PHP - File Sharing System Pdo Help!

HI all,

this is a strange request so bear with me. I have setup a server on my local machine, what I want to do is scrape info off the real server out on the internet in some of the pages.

I have that working using curl for different domains, but the issue is I have a 127.0.0.1 host entry for the domain in question because the local server name has to match the real server name for the application to run.

I can get the real IP using a shell ie: echo exec('nslookup example.com 1.1.1.1'); but I don't know how to get curl to use that IP or force curl to use a different name server, any ideas?

CURL code:

thanks in advance!!

$url = "http://example.com/index.php";


$fields = [
    'id'      => '1234'
   
];


$fields_string = http_build_query($fields);

$ch = curl_init();

curl_setopt($ch,CURLOPT_URL, $url);
curl_setopt($ch,CURLOPT_POST, true);
curl_setopt($ch,CURLOPT_POSTFIELDS, $fields_string);
curl_setopt($ch,CURLOPT_RETURNTRANSFER, true); 

$result = curl_exec($ch);
echo $result;

<?php
include("config.inc.php");

if ($_SERVER['REQUEST_METHOD'] == "POST") 
{

 include("config.inc.php");
    if(!$_POST) {
    header("Location: preexport.php");
    exit();
} 

 
    // initialization
    $result_final = "";
    $counter = 0;

// List of our known photo types
    $known_photo_types = array(
                        'image/pjpeg' => 'jpg',
                        'image/jpeg' => 'jpg',
                        'image/gif' => 'gif',
                        'image/bmp' => 'bmp',
                        'image/x-png' => 'png'
                    );
   
// GD Function List
    $gd_function_suffix = array(
                        'image/pjpeg' => 'JPEG',
                        'image/jpeg' => 'JPEG',
                        'image/gif' => 'GIF',
                        'image/bmp' => 'WBMP',
                        'image/x-png' => 'PNG'
                    );
 
// Fetch the photo array sent by preexport.php
    $photos_uploaded = $_FILES['photo_filename'];
    $filename[]= $photos_uploaded['name'][$counter];
	//print_r($photos_uploaded);
  $photo_caption = $_POST['photo_caption'];

// Fetch the photo caption array
    $photo_description = $_POST['photo_description'];

// Fetch the photo caption array
    $photo_keyword = $_POST['photo_keyword'];
     
    while( $counter <count($_FILES['photo_filename']['tmp_name']) ) 
{
        if($photos_uploaded['size'][$counter] > 0)
        {
            if(!array_key_exists($photos_uploaded['type'][$counter], $known_photo_types))
            {
                $result_final .= "File ".($counter+1)." is not a photo<br />";
            }
            else
            {
			
			/*print "HHHHHH\n";
			print "Counter is $counter : ";
			print $photos_uploaded['name'][0];
			print $photos_uploaded['name'][1];
			print "Photo caption is $photo_caption[$counter]"; */
                mysqli_query(
                    $mysqli,"INSERT INTO
                        gallery_photos (
                    `photo_filename`,
		    `photo_caption`,
                    `photo_description`,
		    `photo_keywords`,
                    `category_name`
                    ) VALUES(
		        '".addslashes($photos_uploaded['name'][$counter])."',
                        '".addslashes($photo_caption[$counter])."',
                        '".addslashes($photo_description[$counter])."',
                        '".addslashes($photo_keyword[$counter])."',
                        '".addslashes($_POST['category'])."')"
                    ) or die(mysqli_error() . 'Photo not uploaded');
                   
               // $new_id = mysqli_insert_id();
                $filetype = $photos_uploaded['type'][$counter];
				
                $extention = $known_photo_types[$filetype];
                //$filename = $photo_filename[$counter].".".$extention;
		//$filename = $new_id.".".$extention;
 
              //  mysqli_query( "UPDATE gallery_photos SET photo_filename='".addslashes($filename)."' WHERE photo_id='".addslashes($new_id)."'" );
 
                // Store the orignal file
				
                copy($photos_uploaded['tmp_name'][$counter], $images_dir."/".$photos_uploaded['name'][$counter]);
 
                // Let's get the Thumbnail size
                $size = GetImageSize( $images_dir."/".$photos_uploaded['name'][$counter] );
                if($size[0] > $size[1])
                {
                    $thumbnail_width = 200;
                    $thumbnail_height = (int)(200 * $size[1] / $size[0]);
                }
                else
                {
                    $thumbnail_width = (int)(200 * $size[0] / $size[1]);
                    $thumbnail_height = 200;
                }
           
                // Build Thumbnail with GD 1.x.x, you can use the other described methods too
                $function_suffix = $gd_function_suffix[$filetype];
                $function_to_read = "ImageCreateFrom".$function_suffix;
                $function_to_write = "Image".$function_suffix;
 
                // Read the source file
                $source_handle = $function_to_read ( $images_dir."/".$photos_uploaded['name'][$counter] );
				
				$sharpenMatrix = array
                (
                    array(-1.2, -1, -1.2),
                    array(-1, 8, -1),
                    array(-1.2, -1, -1.2)
                );
 
                // calculate the sharpen divisor
                $divisor = array_sum(array_map('array_sum', $sharpenMatrix));          
 
                $offset = 0;
               
                if($source_handle)
                {
                    // Let's create an blank image for the thumbnail
                        $destination_handle = ImageCreateTrueColor ( $thumbnail_width, $thumbnail_height );
               
                    // Now we resize it
                    ImageCopyResized( $destination_handle, $source_handle, 0, 0, 0, 0, $thumbnail_width, $thumbnail_height, $size[0], $size[1] );
                }
 
                // Let's save the thumbnail
                $function_to_write( $destination_handle, $images_dir."/tb_".$photos_uploaded['name'][$counter], 100 );
                ImageDestroy($destination_handle );
                //

           
               
 
                $result_final .= "<img src='".$images_dir. "/tb_".$photos_uploaded['name'][$counter]."' /> File ".($counter+1)." Added<br />";
            }
        }
    $counter++;
    }
 
    // Print Result
echo <<<__HTML_END
 
<html>
<head>
    <title>Photos uploaded</title>
</head>
<body>
    $result_final
</body>
</html>
 
__HTML_END;

}
?>

<?php
 include 'config.inc.php';
 
  $photo_category_list = '';
 $photo_upload_fields = '';
 $counter = 1;
 
 // If we want more fields, then use, preexport.php?number_of_fields=9
 $number_of_fields = (isset($_GET['number_of_fields'])) ?
   (int)($_GET['number_of_fields']) : 9;
 
 // Firstly Lets build the Category List
 $result = mysqli_query($mysqli,'SELECT category_name FROM gallery_category');
 /*if($result === FALSE) {
    die(mysqli_error()); // TODO: better error handling
}*/
 while($row = mysqli_fetch_array($result)) {
   $photo_category_list .= <<<__HTML_END
<option value="$row[0]">$row[0]</option>\n
__HTML_END;
 }
 mysqli_free_result( $result ); 
 
 // Lets build the Image Uploading fields
 while($counter <= $number_of_fields) {
   $photo_upload_fields .= <<<__HTML_END
<tr><td>
 Photo {$counter}:
 <input name="photo_filename[]"
type="file" />
</td></tr>
<tr><td>
 Caption:
 <textarea name="photo_caption[]" cols="50"
   rows="1"></textarea>
</td></tr>
<tr><td>
 Description:
 <textarea name="photo_description[]" cols="50"
   rows="4"></textarea>
</td></tr>
<tr><td>
 Keyword:
 <textarea name="photo_keyword[]" cols="50"
   rows="4"></textarea>
</td></tr>
__HTML_END;
   $counter++;
 }
 
 // Final Output
 echo <<<__HTML_END
<html>
<head>
<title> Rajeev lets upload photos!! </title>
</head>
<body>
<form enctype="multipart/form-data"
 action="export.php" method="post"
 name="export_form">
 <table width="90%" border="0"
   align="center" style="width: 90%;">
   <tr><td>
     Select Category
     <select name="category">
     $photo_category_list
     </select>
   </td></tr>
   <!&#8212;Insert the image fields here -->
   $photo_upload_fields
   <tr><td>
     <input type="submit" name="submit"
       value="Add Photos" />
   </td></tr>
 </table>
</form>
</body>
</html>
__HTML_END;
?>

<?php
$confId = $_GET['confession'];
$viewIp = $_SERVER['REMOTE_ADDR'];


// Get the Full Page URL
$pageURL = (isset($_SERVER['HTTPS']) ? "https" : "http")."//".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];


$count = 0;
$hasViewed = '';
$msgBox = '';


// Get the File Uploads Folder from the Site Settings
$uploadsDir = $set['uploadPath'];


// Check if Moderation is On
$moderated = $set['moderation'];


// Check if Profanity Filter is On
$filterProfanity = $set['useFilter'];


$chkViews = mysqli_query($mysqli,"SELECT 'X' FROM views WHERE confessId = ".$confId." AND viewIp = '".$viewIp."' LIMIT 1");
$hasView = mysqli_num_rows($chkViews);
if ($hasView == 0) { $hasViewed = '0'; }
$viewDate = date("Y-m-d H:i:s");


if ($hasViewed == '0') {
$stmt = $mysqli->prepare("
INSERT INTO
views(
confessId,
viewIp,
viewDate
) VALUES (
?,
?,
?
)
");
$stmt->bind_param('sss',
$confId,
$viewIp,
$viewDate
);
$stmt->execute();
}


// Add New Comment
    if (isset($_POST['submit']) && $_POST['submit'] == 'addComment') {
        // Validation
if($_POST['commentText'] == "") {
            $msgBox = alertBox($commentsReq, "<i class='fa fa-times-circle'></i>", "danger");
        } else if($_POST['answer'] == "") {
            $msgBox = alertBox($captchaCodeReq, "<i class='fa fa-times-circle'></i>", "danger");
        } else if ($_POST['hole'] != '') {
$msgBox = alertBox($commentsErrorMsg, "<i class='fa fa-times-circle'></i>", "danger");
$_POST['firstName'] = $_POST['commentText'] = $_POST['answer'] = '';
} else {
$commentText = htmlentities($_POST['commentText']);
$usersId = $mysqli->real_escape_string($_POST['usersId']);
if ($_POST['firstName'] == '') {
$firstName = null;
} else {
$firstName = $mysqli->real_escape_string($_POST['firstName']);
}
$commentDate = date("Y-m-d H:i:s");


// Moderation Check
if ($moderated == '1') { $isActive = '0'; } else { $isActive = '1'; }


// Check if the poster is a logged in user
if (isset($_SESSION['userId'])) {
$user = $_SESSION['userId'];
} else {
$user = '0';
}


if(strtolower($_POST['answer']) == $_SESSION['thecode']) {
$stmt = $mysqli->prepare("
INSERT INTO
comments(
confessId,
userId,
firstName,
comments,
commentDate,
isActive,
commentIp
) VALUES (
?,
?,
?,
?,
?,
?,
?
)
");
$stmt->bind_param('sssssss',
$confId,
$user,
$firstName,
$commentText,
$commentDate,
$isActive,
$viewIp
);
$stmt->execute();


if ($moderated == '1') {
$msgBox = alertBox($commentsSavedMsg1, "<i class='fa fa-check-square'></i>", "success");
} else {
$msgBox = alertBox($commentsSavedMsg2, "<i class='fa fa-check-square'></i>", "success");
}
// Clear the Form of values
$_POST['firstName'] = $_POST['commentText'] = $_POST['answer'] = '';
$stmt->close();
} else {
$msgBox = alertBox($captchaErrorMsg, "<i class='fa fa-warning'></i>", "warning");
}


// If the confession is posted by a user
if ($usersId != '0') {
$uemail = "SELECT userEmail, recEmails FROM users WHERE userId = ".$usersId;
$remail = mysqli_query($mysqli, $uemail) or die('-1' . mysqli_error());
$e = mysqli_fetch_assoc($remail);
$userEmail = $e['userEmail'];
$recEmails = $e['recEmails'];


// If the users has opted in to receive notifications
if ($recEmails == '1') {
// Send out the email in HTML
$installUrl = $set['installUrl'];
$siteName = $set['siteName'];
$siteEmail = $set['siteEmail'];


$subject = $newCommentEmailSubject;
$message = '<html><body>';
$message .= '<h3>'.$subject.'</h3>';
$message .= '<hr>';
$message .= '<p>'.nl2br($commentText).'</p>';
$message .= '<hr>';
$message .= '<p>'.$newCommentEmail1.' '.$pageURL.'</p>';
$message .= '<p>'.$subscribeEmail3.'<br>'.$siteName.'</p>';
$message .= '</body></html>';
$headers = "From: ".$siteName." <".$siteEmail.">\r\n";
$headers .= "Reply-To: ".$siteEmail."\r\n";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: text/html; charset=ISO-8859-1\r\n";


mail($userEmail, $subject, $message, $headers);
}
}
}
}


// Get Confession
$select = "SELECT
confessId,
userId,
(IFNULL(firstName, '')) AS firstName,
confessText,
DATE_FORMAT(postDate,'%b %d %Y %h:%i %p') AS postDate,
hasImage,
isActive,
(SELECT COUNT(*) FROM views WHERE views.confessId = confessions.confessId ) as totalViews,
(SELECT COUNT(*) FROM likes WHERE likes.confessId = confessions.confessId ) as totalLikes,
(SELECT COUNT(*) FROM dislikes WHERE dislikes.confessId = confessions.confessId ) as totalDislikes
FROM
confessions
WHERE confessId = ".$confId;
$res = mysqli_query($mysqli, $select) or die('-1' . mysqli_error());
$row = mysqli_fetch_assoc($res);


if ($row['totalViews'] == '1') { $viewText = $singleViewText; } else { $viewText = $multipleViewsText; }
$shareURL = $set['installUrl'].'page.php?page=view&confession='.$row['confessId'];
$googleURL = $set['installUrl'];


// Get Comments
$qry = "SELECT
commentId,
confessId,
(IFNULL(firstName, '')) AS fName,
comments,
DATE_FORMAT(commentDate,'%b %d %Y %h:%i %p') AS commentDate,
isActive
FROM
comments
WHERE
confessId = ".$confId." AND
isActive = 1
ORDER BY commentId DESC";
$results = mysqli_query($mysqli, $qry) or die('-2'.mysqli_error());


include('includes/header.php');
?>
<section id="main-container">
<div class="container">
<?php if ($msgBox) { echo $msgBox; } ?>


<div class="confessbox">
<div class="confession">
<?php
if ($row['hasImage'] == '1') {
// Get Image
$sqlStmt = "SELECT uploadId, confessId, uploadUrl FROM uploads WHERE confessId = ".$confId;
$sqlres = mysqli_query($mysqli, $sqlStmt) or die('-2'.mysqli_error());
$col = mysqli_fetch_assoc($sqlres);


//Get File Extension
$ext = substr(strrchr($col['uploadUrl'],'.'), 1);
$imgExts = array('gif', 'GIF', 'jpg', 'JPG', 'jpeg', 'JPEG', 'png', 'PNG', 'tiff', 'TIFF', 'tif', 'TIF', 'bmp', 'BMP');


if (in_array($ext, $imgExts)) {
echo '<p class="mb-20"><img alt="'.$confImageAlt.'" src="'.$uploadsDir.$col['uploadUrl'].'" class="img-responsive" /></p>';
}
}
?>
<p>
<i class="fa fa-quote-left"></i>
<?php
if ($filterProfanity == '1') {
echo nl2br(clean(filterwords($row['confessText'])));
} else {
echo nl2br(clean($row['confessText']));
}
?>
<i class="fa fa-quote-right"></i>
</p>
<input type="hidden" id="confessId" name="confessId_<?php echo $count; ?>" value="<?php echo $row['confessId']; ?>" />
<div class="confession-footer">
<div class="likes">
<span class="label label-confess first liked">
<a href="" id="likeIt<?php echo $row['confessId']; ?>" class="likeIt_<?php echo $count; ?> text-success">
<i class="fa fa-smile-o"></i> <span id="likesVal_<?php echo $count; ?>"><?php echo $row['totalLikes']; ?></span>
</a>
</span>
</div>
<div class="dislikes">
<span class="label label-confess disliked">
<a href="" id="dislikeIt<?php echo $row['confessId']; ?>" class="dislike_<?php echo $count; ?> text-danger">
<span id="dislikesVal_<?php echo $count; ?>"><?php echo $row['totalDislikes']; ?></span> <i class="fa fa-frown-o"></i>
</a>
</span>
</div>
<span class="label label-confess"><?php echo timeago($row['postDate']); ?></span>
<span class="label label-confess last"><?php echo $row['totalViews'].' '.$viewText; ?></span>
<a href="https://twitter.com/intent/tweet?text=<?php echo $set['siteName']; ?>%20Confession:%20<?php echo ellipsis($row['confessText'],65); ?>%20&url=<?php echo $shareURL; ?>" class="btn btn-tw btn-sm" target="_blank" data-toggle="tooltip" data-placement="top" title="<?php echo $twitterShareTooltip; ?>">
<i class="fa fa-twitter"></i>
</a>
<a href="https://plus.google.com/share?url=<?php echo $googleURL; ?>" class="btn btn-gp btn-sm" target="_blank" data-toggle="tooltip" data-placement="top" title="<?php echo $googleShareTooltip; ?>">
<i class="fa fa-google-plus"></i>
</a>
<span class="label label-confess last hasVoted text-danger"><strong><?php echo $onlyVoteOnceText; ?></strong></span>
<div class="comments">
<?php if ($row['firstName'] != '') { ?>
<span class="label label-confess last"><?php echo $postedByText.' '.clean($row['firstName']); ?></span>
<?php } else { ?>
<span class="label label-confess last"><?php echo $postedByAnon; ?></span>
<?php } ?>
</div>
</div>
<div class="clearfix"></div>
</div>
</div>


<?php if(mysqli_num_rows($results) > 0) { ?>
<hr />
<div class="commentbox">
<?php while ($rows = mysqli_fetch_assoc($results)) { ?>
<div class="comment">
<p>
<?php
if ($filterProfanity == '1') {
echo nl2br(clean(filterwords($rows['comments'])));
} else {
echo nl2br(clean($rows['comments']));
}
?>
</p>
<?php if ($rows['fName'] != '') { ?>
<span class="label label-comments"><?php echo clean($rows['fName']).' '.$commentedText.' '.timeago($rows['commentDate']); ?></span>
<?php } else { ?>
<span class="label label-comments"><?php echo $anonCommented.' '.timeago($rows['commentDate']); ?></span>
<?php } ?>
</div>
<?php } ?>
</div>
<?php } ?>


<hr />


<form action="" method="post" class="comment-form mt-30">
<div class="form-group">
<textarea class="form-control" name="commentText" id="commentText" rows="4" required="" placeholder="<?php echo $addCommentsField; ?>"><?php echo isset($_POST['commentText']) ? $_POST['commentText'] : ''; ?></textarea>
</div>
<div class="row">
<div class="col-md-4">
<div class="form-group">
<input type="text" class="form-control" name="firstName" placeholder="<?php echo $firstNamePlaceholder; ?>" value="<?php echo isset($_POST['firstName']) ? $_POST['firstName'] : ''; ?>">
</div>
</div>
<div class="col-md-4"></div>
<div class="col-md-4">
<div class="row">
<div class="col-md-4">
<img src="includes/captcha.php" id="captcha" data-toggle="tooltip" data-placement="left" class="pull-right" title="<?php echo $captchaCodeTooltip; ?>" />
</div>
<div class="col-md-8">
<div class="form-group">
<input type="text" class="form-control" name="answer" required="" maxlength="6" placeholder="<?php echo $captchaCodeTooltip; ?>">
</div>
</div>
</div>
</div>
</div>
<div class="row">
<div class="col-md-8">
<p><?php echo $commentsQuip1; ?><strong><?php echo $isOn; ?></strong>. <?php echo $commentsQuip2; ?> <strong><?php echo $filtered; ?></strong>.</p>
</div>
<div class="col-md-4">
<input type="hidden" name="hole" id="hole" />
<input type="hidden" name="usersId" value="<?php echo $row['userId']; ?>" />
<button type="input" name="submit" value="addComment" class="btn btn-fessup btn-lg pull-right btn-icon"><i class="fa fa-check-square-o"></i> <?php echo $saveCommentsBtn; ?></button>
</div>
</div>
</form>


</div>
</section>

<?php

require 'connect.php';

if(isset($_POST['submit'])) {

	$username = $_POST['username'];
	$password = $_POST['password'];

	//Prevent hackers from using SQL Injection
	$username = stripslashes($username);
	$password = stripslashes($password);
	$username = mysql_real_escape_string($username);
	$password = mysql_real_escape_string($password);

	$sql = "SELECT * FROM $tbl_name WHERE username='$username' AND password='$password'";
	$result = mysql_query($sql);
	$count = mysql_num_rows($result);

	$user_level = $_GET['user_level'];

	$_SESSION['user_level'] = $user_level;

	if($count == 1) {

		$_SESSION['username'];
		$_SESSION['password'];
		header("Location: index.php");
	} else {

		echo "Please check the username and password you entered is correct.";
	} if($_SESSION['user_level'] == 0) {
		$_SESSION['username'];
		$_SESSION['password'];
		header("Location: index.php");
		
	} else if($_SESSION['user_level'] == -1) {

		die();
		header("Location: banned.php");

	} else if($_SESSION['user_level'] < -1) {
		die();
		echo "An error has occurred please contact your administrator.";

	} else if($_SESSION['user_level'] == 1) {
		$_SESSION['username'];
		$_SESSION['password'];
		header("Location: admin.php");

	}


}

?>

Hi all

I have been looking though loads of tutorials regarding log in method for websites (not APIs), and cant help find that they are outdated.

So I am asking what is the correct way to create a log in system using php?

Modern websites use JavaScript for asynchronous web requests so this requirement should also be catered for. APIs and mobile apps use access tokens which is very secure if implemented correctly.

Can we use the token principle for websites? As the way I see it that most php log in systems use php sessions and they create a session and save some data in this session when the user successfully authenticates, however the session id is held in a cookie so if the cookie is stolen then they have access to your account.

API access tokens are expired and refreshed periodically so is there such a implementation method for web sites too?

<?php


include_once 'db_connect.php';
include_once 'functions.php';


sec_session_start(); // Our custom secure way of starting a PHP session.


if (isset($_POST['email'], $_POST['p'])) {
    $email = $_POST['email'];
    $password = $_POST['p']; // The hashed password.


$page = login($email, $password, $mysqli);
if ($page == true) {
  // Login success        
  header('Location: '. $page);
   exit();


    } else {
        // Login failed 
        header('Location: ../error.php?error=1');
    }
} else {
    // The correct POST variables were not sent to this page. 
    echo 'Invalid Request';
}