PHP - Site Infected Or Is This Real Code?

This topic has been moved to Miscellaneous.

http://www.phpfreaks.com/forums/index.php?topic=317142.0

hi guys,

i just finished highschool starting to do webdesign at uni, and for one of my major project i want to make a search engine as simple as google that searches for example 10 websites and with the keyword given it brings out the results.

im doing a website on jetski sales results so if someone want to buy a jetski they come to this website and just choose the choose one from those 10 website without going to them individually. so it brings out all search resuts in a nice results format, and when you click on each results it take you to the website but i wanna be able to show their photo and price so just like brings their results into your site but combing 10 website results.

and i need to have an advance search option where they can search year price age of jetski, and all these variables are also in the 10 websites that im getting the results from.

i have been doing some searching and i cant get my head around i need some help LOL i dont wanna fail...

cheers guys

Hi

I'm currently in the process of re-developing a website for a client in Wordpress. I've completed the work apart from the fact that on the old site the client has a webpage with an email subscription form for subscribing to a newsletter. The form takes a 'Name' and 'Email Address' and writes these to a MySQL database in the back end.

I've tried adding the code to a page in wordpress and have a few plugins which allow PHP code execution on both the sidebar and page but when the button is clicked to submit the subscription nothing appears to happen as on the origonal page.

I really need to know whether this type of code could be imported into Wordpress and made to work or how to go about writing a wordpress page that will write to the same database.

Any advice on this would be helpful as I'm not a strong php coder.

The Code is as follows:

There's a contact.php page on the origoanl site that calls inc-mailing-list.php that also referrences a mysqlconnections.php file

I've put all the code below for referrence.

Origonal Site: contact.php
Code: <?php
session_start();
$string = strtoupper($_SESSION['string']);
$userstring = strtoupper($_POST['userstring']);
session_destroy();

?>

HTML PAGE FORMATTING (REMOVED FOR THE POST)

<?php include("inc-mailing-list.php"); ?></TD>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-9716450-1");
pageTracker._trackPageview();
} catch(err) {}</script></body>

</html>


INC-MAILING-LIST.PHP

<?php require_once('Connections/mysqlconnection.php'); ?>
<?php

/* In contact.php
session_start();
$string = strtoupper($_SESSION['string']);
$userstring = strtoupper($_POST['userstring']);
session_destroy(); 
*/

///// Anti sql injection
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
  $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;   
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}
//// Site config
$siteName = "South Wales Art Society";
$siteURL = "www.southwalesartsociety.co.uk";
$siteEmail = "info@southwalesartsociety.co.uk";

///// Establish the current date/time as a variable
$now = date('Y-m-d H:i:s'); // Current date

//// Call mailing lists
mysql_select_db($database_mysqlconnection, $mysqlconnection);
$query_callMailingLists = "SELECT * FROM content WHERE contenttype = 501 AND onlinestatus = '1' ORDER BY displayorder ASC";
$callMailingLists = mysql_query($query_callMailingLists, $mysqlconnection) or die(mysql_error());
$row_callMailingLists = mysql_fetch_assoc($callMailingLists);
$totalRows_callMailingLists = mysql_num_rows($callMailingLists);



//// Unsubscribe
if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "elist") && ($_POST["subscription"] == "unsubscribe") && (strlen($_POST["email"]) > 4) && ($string == $userstring) && (strlen($string) > 4)) {

  $deleteSQL = sprintf("DELETE FROM content WHERE email=%s AND contenttype = 500", GetSQLValueString($_POST['email'], "text"));

  mysql_select_db($database_mysqlconnection, $mysqlconnection);
  $Result1 = mysql_query($deleteSQL, $mysqlconnection) or die(mysql_error());
  $status = "1";
 
 
 
//SEND CONFIRMATION EMAIL
   
$to      = $_POST['email'];
$subject = $siteName.' Mailing List';
$body = 'Your email address has been removed from the '.$siteName.' mailing list.' . "\n\r";
$body .= $siteURL . "\n\r";       
$headers = 'From: '.$siteEmail . "\r\n" .
           'X-Mailer: PHP/' . phpversion();
       
mail($to, $subject, $body, $headers);



}


/////////////////// SUBSCRIPTION ////////////////////////



// Insert comment if sent and valid
if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "elist") && ($_POST["email"] != "") && ($_POST["subscription"] == "subscribe") && ($string == $userstring) && (strlen($string) > 4)) {

////////////////////////////////////////////////////////////////////////////////////
///////////////////////////// COUNT AND JOIN TAGS //////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////
$tagCombination1 = ""; // Default value to define variable.
$tagTotal = ""; // Default value to define variable.
if (isset($_POST['TagsTotal1'])) { $tagTotal = $_POST['TagsTotal1'];}
$tagNumber = 0;

do { $tagNumber = $tagNumber+1;

if (isset($_POST['Tag-1-'.$tagNumber])) $tagCombination1 = $tagCombination1.",".$_POST['Tag-1-'.$tagNumber]; // DISREGARD UNSELECTED TAGS

} while ($tagNumber <= $tagTotal); // LOOP UNTIL ALL TAGS HAVE BEEN COMBINED

$tagCombination1 = $tagCombination1.","; // ADD A COMMA TO THE END TO GET CORRECT SEARCH PARAMETERS
$tagCombination1 = str_replace(",,",",",$tagCombination1); // CLEAR OUT ANY DOUBLE COMMAS
////////////////////////////////////////////////////////////////////////////////////
/////////////////////////// COUNT AND JOIN TAGS END ////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////

  $insertSQL = sprintf("INSERT INTO content (contenttype, title1, email, date_added, tags1) VALUES (%s, %s, %s, %s, %s)",
                       GetSQLValueString(500, "int"),
                       GetSQLValueString($_POST['name'], "text"),
                       GetSQLValueString($_POST['email'], "text"),
                       GetSQLValueString($now, "text"),
                       GetSQLValueString($tagCombination1, "text"));

  mysql_select_db($database_mysqlconnection, $mysqlconnection);
  $Result1 = mysql_query($insertSQL, $mysqlconnection) or die(mysql_error());
  $status = "2";
 
 
 
//SEND CONFIRMATION EMAIL
   
$to      = $_POST['email'];
$subject = $siteName.' Mailing List';
$body = 'Thank you. Your name has been added to the '.$siteName.' mailing list.' . "\n\r";
$body .= $siteURL . "\n\r"; 
$headers = 'From: '.$siteEmail . "\r\n" .
           'X-Mailer: PHP/' . phpversion();
       
mail($to, $subject, $body, $headers);



}
?>

<div id="signup" >
<H5>Sign Up For Our Mailing List</H5>

<?php if (($_POST['email']) && ($status == "1")) { ?>
<br /><strong>Thank you, you have been removed from the mailing list.</strong>

<?php } elseif (($_POST['email']) && ($status == "2")) { ?>
<br /><strong>Thank you, you have been added to the mailing list.</strong>

<?php } else { ?>


<form name="elist" method="POST" action="">
<?php if (($_POST['email']) && ($status != "2")) { ?><p class="red"><strong>Please complete your details and enter the code.</strong></p><?php } // Error ?>

<br />

Name: <input name="name" type="text" value="<?php echo $_POST['name']; ?>" /><br />
Email: <input name="email" type="text" value="<?php echo $_POST['email']; ?>" /><br />

<input name="subscription" type="radio" id="subscription_0" value="subscribe" <?php if($_GET['unsubscribe']!="yes") { ?>checked="checked"<?php } // ?> />
Subscribe<br />
<input type="radio" name="subscription" value="unsubscribe" id="subscription_1" <?php if($_GET['unsubscribe']=="yes") { ?>checked="checked"<?php } // ?>/>
Unsubscribe<br />

<br />

<?php /*?>Select which information you would like to receive:<br />
      
<?php $tagNumbers = 0; do { $tagNumbers = $tagNumbers+1;?>
<label><input <?php if (!(strcmp($row_callMailingLists['id'],1000))) {echo "checked=\"checked\"";} ?> name="Tag-1-<?php echo $tagNumbers; ?>" type="checkbox" value="<?php echo $row_callMailingLists['id']; ?>" /><?php echo $row_callMailingLists['title1']; ?></label><br />
<?php } while ($row_callMailingLists = mysql_fetch_assoc($callMailingLists)); ?><br /><br />

<input type="hidden" name="TagsTotal1" value="<?php echo $totalRows_callMailingLists; ?>" />

USE THE TWO HIDDEN FIELDS BELOW AS THERE IS ONLY ONE LIST

<?php */?>
<input type="hidden" name="Tag-1-1" value="1000" />
<input type="hidden" name="TagsTotal1" value="1" />
 
<img src="/captcha/imagebuilder.php" alt="" border="0" /><br /><br />

<small>Please enter the code shown above.</small><br />

<input maxlength="8" size="8" name="userstring" type="password" value="" /><br /><br />

<input name="Submit" type="submit" value="Submit" /><br />


<input type="hidden" name="datesubscribed" value="<?php echo date('Y-m-d H:i:s'); ?>" />
<input type="hidden" name="MM_insert" value="elist" />
</form>
</div>
<?php } // ?>
<?php
mysql_free_result($callMailingLists);
?>

hello dear friends


if we want to put a facebook-fanbox on a wordpress-page - so that it looks like this he

http://www.designche...ial-media-tabs/


 we can go like so:
 
we take the test from the facebook-deeloper site:

https://developers.f...e-box-for-pages

Initialize the JavaScript SDK using this app: books-page...

<div id="fb-root"></div>
<script>(function(d, s, id) {
  var js, fjs = d.getElementsByTagName(s)[0];
  if (d.getElementById(id)) return;
  js = d.createElement(s); js.id = id;
  js.src = "//connect.facebook.net/en_GB/sdk.js#xfbml=1&appId=473241986032774&version=v2.0";
  fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));</script>

Include the JavaScript SDK on your page once, ideally right after the opening <body> tag.
 

or do i need to inclue this

<div class="fb-like-box" data-href="https://www.facebook.com/FacebookDevelopers"
data-colorscheme="light" data-show-faces="true" data-header="true"
data-stream="false" data-show-border="true"></div>`

love to hear from you

 

I have a Google Adsense code that I am saving to the wp_options table. I can successfully save and retrieve the variable containing the google adsense code but it doesn't do anything except display it as plain text on screen.

Getting an unexpected end error on this and unsure as to why.

Code: [Select]
<?php if($players['is_banned'] == 1) { ?>
<a href="profile.php?id=<?php echo $players['id'] ?>"><?php echo $players['name']  ?> (BANNED)
<? }else{ ?>
<a href="profile.php?id=<?php echo $players['id'] ?>"><?php echo $players['name']  ?>
<? } ?>

I am trying to send an html file (with .js formatting) to the browser from within a PHP script.  The .js formatting is not being interpreted and so the result in the browser is less than impressive.  Why can't I make a call, in PHP, to a url and have the results from that call directed to the browser?

Hello guys,

I have been searching on the internet for articles that shows me how to get the real IP address when they are behind a proxy. But after some reading it seems that this is not completely possible. Correct me if I'm wrong.

So what is the best thing to do? Because I have seen different methodes and I'm not sure which one is the best.

http://www.laughing-buddha.net/php/lib/remoteip

Okay, so this is my first real php script from scratch.

This is the theory of the script I am writing.


Mysql database connect script already done.

So, first things I need to do is connect, right?

<?php
//connect to db
require_once ('includes/connect.php');

//connect to table
$result = mysql_query ("select * FROM shop1");

//display data in table
echo "<table border='1'><tr><td>Shop</td><td>city</td><td>members</td></tr>";

while($row = mysql_fetch_array($result))
{

echo "<tr>";

echo "<td>" . $row['name'] . "</td>";

echo "<td>" . $row['city'] . "</td>";

echo "<td>" . $row['members'] . "</td>";

echo "</tr>";
}

echo "</tr></table>";

?>

Displays this, http://67.23.249.45/~gaogier/shop1.php

What do you think so far?



Whats still to come.

How do I link 2 tables together?
   I mean, I plan to have many shops displayed, then, inside the shop, have the items, which will be linked to each shop.

I plan to link each shop to a different page, which will be displayed like, url/shop/shopname 


If you are confused, i need to have a working shop database that works like this, http://www.tip.it/runescape/?rs2shops

I don't care about styling at the moment, I just want the script to work.

What do I do now?

Hi everyone,

If I have a line like this:
$nfn = $brand . $model;

then when the variable is echoed ($nfn) will come out like nikeair, how can I save it with a space so when echoed it will display nike air?

Cheers

Hi guys, got some questions about the Instagram real-time api. first let me tell you what I want to do. I'd like to run a daemon process with a socket connection or something of the like to the Instagram API to get a constant feed of photos with a certain tag. We estimate it to be a large amount of data at a particular time (thus why we want to go Real-time). This process will parse the feed and store it into a mongodb database.

Secondly, for the front end, I'd like to display all new, live photos in real-time, possible with ajax or some form of checking on a set interval.

Problem being, I can't find anyone doing this with php. All of the resources I have seen use Node.js and Tornado. Has anyone done this with PHP or know of a good Real-time API demonstration/tutorial to get me started?

Here's the documentation... http://instagr.am/developer/realtime/

any help would be greatly appreciated! thanks!

I am trying to get the actual filename so that I can attach it to an email. 

I tried echo $file;  but its not giving me anything.  Just a blank page.  Here's the code that I' working with:

$file = date('M-d-Y  H:i A'). '.png';
$uri =  substr($data,strpos($data,",")+1);
file_put_contents('./Collection_Posts/'.$file, base64_decode($uri));
echo $file;

exit;

 

 

Hello I am having a problem trying to write to a database using mysql real escape so there wont be any injection attacks. I trying using myrealescape and it returns errors:
Code: [Select]
Notice: Use of undefined constant messageTo - assumed 'messageTo' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17

Notice: Use of undefined constant messageSubject - assumed 'messageSubject' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17

Notice: Use of undefined constant messageBody - assumed 'messageBody' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17
I add in the single quotes and it doesn't write either. Dreamweaver says that either single quotes or not there is no syntax errors.

What going on? I have used it like this befo ('$ID','" . mysql_real_escape_string($_POST[post_content]) . "') and no problems..

~AJ


<?php 
require_once('connect.php');

if(isset($_COOKIE['user'])){}else{
header( 'Location: members.php');
}

if (isset($_POST['sendBtn'])){

$messageFrom = $_COOKIE['user'];
$messageTo = $_POST['messageTo'];
$hash = $messageTo.$messageFrom.time();
$hash = md5($hash);

mysql_select_db("majik");

$sql="INSERT INTO messagesystem(ID, hash, messageTo, messageFrom, messageSubject, messageBody, messageDate, messageRead, messageDelete) VALUES ('','$hash','" . mysql_real_escape_string($_POST['messageTo']) . "','$messageFrom','" . mysql_real_escape_string($_POST['messageSubject']) . "','" . mysql_real_escape_string($_POST['messageBody']) . "','0','0')";

echo '<center>Your message was sent to: '.$messageTo.'</center>';


}


?>

Ok so I have a question. is it possible to make a form submit to a DB in real time without the need for a submit button ?  if so could you drop a hint to what it would be caled or a tut / reference to it ?