[Development] Immortal web

[Nexux]

that will not work in sql 2012 becouse it uses native client 11.0 i just found out that php removed suport for sql 2008 R2 and above so we have to use 2005 or less to get it working .It can be used with 2012 with the drivers they have in microsoft web site but its a pain to make them connect right becouse of php5ts.dll and VC9 sql drivers issue.

I´m going to test with 2005 and see if its working and post a tutorial for everyone.

Btw i was thinking on moving everything centos side to windows side is there a way to use linux progs on windows ?

 

[western]

Now i get it.. when you download drivers(in my case 3.0) from

You must be registered to see links

, the name means..

53 -> php version(5.3.x)
ts -> Means that ts is enabled(THREAD-SAFE=enabled)
vc9 -> Compiler php is VC9

Then i have php(5.4.x), ts is enabled, so i need to copy the file php_sqlsrv_54_ts.dll to php/ext and add the extension in php.ini.
If i try...

<?php
 $serverName = "serverName\SQLEXPRESS";  //serverName\instanceName
 $connectionInfo = array( "Database"=>"PassportBOIOLD", "UID"=>"sa", "PWD"=>"passwordsa");
 $conn = sqlsrv_connect( $serverName, $connectionInfo);
 
 if( $conn ) {
      echo "Connection established.<br />";
 }else{
      echo "Connection could not be established.<br />";
      die( print_r( sqlsrv_errors(), true));
 }
 //phpinfo();
 ?>

Response:

Connection could not be established.<br />Array ( [0] => Array ( [0] => 08001 [SQLSTATE] => 08001 [1] => -1

 => -1             [2] => [Microsoft][SQL Server  Native Client 11.0]SQL Server Network Interfaces: Error Locating  Server/Instance Specified [xFFFFFFFF].              [message] => [Microsoft][SQL  Server Native Client 11.0]SQL Server Network Interfaces: Error Locating  Server/Instance Specified [xFFFFFFFF].          ) ...etc... ) [/QUOTE]

But that's better than "call to undefined function..."

 

[Nexux]

hum going to trie that now

 

[western]

Ok, now is working

<?php
$serverName = "ipmssql or servername";
$connectionInfo = array( "Database"=>"PassportBOIOLD", "UID"=>"sa", "PWD"=>"passwordsa");
$conn = sqlsrv_connect( $serverName, $connectionInfo);
if( $conn ) {
     echo "Connection established.<br />";
     $sql2 = "exec adduser 'master',0xa15b019f7ab9ba0e01482577acb76e90,'prompt','answer','truename',123123,'k@k.com',123123,'province','city',123123,'address',123123,0,'1998/01/01','qq',0xa15b019f7ab9ba0e01482577acb76e90";
     $stmt = sqlsrv_query( $conn, $sql2);
     printf($stmt);
if( $stmt === false ) {
     die( print_r( sqlsrv_errors(), true));
}
}else{
     echo "Connection could not be established.<br />";
     echo "<pre>";
     die( print_r( sqlsrv_errors(), true));
     echo "</pre>";
}
//phpinfo();
?>

 

[Nexux]

sql 2012? what about php_pdo_sqlsrv_54_ts.dll ???

 

[OzzyGT]

I have sql 2008 R2 and it works, it should work with any version unless microsoft changes the protocol or stops using sql syntax.

The only problem is this:

You must be registered to see links

These functions allow you to access MS SQL Server database.

This extension is not available anymore on Windows with PHP 5.3 or later.

So if you're using windows you have to download the driver from microsoft, but again, if you're using windows you should use IIS with ASPX.

 

[Nexux]

IIS with ASPX whats does that mean sorry im new to php

 

[OzzyGT]

IIS = Internet Information Services

You must be registered to see links

ASPX (ASP.NET) it's a framework to make websites or web applications from microsoft, you can choose the programming laguage (Visual Basic or C#)

You must be registered to see links

Both of them are included in Windows Servers althought you have to enable them.

if you're starting with php it should be easier to program with visual basic and if you use visual studio you'll have a GUI to make the website.

It's always a matter of personal opinion but my thoughts are that apache,php and mysql are better for linux and IIS, aspx and mssql are better for windows.

Another thing, if you use that query you posted earlier in a live server, you're going to get hacked ^^

 

[Nexux]

im not using windows server so i have to install them? im guessing asp.net is included in visual studio right?

 

[OzzyGT]

yep, if you have windows 7 ultimate you just need to enable IIS in "Turn Windows features on or off"

asp.net developer tools are included in the full version of visual studio but you can also use "visual web developer express" for free

You must be registered to see links

but it's always better to have the full version without limits.

What I don't understand is why are you making the website in php on windows when for running the server you need a Linux machine and you can use the same machine to host the web page. Also the linux machine is used almost for databases purposes in this game so using it for a webserver it's better than in the windows machine where the "game server" is running and using more resources.

 

[Nexux]

omg your right im going to see how its done in linux if you can help me im greatfull.

 

[western]

My conf, windows 7 32, SQL server 2008 r2 and as webserver i use xampp, last version, is working well and apache didn't crash. Im not at home right now, later tell you how i did it, also you only need php_sqlsrv_54_ts.dll in php/ext

 

[Nexux]

SQL server 2008 r2 express edition?

 

[western]

SQL server 2008 r2 express edition?

Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (Intel X86) Apr 2 2010 15:53:02 Copyright (c) Microsoft Corporation Enterprise Edition on Windows NT 6.1 <X86> (Build 7600: )

1- Download

You must be registered to see links

, install.
2- You need to know php version, thread-safe(in xampp is on) and php compiler(vc6 or vc9), do phpinfo().
3- Next, we need dll, so download them from

You must be registered to see links

.
4- Keep in mind that

• 53 -> php version(5.3.x)
• ts -> Means that ts is enabled(THREAD-SAFE=enabled)
• vc9 -> Compiler php is VC9

If your php version is 5.4 and compiler is VC9, we need php_sqlsrv_54_ts.dll(PHP 5.4 is compiled with VC9), paste the dll to xampp/php/ext and open php.ini(xampp/php), search for the line extension=php_xmlrpc.dll and add this line down extension=php_sqlsrv_54_ts.dll.
5- Start apache, if crashes that means you using wrong dll, if not try using this code:

  <?php
$serverName = "ipmssql or servername";
$connectionInfo = array( "Database"=>"PassportBOIOLD", "UID"=>"sa", "PWD"=>"passwordsa");
$conn = sqlsrv_connect( $serverName, $connectionInfo);
if( $conn ) {
     echo "Connection established.<br />";
     $sql2 = "exec adduser 'username',0xa15b019f7ab9ba0e01482577acb76e90,'prompt','answer','truename',123123,'k@k.com',123123,'province','city',123123,'address',123123,0,'1998/01/01','qq',0xa15b019f7ab9ba0e01482577acb76e90";
     $stmt = sqlsrv_query( $conn, $sql2);
     printf($stmt);
if( $stmt === false ) {
     die( print_r( sqlsrv_errors(), true));
}
}else{
     echo "Connection could not be established.<br />";
     echo "<pre>";
     die( print_r( sqlsrv_errors(), true));
     echo "</pre>";
}
//phpinfo();
?>

If authenticate and connect it will reply, if not well you know.. Connection could not be established.. but that means the dll is the right one. If you still getting this connection cannot be established... open SQL management studio, login, right click on servername->properties->connection->enable "Allow remote conections", restart mssql service.

 

[Nexux]

i get this error now

Connection established.
Array ( [0] => Array ( [0] => 42000 [SQLSTATE] => 42000 [1] => 8114

 => 8114 [2] => [Microsoft][SQL Server Native Client 11.0][SQL Server]Error converting data type varchar to varbinary. [message] => [Microsoft][SQL Server Native Client 11.0][SQL Server]Error converting data type varchar to varbinary. ) )

 

[western]

i get this error now
Connection established.
Array ( [0] => Array ( [0] => 42000 [SQLSTATE] => 42000 [1] => 8114

 => 8114 [2] => [Microsoft][SQL Server Native Client 11.0][SQL Server]Error converting data type varchar to varbinary. [message] => [Microsoft][SQL Server Native Client 11.0][SQL Server]Error converting data type varchar to varbinary. ) )[/QUOTE]

[URL="http://forum.ragezone.com/members/1333428500.html"][B]OzzyGT[/B][/URL] talking about it, [URL="http://forum.ragezone.com/f769/development-immortal-web-871163/index2.html#post7199953"]see below[/URL].
Execute Ozzy's query and try again...

[PHP]
<?php
$serverName = "ipmssql or servername";
$connectionInfo = array( "Database"=>"PassportBOIOLD", "UID"=>"sa", "PWD"=>"passwordsa");
$conn = sqlsrv_connect( $serverName, $connectionInfo);
if( $conn ) {
     echo "Connection established.<br />";
     $pass = "monster";
     $username = "example";
     $dbpass = md5($username.$pass);
     $sql2 = "exec adduser ?,?,'prompt','answer','truename',123123,'k@k.com',123123,'province','city',123123,'address',123123,0,'1998/01/01','qq',?";
     $params = array($username, $dbpass, $dbpass);
     $stmt = sqlsrv_query( $conn, $sql2, $params);
     printf($stmt);
if( $stmt === false ) {
     die( print_r( sqlsrv_errors(), true));
}
}else{
     echo "Connection could not be established.<br />";
     echo "<pre>";
     die( print_r( sqlsrv_errors(), true));
     echo "</pre>";
}
//phpinfo();
?>
[/PHP]

The thing is that i can send binary pass through php without sql error is that a vulnerability ? Better is use Ozzy's query, then modify php file.

 

[OzzyGT]

I think he's forgetting to add "0x" to the md5 hash.

Because queries aren't strong typed and the MSSQL documentation says that when inserting in a binary field it would convert the varchar automatically, it should work with just the string.

Only modify the stored procedure when you're going to use mssql_bind, otherwise you'll have start inserting the password without the "0x".

It's not a vulnerabilty, either way if you send it as a string or as binary data, the password is hashed so it's almost the same, also is not safer to send it as binary because to see it you only have to convert it back to a string.

Using md5 to hash passwords is a different matter, it's been a long time since people can break md5 hashes, so we can say that using md5 is the vulnerabilty ^^

 

[Donus]

Good :laugh:

 

[Nexux]

sorry i got lost on forgetting to add 0x, where do i add that? lol...

 

[OzzyGT]

Before the hash, it's the same if you use the stored procedure:

Using western's example:

$sql2 = "exec adduser ?,?,'prompt','answer','truename',123123,'k@k.com',123123,'province','city',123123,'address',123123,0,'1998/01/01','qq',?";
$params = array('master', '[COLOR="#FF0000"]0x[/COLOR]'.$dbpass, '[COLOR="#FF0000"]0x[/COLOR]'.$dbpass);

Or using kev's example:

When making a account add your account to users too..

Insert Into account
(id,creatime,name,passwd,usertype)
Values
(1,'1998.01.01','master',0xa15b019f7ab9ba0e01482577acb76e90,'1')

insert into users
(id, birthday, name, prompt, answer, idnumber, email,gender,passwd2)
Values
(1, '1998/01/01', 'master', 123123, 123123, 123123, 'k@k.com', 1, 0xa15b019f7ab9ba0e01482577acb76e90)