ZapCMS [PHP, OOP, From Scratch]

[Hejula]

Jonty - I just fixed that exploit on Fresh :P

You was putting mysql_real_escape_string in the wrong place :')

You put it here:

//$name = $_POST['bean_avatarName'];
        $name = mysql_real_escape_string($_POST['bean_avatarName']); 

It also needs to be here:

else if (isset($_POST['bean_avatarName']))
    {
        $registerErrors = Array();
    
        $name = mysql_real_escape_string($_POST['bean_avatarName']);
        $password = $_POST['bean_password'];
        $password2 = $_POST['bean_retypedPassword'];
        $email = $_POST['bean_email'];
        $dob_day = $_POST['bean_day'];
        $dob_month = $_POST['bean_month'];
        $dob_year = $_POST['bean_year'];
        //$lang = $_POST['bean_lang']; 

[PythoneX12]

Jonty, Could u include all client files for this? Thanks

[Jonteh]

Jonty, Could u include all client files for this? Thanks

this is not yet done but when it is it shall be released in full.

Thank you.

[Quackster]

Cannot wait! This will support phoenix I assume?

[Jonteh]

Cannot wait! This will support phoenix I assume?

It supports both Phoenix and Uber.

[SiiNz]

Im still looking to check for any exploits

[Hejula]

Im still looking to check for any exploits

You wouldn't know the first thing about spotting exploits.

[Makarov]

You wouldn't know the first thing about spotting exploits.

And how would you know that? Just because he just joined or has less posts then you doesn't mean you have justification on telling him what he can/can't do.

[Davidaap]

Im still looking to check for any exploits

Messages @ me page :)

[Jonteh]

And how would you know that? Just because he just joined or has less posts then you doesn't mean you have justification on telling him what he can/can't do.

SiiNz is a guy off of Zap that was permanently banned for harassment of staff when he was fired. I hired him for a while to use him for Microsoft Points. I don't care what you think about me, i'm not here to gain reputation.

Messages @ me page :)

Probably, i've not coded any protection into the me page.

[Roper]

Yes Jonty, loving you're honesty there!

Seems like some good progress has been made/is being made, keep it up :D

[Jonteh]

Yes Jonty, loving you're honesty there!

Seems like some good progress has been made/is being made, keep it up :D

Progress is slow atm, i'm feeling quite ill and don't feel like I could concentrate on coding right now.

[401Error]

Keep it up!

[Pure]

Jonty - I just fixed that exploit on Fresh :P

You was putting mysql_real_escape_string in the wrong place :')

You put it here:

//$name = $_POST['bean_avatarName'];
        $name = mysql_real_escape_string($_POST['bean_avatarName']); 

It also needs to be here:

else if (isset($_POST['bean_avatarName']))
    {
        $registerErrors = Array();
    
        $name = mysql_real_escape_string($_POST['bean_avatarName']);
        $password = $_POST['bean_password'];
        $password2 = $_POST['bean_retypedPassword'];
        $email = $_POST['bean_email'];
        $dob_day = $_POST['bean_day'];
        $dob_month = $_POST['bean_month'];
        $dob_year = $_POST['bean_year'];
        //$lang = $_POST['bean_lang']; 

This would be extremely easy to fix for every revision and for that matter every page.

$data = array();

foreach( $_POST as $key => $value )
{

 $data[ str_replace('bean_', '', $key) ] = mysql_real_escape_string( $value );

}

extract($data);

echo $password2;//lol123445667 

[Predict]

Jonty - I just fixed that exploit on Fresh :P

You was putting mysql_real_escape_string in the wrong place :')

You put it here:

//$name = $_POST['bean_avatarName'];
        $name = mysql_real_escape_string($_POST['bean_avatarName']); 

It also needs to be here:

else if (isset($_POST['bean_avatarName']))
    {
        $registerErrors = Array();
    
        $name = mysql_real_escape_string($_POST['bean_avatarName']);
        $password = $_POST['bean_password'];
        $password2 = $_POST['bean_retypedPassword'];
        $email = $_POST['bean_email'];
        $dob_day = $_POST['bean_day'];
        $dob_month = $_POST['bean_month'];
        $dob_year = $_POST['bean_year'];
        //$lang = $_POST['bean_lang']; 

Instead of doing this, use..

function Filter($input = '') {
return mysql_real_escape_string($input); }

Depending if you make new classes. It would be something like this.

$blabab(blababa is your class)->(or ::)Filter;

$name = $blabab->Filter($_POST['bean_avatarName']);