Hello! Can nobody help me?

Tony Wolf · Apr 25, 2015

Hi! I have error there, idk what for error i have .. mean somebody hack me with one of they code.. Can you look it on there and fix for me maybe?

<?php
if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])) {
$_SERVER['REMOTE_HOST'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
}
define('SQL_SERVER', '127.0.0.1');
define('SQL_USER', 'root');
define('SQL_PASS','PASS');
define('SQL_DB', 'DB');
function err($errstr = 'unknown')
{
@ob_end_clean();
die('<h1>Error</h1><hr />' . $errstr . '<hr /><i>Xabbo</i>');
}
$__GET = array();
foreach($_GET as $key => $value)
{
$remv = $value;
$blackwords = array("select", "update", "delete", "truncate", "insert", "drop", "create");
foreach($blackwords as $word)
$remv = str_replace($blackwords, "", strtolower($remv));
$__GET[$key] = mysql_real_escape_string(stripslashes($remv));
}
mysql_connect(SQL_SERVER, SQL_USER, SQL_PASS) or err(mysql_error());
mysql_select_db(SQL_DB) or err(mysql_error());
$d = mysql_query('SELECT id FROM users WHERE vk = "' . mysql_real_escape_string($_GET["viewer_id"]) . '" LIMIT 1') or err(mysql_error());
if (mysql_num_rows($d) > 0) {
define('SSO_TICKET', sha1(rand(1000, 9999) . mysql_real_escape_string($_GET["viewer_id"])));
mysql_query('UPDATE users SET auth_ticket = "' . SSO_TICKET . '", ip_last = "' . $_SERVER['REMOTE_HOST'] . '" WHERE vk = ' . mysql_real_escape_string($_GET["viewer_id"]) . ' LIMIT 1') or err(mysql_error());
header("Location: client.php?ticket=" . SSO_TICKET);
die();
}
?>
<!doctype html>
<html>
<head>
<title>Xabbo</title>
<script src="//vk.com/js/api/xd_connection.js?2" type="text/javascript"></script>
<script type="text/javascript" src='
You must be registered for see links
<var script = document.createElement('SCRIPT');
script.src = "
You must be registered for see links
";
document.getElementsByTagName("head")[0].appendChild(script);
function callbackFunc(result) {
alert(result);
}
<script src="
You must be registered for see links
" type="text/javascript">
<script type="text/javascript">
VK.init(function() {
// API initialization succeeded
// Your code here
});
</script>
<script type='text/javascript' src='
You must be registered for see links
</script>
</head>
<body>
</head>
<style>
body
{
text-align: center;
background: #C0E3F0;
padding: 240px 300px;
line-height: 24px;
font-family: Segoe UI;
}
</style>
<h2>Выберите имя:<br />(имя нельзя будет поменять)</h2>
<?php
if (isset($_GET["username"])) {
$username = mysql_real_escape_string(stripslashes($_GET['username']));
echo (preg_match("^[a-zA-Z0-9]*$", $username));
if ($_GET["username"] != $username) {
echo '<div class="msg" id="ij_msg">Имя недоступно!</div>';
} else if (!preg_match("/^[a-zA-Z0-9]*$/", $username)) {
echo '<div class="msg" id="ij_msg">Разрешены только латинские символы и цифры.</div>';
} else if ($username != "" && strlen($username) > 2 && strlen($username) < 17) {
$q2 = mysql_query('SELECT null FROM users WHERE username = "' . mysql_real_escape_string($username) . '"') or die(mysql_error());
if (mysql_num_rows($q2) != 0) {
echo '<div class="msg" id="ij_msg">Имя занято!</div>';
} else {
if (isset($_GET["gender"]) && $_GET["gender"] == "female") {
$gender = "F";
$figure = "lg-720-82.hd-600-1.ch-635-1408.sh-725-1408.hr-545-42";
} else {
$gender = "M";
$figure = "lg-285-82.ch-215-1408.hd-180-1.sh-290-1408.hr-100-61";
}
mysql_query('INSERT INTO users (username, vk, ip_last, ip_reg, account_created, last_online, look, gender) VALUES("' . mysql_real_escape_string($username) . '", "' . mysql_real_escape_string($_GET["viewer_id"]) . '", "' . $_SERVER["REMOTE_HOST"] . '", "' . $_SERVER["REMOTE_HOST"] . '", "' . time() . '", "' . time() . '", "' . $figure . '", "' . $gender . '")') or die(err(mysql_error()));;
mysql_query('INSERT INTO user_info (user_id, bans, cautions, reg_timestamp, login_timestamp, cfhs, cfhs_abusive) VALUES ((SELECT id FROM users WHERE vk = "' . $_GET["viewer_id"] . '"), "0", "0", UNIX_TIMESTAMP(), UNIX_TIMESTAMP(), "0", "0")') or die(err(mysql_error()));;
header('refresh: 0;');
exit();
}
} else {
echo '<div class="msg" id="ij_msg">Имя должно быть от 3 до 16 символов длинной!</div>';
}
}
?>
<form method="get">
<div class="ij_form">
<div class="ij_reg_row">
<input type="text" name="username" class="big_text" id="ij_first_name" value=""><br><br>
<input type="radio" name="gender" value="male">Парень
<input type="radio" name="gender" value="female">Девушка
</div>
<br/>
<input type="hidden" name="viewer_id" value="<?php echo $_GET["viewer_id"] ?>">
<div class="button_blue button_big ij_button">
<button id="ij_submit" type="submit">
<span class="ij_with_arr">Готово</span>
</button>
</div>
</div>
</form></div>
</div>
</body>
</html>

Strangirs · Apr 25, 2015

Is this your client?...
Kinda confused what you're asking for.

Tony Wolf · Apr 25, 2015

Strangirs said:
Is this your client?...
Kinda confused what you're asking for.

Not client.. i have it on social media

ItsNick · Apr 25, 2015

Well, you'd need to post the error the browser is throwing at you. We can't help you if you don't describe the problem... Posting a script with no explanation of what's wrong doesn't help anyone. Please provide more details?

Tony Wolf · Apr 25, 2015

ItsNick said:
Well, you'd need to post the error the browser is throwing at you. We can't help you if you don't describe the problem... Posting a script with no explanation of what's wrong doesn't help anyone. Please provide more details?

script is vurneble or? Because nobody hack me with they.. from linje 33 to 43 i have a error i think,

Ubuntu · Apr 28, 2015

Do you even english?

Hello! Can nobody help me?

Tony Wolf

Member

Strangirs

Member

Tony Wolf

Member

ItsNick

Member

Tony Wolf

Member

Ubuntu

Professional Slag

Users who are viewing this thread

Latest posts

Connect with us

Newest members