check my site please

[limdis]

Works fine for me on the opposite coast. Btw OP, 2 seconds in and http://troop557.vacau.com/src/

Makes me wonder what else is open for viewing...

[jack08642qa]

well since you can't view php scripts in browser your not going to find anything in that folder and you just reminded me to set up a 403 for outside visitors to that folder plus the others

-- Thu Oct 04, 2012 8:08 pm --

the 403 has been set up for all directories

[barneystinson19]

It looks like your script is vulnerable to Sql Injection. Also have no protection for Cross Site Request Forgery attacks.
You should filter all your variables which gets users input with mysql_real_escape_string() function.

You should use your variables like this;

Code: Select all

$day = mysql_real_escape_string($_GET['day']);

Instead of this;

Code: Select all

$day = $_GET['day'];

Your registration form is also vulnerable to Sql Injection. You should filter that variables too. You should also use htmlspecialchars() function to protect from XSS and many other attacks.
To protect from CSRF attacks, you can find more information from here;
http://en.wikipedia.org/wiki/Cross-site_request_forgery

I hope this helped you

[centip3de]

It looks like your script is vulnerable to Sql Injection. Also have no protection for Cross Site Request Forgery attacks.
You should filter all your variables which gets users input with mysql_real_escape_string() function.

You should use your variables like this;

Code: Select all

$day = mysql_real_escape_string($_GET['day']);

Instead of this;

Code: Select all

$day = $_GET['day'];

Your registration form is also vulnerable to Sql Injection. You should filter that variables too. You should also use htmlspecialchars() function to protect from XSS and many other attacks.
To protect from CSRF attacks, you can find more information from here;
http://en.wikipedia.org/wiki/Cross-site_request_forgery

I hope this helped you

It probably would have been, had it been made around the time OP was still around. However, as you can see, it's been over 5 months since the last post on this thread. Please don't necro old threads, just let them die.