• There is NO official Otland's Discord server and NO official Otland's server list. The Otland's Staff does not manage any Discord server or server list. Moderators or administrator of any Discord server or server lists have NO connection to the Otland's Staff. Do not get scammed!
  • New resources must be posted under Resources tab. A discussion thread will be created automatically, you can't open threads manually anymore.

TalkAction Message system in Website!

Status
Not open for further replies.
I see at step 4 that it is for gesiorAAC?

why are u using this way then?:
PHP: 
mysql_connect("localhost", "YourNickToDatebase", "PASS");
mysql_select_db("DATEBASE");
 
EmmaA, In all your threads you use Quote Tags use code tags dude! But besides that very nice script =P
 
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42S02]: Base table or view not found: 1146 Table 'stary.messages' doesn't exist' in /var/www/message.php:26 Stack trace: #0 /var/www/message.php(26): PDO->query('SELECT * FROM `...') #1 /var/www/index.php(94): include('/var/www/messag...') #2 {main} thrown in /var/www/message.php on line 26
Click to expand...
You do not have time to add something to the database?
 
Saj said:
Lol you said you can hack the site due to this, hahahah what the..? XD
Click to expand...

And he is right with what he said, this doesnt have even SINGLE function that would protect your database. You can write everything as a param. (Just an example: <script>alert("l0al")</script>)

Check now: http://loriaot.net/index.php?subtopic=message

Just to prove that I dont lie, you can input everything. x)
 
Last edited:
Emma Watson said:
And he is right with what he said, this doesnt have even SINGLE function that would protect your database. You can write everything as a param. (Just an example: <script>alert("l0al")</script>)

Check now: LoriaOT - Message players

Just to prove that I dont lie, you can input everything. x)
Click to expand...

Why bother to post it then, I don't want to get hacked..
 
Saj said:
Why bother to post it then, I don't want to get hacked..
Click to expand...

Lol. If I wouldnt post it then you could get hacked, now that you are aware of the security leaks, dont use it. :)
 
very danger holes, don't use it if you dont need to lost your otserver, i'm warned loria administration!
 
If you wanna to make it safe:

PHP: 
db.executeQuery("INSERT INTO `messages` (`id`, `name`, `text`) VALUES (NULL, '".. playerName .."', '".. message .."')")

replace with:
PHP: 
db.executeQuery("INSERT INTO `messages` (`id`, `name`, `text`) VALUES (NULL, '".. db.escapeString(playerName) .."', '".. db.escapeString(message) .."')")

and

PHP: 
<td align=\"center\">".$msg['name']."</td>
<td align=\"center\">".$msg['text']."</td>
<td align=\"center\">".$msg['id']."</td>

replace with:
PHP: 
<td align=\"center\">".htmlspecialchars($msg['name'])."</td>
<td align=\"center\">".htmlspecialchars($msg['text'])."</td>
<td align=\"center\">".htmlspecialchars($msg['id'])."</td>

and it's safe!

if i helped you - rep me!
 
Status
Not open for further replies.
Back
Top