ZapCMS [PHP, OOP, From Scratch]

[Mithex]

Who cares if he is good or bad hotel owner, it doesn't effect you if he is bad owner. Go retire like you said you were, you haven't even been less-active like you should be when "semi-retired". Noob!

Do u see a gold activity award by my name? No. Thus, less active. Go sucka penis

 

[blackpol]

go to register.php:

search for:
$name = $_POST['bean_avatarName'];

replace with:
$name = mysql_real_escape_string($_POST['bean_avatarName']);

:

Also check if magic quotes are turned on...
When magic quotes are turned on you should use stripslashes() too

 

[Jonteh]

Also check if magic quotes are turned on...
When magic quotes are turned on you should use stripslashes() too

Am using a custom written function that includes stripslashes

---------- Post added at 06:05 AM ---------- Previous post was at 06:00 AM ----------

<sarcasm>Best hotel owner ever </sarcasm>

Go retire to your dads bedroom faggot.

 

[Law]

Go retire to your dads bedroom faggot.

OOOH SNAPP!

 

[Jonteh]

OOOH SNAPP!

Stop replying to threads with gay images. I want this thread to stay on topic about my development please.

 

[Hejula]

Jonty - I just fixed that exploit on Fresh

You was putting mysql_real_escape_string in the wrong place :')

You put it here:

//$name = $_POST['bean_avatarName'];
		$name = mysql_real_escape_string($_POST['bean_avatarName']);

It also needs to be here:

else if (isset($_POST['bean_avatarName']))
	{
		$registerErrors = Array();
	
		$name = mysql_real_escape_string($_POST['bean_avatarName']);
		$password = $_POST['bean_password'];
		$password2 = $_POST['bean_retypedPassword'];
		$email = $_POST['bean_email'];
		$dob_day = $_POST['bean_day'];
		$dob_month = $_POST['bean_month'];
		$dob_year = $_POST['bean_year'];
		//$lang = $_POST['bean_lang'];

 

[PythoneX12]

Jonty, Could u include all client files for this? Thanks:tongue:

 

[Jonteh]

Jonty, Could u include all client files for this? Thanks:tongue:

this is not yet done but when it is it shall be released in full.

Thank you.

 

[Quackster]

Cannot wait! This will support phoenix I assume?

 

[Jonteh]

Cannot wait! This will support phoenix I assume?

It supports both Phoenix and Uber.

 

[SiiNz]

Im still looking to check for any exploits

 

[Hejula]

Im still looking to check for any exploits

You wouldn't know the first thing about spotting exploits.

 

[Makarov]

You wouldn't know the first thing about spotting exploits.

And how would you know that? Just because he just joined or has less posts then you doesn't mean you have justification on telling him what he can/can't do.

 

[Davidaap]

Im still looking to check for any exploits

Messages @ me page

 

[Jonteh]

And how would you know that? Just because he just joined or has less posts then you doesn't mean you have justification on telling him what he can/can't do.

SiiNz is a guy off of Zap that was permanently banned for harassment of staff when he was fired. I hired him for a while to use him for Microsoft Points. I don't care what you think about me, i'm not here to gain reputation.

Messages @ me page

Probably, i've not coded any protection into the me page.

 

[Roper]

Yes Jonty, loving you're honesty there!

Seems like some good progress has been made/is being made, keep it up

 

[Jonteh]

Yes Jonty, loving you're honesty there!

Seems like some good progress has been made/is being made, keep it up

Progress is slow atm, i'm feeling quite ill and don't feel like I could concentrate on coding right now.

 

[401Error]

Keep it up!

 

[Pure]

Jonty - I just fixed that exploit on Fresh

You was putting mysql_real_escape_string in the wrong place :')

You put it here:

//$name = $_POST['bean_avatarName'];
		$name = mysql_real_escape_string($_POST['bean_avatarName']);

It also needs to be here:

else if (isset($_POST['bean_avatarName']))
	{
		$registerErrors = Array();
	
		$name = mysql_real_escape_string($_POST['bean_avatarName']);
		$password = $_POST['bean_password'];
		$password2 = $_POST['bean_retypedPassword'];
		$email = $_POST['bean_email'];
		$dob_day = $_POST['bean_day'];
		$dob_month = $_POST['bean_month'];
		$dob_year = $_POST['bean_year'];
		//$lang = $_POST['bean_lang'];

This would be extremely easy to fix for every revision and for that matter every page.

$data = array();

foreach( $_POST as $key => $value )
{

 $data[ str_replace('bean_', '', $key) ] = mysql_real_escape_string( $value );

}

extract($data);

echo $password2;//lol123445667

 

[Predict]

Jonty - I just fixed that exploit on Fresh

You was putting mysql_real_escape_string in the wrong place :')

You put it here:

//$name = $_POST['bean_avatarName'];
		$name = mysql_real_escape_string($_POST['bean_avatarName']);

It also needs to be here:

else if (isset($_POST['bean_avatarName']))
	{
		$registerErrors = Array();
	
		$name = mysql_real_escape_string($_POST['bean_avatarName']);
		$password = $_POST['bean_password'];
		$password2 = $_POST['bean_retypedPassword'];
		$email = $_POST['bean_email'];
		$dob_day = $_POST['bean_day'];
		$dob_month = $_POST['bean_month'];
		$dob_year = $_POST['bean_year'];
		//$lang = $_POST['bean_lang'];

Instead of doing this, use..

function Filter($input = '') {
return mysql_real_escape_string($input); }

Depending if you make new classes. It would be something like this.

$blabab(blababa is your class)->(or :Filter;

$name = $blabab->Filter($_POST['bean_avatarName']);