Jump to content
MakeWebGames

header help

SHAD

By SHAD
in Engine Support

 Share

Recommended Posts

SHAD Newbie

SHAD

Posted
Posted

Can anyone point out the unsecure points in this header and please secure them for me. prefrabally in sprinf format,as it is my favorate. :)

 

 <?php
class headers {
function startheaders() {
global $ir, $set;
echo <<<EOF
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>{$set['game_name']}</title>
<style type="text/css">
<!--
body {
background-image:url(Images/Header.jpg);
margin-top: 0px;
margin-bottom: 0px;
font-family:calibri, helvetica, arial, geneva, sans-serif;font-size:12px;color: white;
  scrollbar-base-color: #005B70; 
  scrollbar-arrow-color: #F3960B;
  scrollbar-DarkShadow-Color: #000000;
}
a:visited,a:active,a:hover,a:link { color: white;text-decoration: none; }
table,tr,td { font-family:helvetica, arial, geneva, sans-serif;font-size: 12px; }
img { border:none; }
textarea { font-family:helvetica, arial, geneva, sans-serif;font-size:12px;color: white; }
.table2 {
}
.lgrad {
background-image:url(lgrad.jpg);
background-repeat:repeat-y;
width:19px;
}
.linegrad {
background-image:url(linegrad.PNG);
background-repeat:repeat-y;
background-align: center;
width:2px;
}
.rgrad {
background-image:url(rgrad.jpg);
background-repeat:repeat-y;
width:19px;
}
.dgrad {
background-image:url(dgrad.jpg);
background-repeat:repeat-x;
height:38px;
}
.dgradl {
background-image:url(dgradl.jpg);
background-repeat:no-repeat;
height:38px;
width:38px;
}
.dgradr {
background-image:url(dgradr.jpg);
background-repeat:no-repeat;
height:38px;
width:38px;
}
.center {
width:932px;
background-color:#000000;
vertical-align:top;
text-align:center;
}
.table {
background-color:#101010;
}
.table3 {
background-color:#000000;
}
.table td {
background-color:#000000;
height:22px;
}
.table3 td {
background-color:#000000;
}
td .alt {
background-color:#000000;
height:22px;
}
td .h {
background-image:url(Images/Top.jpg);
}
.table th {
background-image:url(Images/Top.jpg);
}
-->
</style></head>
<body>
<center>
<table width="932" border="0" cellpadding="0" cellspacing="0" class="table2">
<tr>
<td class="lgrad"></td>
<td class="center">
EOF;
}
function userdata($ir, $dosessh=1) {
 global $db, $c, $userid, $set;

 $db->query(sprintf("UPDATE `users` SET `laston`=unix_timestamp(), `lastip`='%s' WHERE `userid`='%u'", getip(), intval($userid)));
 if (trim($ir['email']) == '') {
  header('Location: NoEmail.php');
  session_unset();
  session_destroy();
 }
 if($dosessh && $_SESSION['attacking']) {
  print "You lost all your EXP for running from the fight.";
  mysql_query("UPDATE users SET exp=0 WHERE userid=$userid",$c);
  $_SESSION['attacking']=0;
 }
$enperc=(int) ($ir['energy']/$ir['maxenergy']*100);
$wiperc=(int) ($ir['will']/$ir['maxwill']*100);
$experc=(int) ( $ir['exp']/$ir['exp_needed']*100);
$brperc=(int) ($ir['brave']/$ir['maxbrave']*100);
$hpperc=(int) ($ir['hp']/$ir['maxhp']*100);
$enopp=100-$enperc;
$wiopp=100-$wiperc;
$exopp=100-$experc;
$bropp=100-$brperc;
$hpopp=100-$hpperc;
$d="";
$u=$ir['username'];
if($ir['donatordays']) { $u = "<font color=red>{$ir['username']}</font>";$d="[img=donator.gif]"; }
$gn=""; 
global $staffpage;
$bgcolor = '000000';
print <<<OUT
[img=title.jpg]


<table width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td width="20%" bgcolor="#$bgcolor" valign="top">














[b]Name:[/b] $gn{$u} [{$ir['userid']}] $d

[b]Money:[/b] {$fm}

[b]Level:[/b] {$ir['level']}

[b]Crystals:[/b] {$ir['crystals']}

[[url='logout.php']Emergency Logout[/url]]
<hr />
[b]Energy:[/b] {$enperc}%

<img src=greenbar.png width=$enperc height=10><img src=redbar.png width=$enopp height=10>

[b]Will:[/b] {$wiperc}%

<img src=bluebar.png width=$wiperc height=10><img src=redbar.png width=$wiopp height=10>

[b]Brave:[/b] {$ir['brave']}/{$ir['maxbrave']}

<img src=yellowbar.png width=$brperc height=10><img src=redbar.png width=$bropp height=10>

[b]EXP:[/b] {$experc}%

<img src=navybar.png width=$experc height=10><img src=redbar.png width=$exopp height=10>

[b]Health:[/b] {$hpperc}%

<img src=greenbar.png width=$hpperc height=10><img src=redbar.png width=$hpopp height=10>
<hr />

OUT;
if($ir['fedjail'])
{
$q=$db->query("SELECT * FROM fedjail WHERE fed_userid=$userid");
$r=$db->fetch_row($q);
die("[b]<font color=red size=+1>You have been put in the {$set['game_name']} Federal Jail for {$r['fed_days']} day(s).

Reason: {$r['fed_reason']}</font>[/b]</body></html>");
}
if(file_exists('ipbans/'.$IP))
{
die("[b]<font color=red size=+1>Your IP has been banned from {$set['game_name']}, there is no way around this.</font>[/b]</body></html>");
}
}
function menuarea()
{
include "mainmenu.php";
global $ir,$c;
$bgcolor = '202020';
print '</td><td width="2" class="linegrad" bgcolor="#'.$bgcolor.'"></td><td width="80%"  bgcolor="#'.$bgcolor.'" valign="top">
<center>';
if($ir['hospital'])
{
 print "[b]NB:[/b] You are currently in hospital for {$ir['hospital']} minutes.
";
}
if($ir['jail'])
{
 print "[b]NB:[/b] You are currently in jail for {$ir['jail']} minutes.
";
}
print "[url='donator.php'][b]Donate to {$set['game_name']} now for game benefits![/b][/url]
";
}
function smenuarea()
{
include "smenu.php";
global $ir,$c;
$bgcolor = 'FFFFFF';
print '</td><td width="2" class="linegrad" bgcolor="#'.$bgcolor.'"></td><td width="80%"  bgcolor="#'.$bgcolor.'" valign="top"><center>';
}
function endpage()
{
global $db;
print <<<OUT
</td>
</tr>
[img=Images/Top.jpg]
</table>
[img=Images/Top.jpg]
</td>

</tr>
<tr>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>
</html>
OUT;
}
}
?>
Link to comment
Share on other sites
SHAD Newbie

SHAD

Posted
  • Author
Posted

This is the getip() function,is it secure,and thank you for you help.

 

function getip() {

if (validip(isset($_SERVER['HTTP_CLIENT_IP']))) {

return $_SERVER['HTTP_CLIENT_IP'];

}

foreach (explode(",", isset($_SERVER['HTTP_X_FORWARDED_FOR'])) as $IP) {

if (validip(trim($IP))) {

return $IP;

}

}

if (validip(isset($_SERVER['HTTP_X_FORWARDED']))) {

return $_SERVER['HTTP_X_FORWARDED'];

} else if (validip(isset($_SERVER['HTTP_FORWARDED_FOR']))) {

return $_SERVER['HTTP_FORWARDED_FOR'];

} else if (validip(isset($_SERVER['HTTP_FORWARDED']))) {

return $_SERVER['HTTP_FORWARDED'];

} else if (validip(isset($_SERVER['HTTP_X_FORWARDED']))) {

return $_SERVER['HTTP_X_FORWARDED'];

} else {

return $_SERVER['REMOTE_ADDR'];

}

}

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to topic listing
×
×
  • Create New...