PHP - I Think Is Php Code Is Causing A Bug In My Application

I've been developing a php application that runs my entire company for the last 4 years. One of the things I never thought of until now is that the server guys or anyone else could copy the source code and db and be able to start up another company which brings up my question to you.... How would you protect your application?

My thought is to create one small php file that is encrypted with something that is required to make the entire site run (not sure at this point what it would be that they couldn't just rebuild). Then if this file sees it's on a different domain/ip it requests data from my site which logs the info for me to look at. If I find out it's something not approved, it would then not allow the program to run and will give a error.

What is your idea?

Hey,
I'm writing an application that tracks attendance. There are multiple events ('events' table), in which members that are present will be found. (When an event file is uploaded, it has all members that attended the event, and adds the event entry in 'events', as well as adding each member to the 'attendance' table, with event_id(eid) and the 'did_attend' value as '1'. When the event is edited, it needs to find the other members that AREN'T in the events table, and add them to the 'attendance' table. When I use this code, it apparently keeps adding the same members. Will a LIMIT 1 stop this? I has about 65,000+ entries added before I stopped the execution of the script.

Thanks!


Code: [Select]
$sql2 = mysql_query("SELECT * FROM members WHERE status=1 ORDER BY mid ASC");
while($row = mysql_fetch_assoc($sql2)){
$sql3 = mysql_query("SELECT * FROM attendance WHERE event='$eid' ORDER BY member ASC");
while($row2 = mysql_fetch_assoc($sql3)){
if($row2[mid] == $row[mid]){
// if the member is in the attendance db, skip
}else{
//if member is not in attendance, write zero--- causing multiple entries (50,000+)

$qry = mysql_query("INSERT INTO attendance (member,event,did_attend) VALUES ('$row[mid]','$eid','0')");
if(!$qry){
die("SQL: ".mysql_error());
}else{
$msg = "<br />Member ".$row[mid]." marked as absent.";
}
}
}
}

I have this function which works except it throws a Notice regarding the 3rd line of the function. The Notice reads "Only variables should be passed by reference..." What am I doing wrong in that 3rd line—$caller = next(debug_backtrace()) [‘function’]; ?
Thanks for any assistance!

//EMAIL_ADMIN
//Sends email to site admin if email testing services fail.
//Only occurs if both primary and secondary services have failed.
//Calls no other function.
//Called by test_email function.
//***************************************************************

function email_admin($email){
    global $full_site_url;//used in links.
    global $site_title;//used in confirmation messages.
    $caller = next(debug_backtrace())['function']; //assigns calling function name to $caller.
    
    if ($caller == 'alt_test_email'){
        //used in email message to provide links for checking services.
        $primary_service = 'http://www.quickemailverification.com';//used in email message.
        $secondary_service = 'http://www.neverbounce.com';//used in email message.

        $to = get_bloginfo('admin_email');
        $subject = 'EMAIL TESTING SERVICES HAVE FAILED!';
        $message = 'Both email testing services have failed. Go to ' . $primary_service . ' and ' . $secondary_service . '.';
        dw_send_email($to, $subject, $message);//call email sending function.
    }
    
    if ($caller == 'unsubscribe'){
        $to = get_bloginfo('admin_email');
        $subject = $site_title . " unsubscribe";
        $message = $email . " has unsubscribed.";
        dw_send_email($to, $subject, $message);//call email sending function.
    }
    
    if ($caller == 'subscribe_form_display'){
        $to = get_bloginfo('admin_email');
        $subject = "New " . $site_title . " subscriber";
        $message = $email . " has subscribed to " . $site_title . ".";
        dw_send_email($to, $subject, $message);//call email sending function.
    }
}

 

I have several pages on my site using the exact same code at the very top, which works fine except for one page:

<?php include_once("../members/dbinfo.php");

The top of dbinfo looks like this:

<?php session_start();
And then the connection strings for the database

However it is giving me this error on this one page:

Quote

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at C:\Inetpub\WebSites\premierathome_com\products\FrenchTalkingDictionary.php:1) in C:\Inetpub\WebSites\premierathome_com\members\dbinfo.php on line 1

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at C:\Inetpub\WebSites\premierathome_com\products\FrenchTalkingDictionary.php:1) in C:\Inetpub\WebSites\premierathome_com\members\dbinfo.php on line 1


Now the session does actually start and doesn't prevent anything from working, I just get those messages. I'm at a loss as to why a different page with the exact same code, save for searching the database for a different product version would have this problem.

I have had this code in place as well which works fine on other pages but doesn't help my problem at all:

if(!isset($_SESSION['OK'])){
session_start();
}
OK being a variable I set up during log in.

I'm at a loss, is anyone able to help me out with this?

Okay, I have no idea how this works out but this is really getting on my nerves.

Here is my logic for the following code. I manually register a user, It goes into the database and dispatches an email notification explaining that a user must activate their account and change their user name (OPTIONAL) and password. In the email, There is an automatically generated password with the username, And a link to activate the account. This leads to stage 1 of the activation process, In this stage the user is accepted, Registered as a verified user and then is sent to another page to change the details like login and password. As far as I know this page works except through trial and error I found that this little snippet of code is causing browsers to show an error 500 page, If I remove this the page works:

<?php
if($messages){

displayErrors($messages);
} else {

echo("<p align=\"center\" class=\"standard\">Your account has been activated.</p><p align=\"center\" class=\"standard\">You now need to change your password. If you like you can also change your username, Remember that you only have 3 days to do so and this change will be permanent.</p>");
}
?>

and this is the displayErrors function:

<?php
function displayErrors($messages) {

print("<p align=\"center\" class=\"standard\">"."<b>There were problems with the previous action:</b>\n<ul>\n");

foreach($messages as $msg){

print("<li>$msg</li>\n");

}

print("</ul>\n"."</p>");
}
?>


The displayErrors function is in a file called functions.php, Which is included in config.php, Which is included in every page including this one.

The entire "Change password and login page thingie" is he


<?php
include("config.php");
global $link, $messages;
require_once('recaptchalib.php');
if($_GET['error']){

$id=$_GET['id'];

$messages[]="There is more than one or no accounts with the verification code you are using. <a href=\"mailto:rentals@nivso.co.uk?subject=Two or no accounts with activation ID of $id\">Click here to email us about this and have the problem sorted.</a>";

doIndex();

exit;
}
if(isset($_POST['submit'])){

if(!isset($_POST['activationid'])){

die("Doesn't exist -.- might as well quit this is *STUFF* -.-");

}

$privatekey = "YOUR NOT HAVING THIS";

$resp = recaptcha_check_answer ($privatekey,

$_SERVER["REMOTE_ADDR"],

$_POST["recaptcha_challenge_field"],

$_POST["recaptcha_response_field"]);

if (!$resp->is_valid) {

$messages[]="The code you entered is incorrect. Please go back and try again!";

doIndex();

exit; // exit or the below lines will be processed.

} else {

//This is where the fun starts!

$login=$_POST['login'];

$passw=$_POST['password'];

$passc=$_POST['passwordc'];

$id2=$_POST['activationid'];

$changinglogin=false;

$get1=excDB("SELECT * FROM `users` WHERE `activeID`='$id2'");

if($get1[0]){ $get1=$get1[1]; } else { die($get1[2]); }

$pro1=mysql_fetch_array($get1);

if($pro1['login']!=$login){

$changinglogin=true;

field_validator("Login", $login, "alphanumeric", 4, 15);

}

field_validator("Password", $passw, "string", 6, 20);

if($passw!=$passc){

$messages[]="The passwords do not match, Please make sure that the passwords are the same!";

}

if($messages){

doIndex();

exit;

}

$passcl=mysql_escape_string($passw);

$passen=md5($passcl);

if($changinglogin){

$wri1=excDB("UPDATE `users` SET `login`='$login', `password`='$passen', `passchange`='1', `loginchange`='1' WHERE `activeID`='$id2';");

if($wri1[0]){ $wri1=$wri1[1]; } else { die($wri1[2]); }

header("Location: login.php?created");

} else {

$wri1=excDB("UPDATE `users` SET `password`='$passen', `passchange`='1', `loginchange`='0' WHERE `activeID`='$id2';");

if($wri1[0]){ $wri1=$wri1[1]; } else { die($wri1[2]); }

header("Location: login.php?created2");

}

}
} else { 

doIndex();
}
function doIndex(){
?>
<!DOCTYPE html>
<head>
<title>Family Rental System! - Rent your DVDs here - Design by Alex, Coding by Gergy008</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link type="text/css" href="css/main.css" rel="stylesheet">
<style type="text/css">
<!--
body {

background-color: #333333;
}
-->
</style></head>
<body style="text-align:center;">
<div class="first">
<div class="backgrounder1"></div>
<div class="headerbar1"></div>
<div class="headerbar2"></div>
</div>
<div align="center">
<table border="0" cellpadding="0" cellspacing="0" width="900">
  <tr>
   <td><img src="images/spacer.gif" width="52" height="1" border="0" alt="" /></td>
   <td><img src="images/spacer.gif" width="123" height="1" border="0" alt="" /></td>
   <td><img src="images/spacer.gif" width="352" height="1" border="0" alt="" /></td>
   <td><img src="images/spacer.gif" width="33" height="1" border="0" alt="" /></td>
   <td><img src="images/spacer.gif" width="55" height="1" border="0" alt="" /></td>
   <td><img src="images/spacer.gif" width="110" height="1" border="0" alt="" /></td>
   <td><img src="images/spacer.gif" width="110" height="1" border="0" alt="" /></td>
   <td><img src="images/spacer.gif" width="50" height="1" border="0" alt="" /></td>
   <td><img src="images/spacer.gif" width="15" height="1" border="0" alt="" /></td>
   <td><img src="images/spacer.gif" width="1" height="1" border="0" alt="" /></td>
  </tr>

  <tr>
   <td colspan="9" background="images/template.slice.1.png">&nbsp;</td>
   <td><img src="images/spacer.gif" width="1" height="20" border="0" alt="" /></td>
  </tr>
  <tr>
   <td colspan="5" background="images/template.slice.2.png">&nbsp;</td>
   <td colspan="2" rowspan="2" background="images/template.slice.3.png"><span class="login"><?php echo(loginHandler()); ?></span></td>
   <td colspan="2" rowspan="3" background="images/template.slice.4.png">&nbsp;</td>
   <td><img src="images/spacer.gif" width="1" height="30" border="0" alt="" /></td>
  </tr>
  <tr>
   <td rowspan="8" background="images/template.slice.5.png">&nbsp;</td>
   <td colspan="2" background="images/template.slice.6.png"><form>
     <div align="center">
       <input name="textfield" type="text" id="textfield" size="40" style="height:16px;">
       <input type="submit" name="button" id="button" value="Search" style="height:20px;">
     </div>
   </form></td>
   <td colspan="2" rowspan="2" background="images/template.slice.7.png">&nbsp;</td>
   <td><img src="images/spacer.gif" width="1" height="30" border="0" alt="" /></td>
  </tr>
  <tr>
   <td colspan="2" rowspan="3" background="images/template.slice.8.png"><p>&nbsp;</p>
    <p>&nbsp;</p></td>
   <td colspan="2" background="images/template.slice.9.png">&nbsp;</td>
   <td><img src="images/spacer.gif" width="1" height="70" border="0" alt="" /></td>
  </tr>
  <tr>
   <td rowspan="2" background="images/template.slice.10.png">&nbsp;</td>
   <td colspan="4" background="images/template.slice.11.png">&nbsp;</td>
   <td rowspan="6" background="images/template.slice.12.png">&nbsp;</td>
   <td><img src="images/spacer.gif" width="1" height="30" border="0" alt="" /></td>
  </tr>
  <tr>
   <td colspan="4" background="images/template.slice.13.png"></td>
   <td><img src="images/spacer.gif" width="1" height="8" border="0" alt="" /></td>
  </tr>
  <tr>
   <td rowspan="4" background="images/template.slice.14.png">&nbsp;</td>
   <td colspan="4" background="images/template.slice.15.png">&nbsp;</td>
   <td colspan="2" rowspan="4" background="images/template.slice.16.png">&nbsp;</td>
   <td><img src="images/spacer.gif" width="1" height="35" border="0" alt="" /></td>
  </tr>
  <tr>
   <td colspan="4" background="images/template.slice.17.png">&nbsp;</td>
   <td><img src="images/spacer.gif" width="1" height="37" border="0" alt="" /></td>
  </tr>
  <tr>
   <td colspan="4" align="center" valign="top" background="images/template.slice.18.png" style="vertical-align:top;"><p class="standard">&nbsp;</p>
     <table width="80%" border="0">
      <tr>
        <td colspan="2">
          <?php
          

if($messages){

//displayErrors($messages);

} else {

//echo("<p align=\"center\" class=\"standard\">Your account has been activated.</p><p align=\"center\" class=\"standard\">You now need to change your password. If you like you can also change your username, Remember that you only have 3 days to do so and this change will be permanent.</p>");

?></td>
        </tr>
      <form name="ChangeDetails" method="post" action="<?=$_SERVER['PHP_SELF']?>">
      <input type="hidden" name="activationid" value="<?php if($_GET['id']){ $id=$_GET['id']; echo($id); } elseif($_POST['activationid']){ $id=$_POST['activationid']; echo($id); } else { die("No ID") } ?>" />
      <tr>
        <td width="50%"><div align="right" class="standard">New Username: </div></td>
        <td width="50%"><input name="login" type="text" id="login" size="35" maxlength="30" /></td>
      </tr>
      <tr>
        <td><div align="right" class="standard">New Password:</div></td>
        <td><input name="password" type="password" id="password" size="35" maxlength="30" /></td>
      </tr>
      <tr>
        <td><div align="right" class="standard">Re-enter password:</div></td>
        <td><input name="passwordc" type="password" id="passwordc" size="35" maxlength="30" /></td>
      </tr>
      <tr>
        <td><div align="right" class="standard">Please enter the code: </div></td>
        <td>

<?php

require_once('recaptchalib.php');

$publickey = "6Le4fsESAAAAAKMOHb8aaiyDfGRJyr0y0EU7dXm-"; // you got this from the signup page

echo recaptcha_get_html($publickey);
            ?>
        </td>
      </tr>
      <tr>
        <td>&nbsp;</td>
        <td><input type="submit" name="submit" id="submit" value="Change your details" /></td>
      </tr>
      </form>
    </table>
     </td>
   <td><img src="images/spacer.gif" width="1" height="450" border="0" alt="" /></td>
  </tr>
  <tr>
   <td colspan="4" background="images/template.slice.19.png">&nbsp;</td>
   <td><img src="images/spacer.gif" width="1" height="50" border="0" alt="" /></td>
  </tr>
  <tr>
   <td colspan="9" background="images/template.slice.20.png">&nbsp;</td>
   <td><img src="images/spacer.gif" width="1" height="40" border="0" alt="" /></td>
  </tr>
</table>
</div>
</body>
</html>
<?php
} ?>


Thanks to all you kind people that take your time to read and help me with this problem. I'm sorry if it is a really simple problem I missed out that makes me look like a right idiot and wasted your time, but that's me I'm always missing stuff out like that, I do proof read though just sometimes not good enough.

Thanks in advance!