// Check for XSS attack
if(!stristr($nsnst_const['query_string'], "index.php?url=") AND (!isset($_COOKIE['admin']) OR !is_admin($_COOKIE['admin']))) {
if( (isset($name) && false !== strpos($name,'://'))
OR (isset($file) && false !== strpos($file,'://'))
OR (isset($libpath) AND (preg_match("/http\:\/\//i", $libpath) OR preg_match("/https\:\/\//i", $libpath)))
OR stristr($nsnst_const['query_string'], "http://") OR stristr($nsnst_const['query_string'], "https://")
OR stristr($nsnst_const['query_string'], "_SERVER=") OR stristr($nsnst_const['query_string'], "_COOKIE=")
OR ( stristr($nsnst_const['query_string'], "cmd=") AND !stristr($nsnst_const['query_string'], "&cmd") )
OR ( stristr($nsnst_const['query_string'], "exec") AND !stristr($nsnst_const['query_string'], "execu") )
OR stristr($nsnst_const['query_string'],"concat") AND !stristr($nsnst_const['query_string'], "../") ) {
block_ip($blocker_row);
}
}
}
Let me know if you think is ok. The first time I got an error but now it is working fine. Intead of ))) I did ))
Joined: Mar 30, 2006 Posts: 2456 Location: Pittsburgh, Pennsylvania
Posted:
Sun Dec 12, 2010 10:38 am
unicornio, you should be using the str* functions in all cases when it is a direct text replacement. Like what you posted about in ABConfigAdmin.php. You could probably use it in the post right before this one as well, but I am not sure what $key is.
If $key has any special chars in it, they will be interpreted as such, which typically would not happen with an eregi. This is why, once again, variables passed to preg should be preg_quoted.
Remember that anytime a variable is used, you lose a certain amount of control over the script. It is always advisable to back up in the script and understand where $key is being populated. It might just be some plain text, or it might be control chars like TAB, etc. Let's say it was being passed file extensions, ie., .jpg, .gif, etc. Without preg_quoting, that dot would cause problems. With preg_quote, the dot would be escaped.
Regular Expressions are not something you just type in and move on. They really need to be thoroughly tested, which is why the MUCH friendlier str* functions are being recommended.
I am assuming from your posts that you are eager to understand, if not master Regular Expressions. If that's the case, I would highly recommend you look into getting a helper, something like Regex Buddy. You can build expressions and it will tell you EXACTLY what your expression is trying to accomplish. It will also allow you to enter any text to test the expression against. It has extremely advanced options, which is why it's payware. There are free versions around if you Google it, and even some online ones to be found.
You can also code a quick and dirty php script to test with.
foreach( $MSBots as $key=>$value )
if (preg_match('/' . preg_quote($key, '/') . '/i', $agent)) {
return true;
}
return false;
}
I have the program Regex Buddy but I don't know how to work with it yet. I can send it to you if you need it since I notice you have good knowledge about Regex.
Last edited by unicornio on Mon Dec 13, 2010 6:28 am; edited 1 time in total
Each one of those string searches is matched to exactly one answer, therefore they are all necessary. The first strstr request is for Win, and seperates ALL Windows agents from all others. The function then forks one way or another to drill down to an exact OS. There is really no more efficient way than using if-elseif-else trees.
Drilling down to each exact OS like this is not necessary really, unless you're a stats freak, or the content being delivered relies on the OS answer (ie., which type of linefeeds to supply).
At any rate, the questions you are asking are indicative of a lack of understanding on exactly what str* does, versus what Regular Expressions do. They -can- do the same thing in some very specific cases, but then after that, Regular Expressions can start showing some very extreme muscle power. In many cases, it might be overkill.
If there is concern for script 'efficiency', ie., run time, the above code isn't critical, since it is only run once per request. Efficiency starts mattering when you want to process, say, a few million user agents. In this case, again, not knowing WHY the portion of script requesting this information actually needs the information to be this precise, the best course of making it more efficient is to not call it all in that form. You will usually want to tweak inefficient parts of code nested in loops, as their inefficiency gets more noticeable the more iterations you need to finish the loop.
foreach( $MSBots as $key=>$value )
if (preg_match('/' . preg_quote($key, '/') . '/i', $agent)) {
return true;
}
return false;
}
PHrEEkie, where did you learn Regular Expressions. It looks like you know a lot but I would like to see examples to undertand better this problematic issue. I do know it won't be a problem when php 6 is out but I do want to know for the future. Can you check if this one is ok please.
If you're asking whether that code should be changed to whatever, I simply don't know. It's a snippet. I have no idea how it's being used, or what's using it, so I have no idea how to advise you there, other to say test it! If you don't know what it's supposed to do, then you simply cannot program it, nor can you debug it.
I learned Regular Expressions the way most programmers do; by force. Sooner or later, you have to deal with them. Regular Expressions are almost a seperate language, and no matter whether you program in Java, PHP, whatever, you will end up running into them. There's so many different ways you might need them, and so many different ways to approach constructing them, that it's impossible to teach someone over a forum. I'll give you a couple of links that should get you started, but you can certainly Google more.
While going through these tutorials, I would highly recommend you fire up that Regex Buddy, plug in the examples from these sites, and learn Regex Buddy along with learning Regular Expressions.
Only registered users can see links on this board! Get registered or login to the forums!
Only registered users can see links on this board! Get registered or login to the forums!
View next topic View previous topic
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
![[Valid RSS]](http://www.ravenphpscripts.com/images/valid-rss.png "Validate my RSS feed"){kind=small}
:: 
::
