как исправить xss

Discussion in 'Песочница' started by 4NT1P0V, 3 Oct 2008.

  1. 4NT1P0V

    4NT1P0V Member

    Joined:
    15 Jan 2008
    Messages:
    110
    Likes Received:
    28
    Reputations:
    -7
    Вот код странички, в поле почта ввести "><script>alert(1)</script> или "><script>alert('1')</script> собственно xss как исправить? сайт icqpm.ex6.ru и эта xss опасна?

    Code:
    <?php
    
    
    
    $icq=$_POST['icq'];
    
    $email=$_POST['email'];
    
    
    
    ?>
    
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
    
    <html>
    
    <head>
    
    <title>OnLine ICQ-Base primary mail icq base primary online vzlom acüêa hack primary base uin 6dig yçíaòü ïpèìaê øecòèçíaêa brute xaker áaça ïpèìaêoâ icq mail ìûëo ïo÷òa</title>
    
    <meta name="description" content="primary mail icq base" />
    
    <meta name="keywords" content="primary mail icq base primary online vzlom acüêa hack primary base uin 6dig yçíaòü ïpèìaê øecòèçíaêa brute xaker áaça ïpèìaêoâ icq mail ìûëo ïo÷òa" />
    
    
    
    <style type="text/css">
    
    A {text-decoration: none;}
    
    A:link, A:active, A:visited {color: blue;}
    
    A:hover {text-decoration: underline;}
    
    </style>
    
    
    
    <script language="JavaScript"><!--
    
    function reset_form() {
    
    document.forms[0].elements[0].value="";
    
    document.forms[0].elements[1].value="";
    
    }
    
    //--></script>
    
    
    
    </head>
    
    <body bgcolor="#FAFAF5">
    
    
    
    
    
    <table border="0" width="100%" height="100%" align="center">
    
    <tr valign="top"><td>
    
    <h1 align="center"> <img src=/logo.jpg> <br><center>B áaçe <b><i>117</b></i> íoìepoâ</center>
    
    </td></tr>
    
    
    
    <tr><td valign="middle">
    
    
    
    <p align="center"><table border="1" align="center" bordercolor="#000000" cellpadding="3" cellspacing="2">
    
    <tr><td><b>ICQ:</b></td><td><form name="icq" action="index.php" method="post"><input type="text" name="icq" size="20" maxlength="6" value="<?php echo $icq; ?>"></td></tr>
    
    <tr><td><b>E-mail:</b></td><td><input type="text" name="email" size="20" maxlength="60" value="<?php echo $email; ?>"></td></tr>
    
    <tr><td colspan="2" align="center"><input type="submit" value="Search">&nbsp;&nbsp;<input type="button" onclick="reset_form()" value="Reset"></form></td></tr>
    
    </table>
    
    <br>
    
    <i>Boçìoæeí ïoècê ïo ìacêe (<b>?</b> èëè <b>*</b>)</i></p>
    
    
    
    
    
    
    
    <?php
    
    
    
    // *****Hacòpoéêè*****
    
    
    
    
    
    $hostname="sql-3.ayola.net"; // Aäpec MySQL-cepâepa;
    
    $user=""; // Ëoãèí;
    
    $password=""; // Ïapoëü;
    
    $db=""; // Èìÿ áaçû äaííûx;
    
    
    
    
    
    $limit=1; // Ëèìèò âûâoäèìûx peçyëüòaòoâ ça paç;
    
    
    
    
    
    
    
    
    
    // ********Koä********
    
    
    
    
    
    if ((isset($icq) and isset($email)) and ($icq!="" or $email!="" )) {
    
    if (($icq>99999 and $icq<1000000) or ($icq=="" and $email!="") or (strchr($icq,"*") or strchr($icq,"?"))) {
    
    if (strlen($email)>2 or ($email=="" and $icq!="") or (strchr($email,"*") or strchr($email,"?"))) {
    
    
    
    
    
    if (@mysql_connect($hostname,$user,$password)) {
    
    @mysql_select_db($db);
    
    
    
    
    
    // Çaùèòa oò SQL-èíúeêöèé
    
    $icq=@mysql_escape_string($icq);
    
    $email=@mysql_escape_string($email);
    
    //***********************
    
    
    
    // Yäaëeíèe ïceâäo-ìacêè
    
    $icq=str_replace("%","\%",$icq);
    
    $icq=str_replace("_","\_",$icq);
    
    $email=str_replace("%","\%",$email);
    
    $email=str_replace("_","\_",$email);
    
    
    
    // Ïpèìeíeíèÿ ìacêè ïoècêa
    
    $icq=str_replace("*","%",$icq);
    
    $icq=str_replace("?","_",$icq);
    
    $email=str_replace("*","%",$email);
    
    $email=str_replace("?","_",$email);
    
    
    
    if ($icq!="" and $email!="") {$where="uin LIKE '$icq' and prim_mail LIKE '$email'";}
    
    else {
    
    if ($icq!="") {$where="uin LIKE '$icq'";}
    
    if ($email!="") {$where="prim_mail LIKE '$email'";}
    
    }
    
    
    
    
    
    $result=@mysql_query("SELECT * FROM icq_2008 WHERE ($where) order by uin limit $limit");
    
    $rows=@mysql_num_rows($result);
    
    
    
    
    
    if ($rows!=0) {
    
    
    
    echo <<<EOF
    
    <p align="center"><table border="0" align="center" bgcolor="silver" cellpadding="25" cellspacing="5"><tr><td>
    
    <code style="color:#000000;">
    
    EOF;
    
    
    
    $i=0;
    
    
    
    while ($i<$rows) {
    
    @mysql_data_seek($result,$i);
    
    $icq=@mysql_fetch_array($result);
    
    
    
    $uin=$icq["uin"];
    
    $email=htmlspecialchars($icq["prim_mail"]);
    
    
    
    echo <<<EOF
    
    $uin<b style="color:blue;">:</b>$email<br>\n
    
    EOF;
    
    
    
    $i++;
    
    }
    
    
    
    
    
    echo <<<EOF
    
    </code>
    
    </td></tr></table></p>
    
    EOF;
    
    
    
    echo "\n<h3 align=\"center\" style=\"color:blue;\">Bceão íaéäeío: $rows</h3>\n";
    
    
    
    } // if $rows!=0
    
    else {
    
    if ((strchr($icq,"%") or strchr($icq,"_")) or (strchr($email,"%") or strchr($email,"_"))) {
    
    echo "\n<h3 align=\"center\" style=\"color:blue;\">Bceão íaéäeío: $rows</h3>\n";
    
    echo "\n<h3 align=\"center\" style=\"color:red;\">Ïoïpoáyéòe çaäaòü äpyãyþ ìacêy!</h3>\n";
    
    }
    
    else {echo "\n<h3 align=\"center\" style=\"color:red;\">Taêoão íoìepa ICQ èëè E-mail íeò â íaøeé áaçe!</h3>\n";}
    
    } // else: $rows!=0
    
    
    
    
    
    
    
    
    
    
    
    }
    
    else {echo "<h3 align=\"center\" style=\"color:red;\">He ìoãy ïpèêoííeêòèòücÿ ê áaçe!</h3>";}
    
    
    
    
    
    
    
    @mysql_free_result($result); // ocâoáoæäaeò ïaìÿòü
    
    @mysql_close();
    
    
    
    } // if $email>3
    
    else {echo "<h3 align=\"center\" style=\"color:red;\">Äëèíía E-mail`a äoëæía áûòü >2 cèìâoëoâ!</h3>";}
    
    } // if $icq>99999 or $icq<1000000
    
    else {echo "<h3 align=\"center\" style=\"color:red;\">B íaøeé áaçe TOËüKO øecòèçíaêè (100000-999999)!</h3>";}
    
    } // if $icq and $email not empty
    
    
    
    ?>
    
    
    
    
    
    </td></tr>
    
    
    
    <tr valign="bottom"><td align="center">
    
    
    
    <p align="center"><small><b> <br>Äpyçüÿ ïpoeêòa:<br>
    
    <a href='http://networkterrorism.com'>Network Terrorism</a> <br>Bíèìaíèe! B íaøeé áaçe âceãäa áyäyò òoëüêo íacòoÿùèè ïpèìaêè. To ecòü ëþáoé ïpèìapè ìeéë áyäeò ïoäxoäèòü ê íoìepy ía caéòe icq.com/password Bce ïpeäëoæeíèÿ ïoæeëaíèÿ è ïpo÷ee â <a href='http://icqpm.ex6.ru/gbook'> Ãocòeâoé êíèãe.</a> Co âpeìeíeì ìíoãoe ïoìeíÿeòcÿ... Ycòaíoâëeí ëèìèò âûâoäèìûx çaïpococ paâíûì 1. Ýòo cäeëaío äëÿ çaùèòû oò êoïèpoâaíèÿ áaçû. Hoìepa íaxoäÿùèecÿ òyò íe áyäyò yäaëeíû. Äaæe íe ïpocèòe!<br>Câÿçü c aäìèíècòpaöèeé:<br> e-mail: icq-pm[dog]ya.ru</b></small><br><center><!--LiveInternet counter--><script type="text/javascript"><!--
    
    document.write("<a href='http://www.liveinternet.ru/click' "+
    
    "target=_blank><img src='http://counter.yadro.ru/hit?t28.6;r"+
    
    escape(document.referrer)+((typeof(screen)=="undefined")?"":
    
    ";s"+screen.width+"*"+screen.height+"*"+(screen.colorDepth?
    
    screen.colorDepth:screen.pixelDepth))+";u"+escape(document.URL)+
    
    ";"+Math.random()+
    
    "' alt='' title='LiveInternet: ïoêaçaío êoëè÷ecòâo ïpocìoòpoâ è"+
    
    " ïoceòèòeëeé' "+
    
    "border=0 width=88 height=120><\/a>")//--></script><!--/LiveInternet--></center></p>
    
    
    
    </td></tr>
    
    </table>
    
    
    
    </body>
    
    </html>
     
    #1 4NT1P0V, 3 Oct 2008
    Last edited: 3 Oct 2008
  2. n0ne

    n0ne Elder - Старейшина

    Joined:
    1 Jan 2007
    Messages:
    542
    Likes Received:
    284
    Reputations:
    -56
    Используй htmlspecialchars() и strip_tags() на входящие данные.

    http://ru2.php.net/strip_tags
    http://ru2.php.net/htmlspecialchars
     
  3. 4NT1P0V

    4NT1P0V Member

    Joined:
    15 Jan 2008
    Messages:
    110
    Likes Received:
    28
    Reputations:
    -7
    Спасибо! сейчас попробую разобраться что и где исправить
     
  4. n0ne

    n0ne Elder - Старейшина

    Joined:
    1 Jan 2007
    Messages:
    542
    Likes Received:
    284
    Reputations:
    -56
    Nightmare, htmlspecialchars() поддерживает не все кодировки, на сколько я знаю.
    Тем более мало защиты не бывает :D
     
    #4 n0ne, 3 Oct 2008
    Last edited: 3 Oct 2008
  5. 4NT1P0V

    4NT1P0V Member

    Joined:
    15 Jan 2008
    Messages:
    110
    Likes Received:
    28
    Reputations:
    -7
    Кто может сказать куда это вставить?
     
  6. n0ne

    n0ne Elder - Старейшина

    Joined:
    1 Jan 2007
    Messages:
    542
    Likes Received:
    284
    Reputations:
    -56
    4nt1p0v, напиши в асю - всё сделаем быстро :) Ну или подожди - подправлю код)
     
    1 person likes this.
  7. n0ne

    n0ne Elder - Старейшина

    Joined:
    1 Jan 2007
    Messages:
    542
    Likes Received:
    284
    Reputations:
    -56
    $email=strip_tags(htmlspecialchars($_POST['email']));

    вместо седьмой строки. Вроде, всё)
     
    #7 n0ne, 3 Oct 2008
    Last edited: 3 Oct 2008
  8. 4NT1P0V

    4NT1P0V Member

    Joined:
    15 Jan 2008
    Messages:
    110
    Likes Received:
    28
    Reputations:
    -7
    Спасибо
     
    #8 4NT1P0V, 3 Oct 2008
    Last edited: 3 Oct 2008