Anmelden
Benutzerkonto erstellen
Tag,
auf meiner Seite (die noch im Aufbau ist) wurde ein XSS Angriff durchgeführt und dies mit Erfolg.
Jetzt wollte ich Fragen wo der Fehler liegt.
Bin wirklich ratlos. Findet jemand ne Lücke, in dem Skript?
Page:
Please Login HERE or Register HERE to see this link!
Skript:
<?php
session_start();
include 'config/connect.php';
include_once 'function.php';
?>
<?php if(!$_SESSION['id']) {
$_SESSION['id'] = 10;
}
?>
<!DOCTYPE HTML>
<html lang="de">
<head>
<link rel="icon" href="img/snap.png" type="image/x-icon">
<title>Snapchat Connection</title>
<meta charset="utf-8"/>
<meta lang="de-de"/>
<meta lang="en-en"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<link rel="stylesheet" href="css/style_message.css" type="text/css"/>
<link rel="stylesheet" href="css/normalize.css" type="text/css"/>
</head>
<body>
<article id="main-msg">
<section class="left-user-msg">
<section class="left-user-search-msg">
<h2 class="chat-title">Chat</h2>
<input type="search" name="search-user-by-msg" placeholder="Person Suchen">
</section>
<?php
$user = $pdo->prepare("
SELECT
user.id,
user.username,
user.image
FROM user
;");
if(!$user->execute()) {
print_r($user->errorInfo());
}
?>
<?php
while($row = $user->fetch(PDO::FETCH_ASSOC)) { ?>
<form class="left" action="" method="GET">
<?php
if($stmt = $pdo->prepare("
SELECT
user.id,
msg.id,
msg.user_id,
msg.sender_id,
msg.message,
msg.date
FROM msg
INNER JOIN user
ON msg.user_id = user.id || msg.sender_id = user.id
WHERE msg.user_id = :user_id AND sender_id = :sender_id || msg.user_id = :sender_id AND msg.sender_id = :user_id ORDER BY date DESC LIMIT 1;"))
{
}
$stmt->BindParam(':user_id', $_SESSION['id']);
$stmt->BindParam(':sender_id', $row['id']);
if(!$stmt->execute()) {
print_r($stmt->errorInfo());
}
?>
<?php
$x = '0000-00-00 00:00:00';
$za = $pdo->prepare("
SELECT * FROM msg
WHERE msg.user_id = :user_id AND sender_id = :sender_id AND read_user_id = :x;");
$za->BindParam(':user_id', $_SESSION['id']);
$za->BindParam(':sender_id', $row['id']);
$za->BindParam(':x', $x);
if(!$za->execute()) {
print_r($za->errorInfo());
}
$zahl = $za->rowCount();
?>
<?php while($row2 = $stmt->fetch(PDO::FETCH_ASSOC)) { ?>
<section class="all-user-list-msg">
<a href="messages.php?u=<?php echo $row['id']; ?>">
<p class="img">
<?php if($row['image'] != '') { ?>
<img src="<?php echo $row['image']; ?>">
<?php } else { ?>
<img src="img/no.png"></img>
<?php } ?>
</p>
<p class="username-text">
<?php echo $row['username']; ?>
</p>
<?php if($row2['sender_id'] == $_SESSION['id']) { ?>
<?php echo $row2['message']; ?>
<?php } else { ?>
<?php if($zahl > 0) { ?>
<p class="msg">
<?php echo $row2['message'] ?> (<?php echo $zahl; ?>)
</p>
<?php } else { ?>
<p class="msg-weight">
<?php echo $row2['message']; ?>
</p>
<?php } ?>
<?php } ?>
<p class="date"> • <?php $time = convertTime($row2['date']); echo $time; ?></p>
</a>
</section>
<?php
}
?>
<?php }
?>
</section>
</form>
<section class="main-user-msg">
<?php if(htmlspecialchars($_GET["u"], ENT_QUOTES)) { ?>
<?php $get = filter_var($_GET["u"], FILTER_SANITIZE_STRING); ?>
<section class="main-user-msg-top">
<?php
if($user = $pdo->prepare("SELECT * FROM user WHERE id = :id LIMIT 1;")) {
$user->BindParam(':id', $get);
if(!$user->execute()) {
print_r($user->errorInfo());
}
$rowuser = $user->fetch(PDO::FETCH_ASSOC);
}
?>
<div class="img-container">
<?php if($rowuser['image'] != '') { ?>
<img src="<?php echo $rowuser['image']; ?>">
<?php } else { ?>
<img src="img/no.png">
<?php } ?>
</div>
<h2>
<a style="color:#444;" href="profil_method2.php?u=<?php echo $get; ?>">
<?php echo $rowuser['username']; ?></a>
</h2>
<div class="work">
<?php
if($folg = $pdo->prepare("
SELECT
follow.user_id,
follow.follow_id
FROM follow
WHERE user_id = :user_id AND follow_id = :follow_id;")) {
$folg->BindParam(':user_id', $_SESSION['id']);
$folg->BindParam(':follow_id', $get);
if(!$folg->execute()) {
print_r($folg->errorInfo());
}
$countfolg = $folg->rowCount();
}
?>
<?php
if($countfolg === 0) { ?> <a style="text-align:right;" class="folg-user" href="like.php?type=follow&id=<?php echo $get; ?>"> Folgen</a> <?php }
?>
<i class="fas fa-ellipsis-v"></i>
</div>
</section>
<section class="main-user-msg-middle">
<?php
$x = '0000-00-00 00:00:00';
$update = $pdo->prepare("UPDATE msg SET read_user_id = NOW() WHERE user_id = :user_id AND sender_id = :id AND read_user_id = :x;");
$update->BindParam(':user_id', $_SESSION['id']);
$update->BindParam(':id', $get);
$update->BindParam(':x', $x);
if(!$update->execute()) {
print_r($update->errorInfo());
}
$show = $pdo->prepare("
SELECT
msg.user_id,
msg.sender_id,
msg.message
FROM msg
WHERE user_id = :user_id AND sender_id = :sender_id || sender_id = :user_id AND user_id = :sender_id;");
$show->BindParam(':user_id', $_SESSION['id']);
$show->BindParam(':sender_id', $get);
if(!$show->execute()) {
print_r($show->errorInfo());
}
while($rowshow = $show->fetch()) { ?>
<?php if($_SESSION['id'] === $rowshow['sender_id']) { ?>
<p class="my-msg"> <?php echo nl2br($rowshow['message']); ?></p>
<?php } else { ?>
<p class="not-my-msg"> <?php echo nl2br($rowshow['message']); ?></p>
<?php
}
}
?>
</section>
<section class="main-user-msg-bottom">
<div class="clip">
<button type="button" name="clip"><img src="img/clip.png"></button>
<ul class="ul">
<li>Hallo</li>
</ul>
</div>
<div class="textarea">
<form action="" method="POST">
<textarea name="message" placeholder="Schreibe etwas..."></textarea>
</div>
<div class="paperplane">
<button type="submit" name="send_msg"><img src="img/paper-plane.png"></button>
<?php
if(isset($_POST['send_msg'])) {
$msgx = '';
if($insert = $pdo->prepare("
INSERT INTO msg (user_id, sender_id, message) VALUES (:user_id, :sender_id, :message);")) {
$insert->BindParam(':user_id', $get);
$insert->BindParam(':sender_id', $_SESSION['id']);
$insert->BindParam(':message', $_POST['message']);
if(!$insert->execute()) {
print_r($insert->errorInfo());
} else {
$msgx = "Erfolg";
}
}
}
}
?>
</form>
<?php echo $id; ?>
</div>
</section>
</section>
</article>
Bearbeitet von Givenchy, 11 March 2018 - 23:43 Uhr.
Nach oben
Melden
Classic Hacking
Coding
Web Coding
