سؤال للمختصين في امن ال Php 2

مشروع انشاء مكتبه مركزيه للحاسب الالى وهذا مشروع التخرج

المطلوب ايجاد الثغرات وتصحيحها لامن الموقع لمنع الهاكرز من وجود الثغره

ارجو منكم المساعده في هذا الكود

index

<?php

session_start() ;

// النجوم

function do_stars($lstr) {

$stars = "" ;

for($i=$lstr+1;$i<=5;$i++) {

$stars .= '<img src="images/staroff.gif">';

}

for($i=1;$i<=$lstr;$i++) {

$stars .= '<img src="images/staron.gif">';

}

return $stars;

}

//-------------------------

include_once('conect.php') ;

$action = $_GET["action"] ;

//================================================== ================================

// new regstration ------------>

//================================================== ================================

if ($action == "newreg") {

$page_title ="تسجيل مستخدم جديد";

$content = '<form action="?action=adduser" method="post" enctype="application/x-www-form-urlencoded" dir="rtl" style="margin:0">

<table>

<tr><td><label style="width:100">اسم المستخدم : <label></td><td><input type="text" name="txtusername" style="width:200"></td></tr>

<tr><td><label style="width:100">كلمة المرور : <label></td><td><input type="password" name="txtpassword" style="width:200"></td></tr>

<tr><td><label style="width:100">تأكيد كلمة المرور : <label></td><td><input type="password" name="txtpassword2" style="width:200"></td></tr>

</table>

</form>' ;

}

//-----------------------------------------------------

if ($action == "adduser") {

$page_title ="تسجيل مستخدم جديد";

$user_name = $_POST["txtusername"] ;

$pass1 = $_POST["txtpassword"] ;

$pass2 = $_POST["txtpassword2"] ;

if (($pass1 == $pass2) && $user_name && $pass1) {

$res = mysql_query("SELECT fusername FROM tblusers WHERE fusername = '$user_name'");

if ($res) {

if (mysql_num_rows($res)>0) {

$content = '<b><font face="Tahoma" size="2" color="#FF0000">اسم المستخدم موجود مسبقا</font></b>';

$content .= '<br/><a href="?action=newreg">العودة</a>';

} else {

mysql_query("INSERT INTO tblusers (fusername , fpassword) VALUES ('$user_name',MD5('$pass1'))") ;

$content = '<b><font face="Tahoma" size="2" color="#008000">تم تسجيل المستخدم بنجاح</font></b>';

$content .= '<br/><a href="?action=newreg">العودة</a>';

}

} else {

$content = '<b><font face="Tahoma" size="2" color="#FF0000">اسم مستخدم غير صحيح أو كلمة المرور غير متطابقة</font></b>';

$content .= '<br/><a href="?action=newreg">العودة</a>';

}

//================================================== ================================

// new regstration <------------

//================================================== ================================

// Login ------------>

//================================================== ================================

if ($action=="login") {

if ($_POST["form"]) {

$user_name = $_POST["txtusername"] ;

$pass = $_POST["txtpassword"] ;

if ($pass && $user_name) {

$res = mysql_query("SELECT fusername FROM tblusers WHERE fusername = '$user_name' AND fpassword = MD5('$pass')");

if ($res) {

if (mysql_num_rows($res)>0) {

$content = '<b><font face="Tahoma" size="2" color="#008000">' . 'مرحبا بك ' . $user_name . ' تم تسجيل دخولك بنجاح ' . '</font></b>';

$_SESSION["islogin"] = "yes" ;

} else {

$content = '<b><font face="Tahoma" size="2" color="#FF0000">تسجيل دخول خاظئ</font></b>';

$content .= '<br/><a href="?action=login">العودة</a>';

unset($_SESSION["islogin"]) ;

}

} else {

$content = '<b><font face="Tahoma" size="2" color="#FF0000">تسجيل دخول خاظئ</font></b>';

$content .= '<br/><a href="?action=login">العودة</a>';

unset($_SESSION["islogin"]) ;

}

} else {

$page_title ="تسجيل الدخول";

$content = '<form action="?action=login" method="post" enctype="application/x-www-form-urlencoded" dir="rtl" style="margin:0">

<table>

<tr><td><label style="width:100">اسم المستخدم : <label></td><td><input type="text" name="txtusername" style="width:200"></td></tr>

<tr><td><label style="width:100">كلمة المرور : <label></td><td><input type="password" name="txtpassword" style="width:200"></td></tr>

</table>

</form>' ;

}

//================================================== ================================

// Login ------------>

//================================================== ================================

// BROWS CATG ------------>

//================================================== ================================

if ($action=="g") {

if ($_SESSION["islogin"]=="yes") {

$ladd = $_GET["add"] ;

$lform = $_GET["form"] ;

if (!$ladd && !$lform) {

$page_title = "إستعراض مجموعات الكتب" ;

$content = '<ul>' ;

$res = mysql_query("SELECT * FROM tblg") ;

if ($res) {

while($lROW = mysql_fetch_assoc($res)) {

$content .= '<li><a href="?action=openg&lgroub=' . $lROW["fid"] . '">' . $lROW["fname"] . '</a></li>';

}

$content .= '</ul>';

$content .= '<br/><a href="?action=g&add=1">إضافة مجموعة</a>';

}

if ($ladd) {

$page_title = "إضافة مجموعة جديدة" ;

$content = '<form action="?action=g&form=1" method="post" enctype="application/x-www-form-urlencoded" dir="rtl" style="margin:0">

<table>

<tr><td><label style="width:100"> اسم المجموعة<label></td><td><input type="text" name="txtg" style="width:200"></td></tr>

</table>

</form>' ;

}

if ($lform) {

$page_title = "إضافة مجموعة جديدة" ;

if ($_POST["txtg"]) {

mysql_query("INSERT INTO tblg (fname) VALUES ('{$_POST["txtg"]}')") ;

$content = '<b><font face="Tahoma" size="2" color="#008000">تم إضافة المجموعة بنجاح</font></b>';

$content .= '<br/><a href="?action=g&add=1">إضافة مجموعة جديدة</a>';

} else {

$content = '<b><font face="Tahoma" size="2" color="#FF0000">لايمكن الحفظ بسبب نقص البيانات</font></b>';

$content .= '<br/><a href="?action=g">العودة</a>';

}

//================================================== ===

} else {

$page_title = "رسالة إدارية" ;

$content = '<b><font face="Tahoma" size="2" color="#FF0000">وصول غير مصرح يتوجب عليك التسجيل</font></b>';

}

//================================================== ================================

// BROWS CATG <------------

//================================================== ================================

// BROWS books ------------>

//================================================== ================================

if ($action=="openg") {

if ($_SESSION["islogin"]=="yes") {

$ladd = $_GET["add"] ;

$lform = $_GET["form"] ;

$lgroub = $_GET["lgroub"] ;

$page = $_GET["page"];

if (!$page) $page= 0;

// جلب اسم المجموعة

$lxres = mysql_query("SELECT fname FROM tblg WHERE fid=$lgroub") ;

$lr = mysql_fetch_assoc($lxres) ;

$_curg = $lr["fname"];

//--------------------------

if (!$ladd && !$lform) {

$page_title = "إستعراض الكتب لمجموعة " . $_curg ;

$content = '

<p align="center">قراءة</td>

<p align="center">تحميل</td>

<p align="center">التقييم</td>

<p align="center">مرات التحميل</td>

<p align="right"> اسم الكتاب</td>

</tr>' ;

$cur_start = ($page * 10);

if ($page==0) $cur_start = ($page*10)+1;

$res = mysql_query("SELECT * FROM tbl_books WHERE fg=$lgroub limit $cur_start,10") ;

$resx = mysql_query("SELECT * FROM tbl_books WHERE fg=$lgroub") ;

$totpages = (mysql_num_rows($resx )/10) - 1 ;

if ($res) {

while($lROW = mysql_fetch_assoc($res)) {

$content .= '

<p align="center"><a href="upload/' . $lROW["filepath"] . '">قراءة</a></td>

<p align="center"><a href="download.php?&id=' . $lROW["fid"] . '">تحميل</a></td>

<p align="center"><span lang="en-us">' . do_stars($lROW["fvote"]) . '</span></td>

<p align="center"><span lang="en-us">' . $lROW["floadscount"] . '</span></td>

<p align="right"><span lang="en-us">' . $lROW["fname"] . '</span></td>

</tr>' ;

}

$content .= '</table></div>';

// paging -------------------------------------->

$content .= '<table><tr>

<td>' ;

if ($page<$totpages) $content .= '<a href="?action=openg&lgroub=' . $lgroub . '&page=' . ($page+1) . '">التالي</a>' ;

$content .= ' </td>

</td>

<td>';

if ($page>0) $content .= '<a href="?action=openg&lgroub=' . $lgroub . '&page=' . ($page-1) . '">السابق</a>' ;

$content .= '</td>

</tr></table>';

// paging -------------------------------------->

$content .= '<br/><a href="?action=openg&add=1&lgroub=' . $lgroub . '">إضافة كتاب</a>';

}

if ($ladd) {

$page_title = "إضافة كتاب جديد" ;

$content = '<form action="?action=openg&form=1&lgroub=' . $lgroub . '" method="post" enctype="multipart/form-data" dir="rtl" style="margin:0">

<table>

<tr><td><label style="width:100">اسم الكتاب<label></td><td><input type="text" name="txtbook" style="width:200"></td></tr>

<tr><td><label style="width:100">الكتاب<label></td><td><input type="file" name="F1" style="width:200"></td></tr>

</table>

</form>' ;

}

if ($lform) {

$page_title = "إضافة كتاب جديد" ;

if ($_POST["txtbook"] && $_FILES["F1"]["name"] ) {

mysql_query("INSERT INTO tbl_books SET fname='" . $_POST["txtbook"] . "' , fg = '$lgroub'") or die(mysql_error()) ;

$_nid = mysql_insert_id() ;

if ($_nid)

{

if ($_FILES['F1']['name'])

{

$nfilename = $_FILES['F1']['name'];

$nfilename = "newbook_$_nid" . substr($nfilename, (strlen($nfilename) - 3) - 1, 4);

$uploadfile = "upload/" . $nfilename;

@move_uploaded_file($_FILES['F1']['tmp_name'], $uploadfile);

//=========

mysql_query("UPDATE tbl_books SET filepath = '$nfilename' WHERE fid = $_nid");

} //@copy

}

$content = '<b><font face="Tahoma" size="2" color="#008000">تم إضافة الكتاب بنجاح</font></b>';

$content .= '<br/><a href="?action=openg&add=1&lgroub=' . $lgroub . '">إضافة كتاب جديد</a>';

} else {

$content = '<b><font face="Tahoma" size="2" color="#FF0000">لايمكن الحفظ بسبب نقص البيانات</font></b>';

$content .= '<br/><a href="?action=openg&lgroub=' . $lgroub . '">العودة</a>';

}

//================================================== ===

} else {

$page_title = "رسالة إدارية" ;

$content = '<b><font face="Tahoma" size="2" color="#FF0000">وصول غير مصرح يتوجب عليك التسجيل</font></b>';

}

//================================================== ================================

// BROWS books <------------

//================================================== ================================

// BROWS ENGLISH CATG ------------>

//================================================== ================================

if ($action=="gen") {

if ($_SESSION["islogin"]=="yes") {

$ladd = $_GET["add"] ;

$lform = $_GET["form"] ;

if (!$ladd && !$lform) {

$page_title = "Browsing books categories" ;

$content = '<ul>' ;

$res = mysql_query("SELECT * FROM tblgen") ;

if ($res) {

while($lROW = mysql_fetch_assoc($res)) {

$content .= '<li><a href="?action=opengen&lgroub=' . $lROW["fid"] . '">' . $lROW["fname"] . '</a></li>';

}

$content .= '</ul>';

$content .= '<br/><a href="?action=gen&add=1">Add category</a>';

}

if ($ladd) {

$page_title = "Add new category" ;

$content = '<form action="?action=gen&form=1" method="post" enctype="application/x-www-form-urlencoded" style="margin:0">

<table>

<tr><td><label style="width:100">Category name<label></td><td><input type="text" name="txtg" style="width:200"></td></tr>

</table>

</form>' ;

}

if ($lform) {

$page_title = "Add new category" ;

if ($_POST["txtg"]) {

mysql_query("INSERT INTO tblgen (fname) VALUES ('{$_POST["txtg"]}')") ;

$content = '<b><font face="Tahoma" size="2" color="#008000">Category added successfully</font></b>';

$content .= '<br/><a href="?action=gen&add=1">Add new category</a>';

} else {

$content = '<b><font face="Tahoma" size="2" color="#FF0000">Error : data not complete </font></b>';

$content .= '<br/><a href="?action=gen">back</a>';

}

//================================================== ===

} else {

$page_title = "Administration massege" ;

$content = '<b><font face="Tahoma" size="2" color="#FF0000">unauthorized access to this page</font></b>';

}

//================================================== ================================

// BROWS ENGLISH CATG <------------

//================================================== ================================

// BROWS ENGLISH books ------------>

//================================================== ================================

if ($action=="opengen") {

if ($_SESSION["islogin"]=="yes") {

$ladd = $_GET["add"] ;

$lform = $_GET["form"] ;

$lgroub = $_GET["lgroub"] ;

$page = $_GET["page"];

if (!$page) $page= 0;

// جلب اسم المجموعة

$lxres = mysql_query("SELECT fname FROM tblgen WHERE fid=$lgroub") ;

$lr = mysql_fetch_assoc($lxres) ;

$_curg = $lr["fname"];

//--------------------------

if (!$ladd && !$lform) {

$page_title = "Showing Category books .. " . $_curg ;

$content = '

<p align="center">download</td>

<p align="center">No downloads</td>

</tr>' ;

$cur_start = ($page * 10);

if ($page==0) $cur_start = ($page*10)+1;

$res = mysql_query("SELECT * FROM tbl_booksen WHERE fg=$lgroub limit $cur_start,10") ;

$resx = mysql_query("SELECT * FROM tbl_booksen WHERE fg=$lgroub") ;

$totpages = (mysql_num_rows($resx )/10)-1;

if ($res) {

while($lROW = mysql_fetch_assoc($res)) {

$content .= '

<p align="left"><a href="downloaden.php?&id=' . $lROW["fid"] . '">Download</a></td>

<p align="center"><span lang="en-us">' . do_stars($lROW["fvote"]) . '</span></td>

<p align="center"><span lang="en-us">' . $lROW["floadscount"] . '</span></td>

<p align="left"><span lang="en-us"> ...' . substr($lROW["fname"] , 0 , 20 ) . '</span></p></td>

</tr>' ;

}

$content .= '</table></div>';

// paging -------------------------------------->

$content .= '<table><tr>

<td>' ;

if ($page<$totpages) $content .= '<a href="?action=opengen&lgroub=' . $lgroub . '&page=' . ($page+1) . '">next</a>' ;

$content .= ' </td>

</td>

<td>';

if ($page>0) $content .= '<a href="?action=opengen&lgroub=' . $lgroub . '&page=' . ($page-1) . '">back</a>' ;

$content .= '</td>

</tr></table>';

// paging -------------------------------------->

$content .= '<br/><a href="?action=opengen&add=1&lgroub=' . $lgroub . '">Add new book</a>';

}

if ($ladd) {

$page_title = "add new book" ;

$content = '<form action="?action=opengen&form=1&lgroub=' . $lgroub . '" method="post" enctype="multipart/form-data" style="margin:0">

<table>

</table>

</form>' ;

}

if ($lform) {

$page_title = "Add new book" ;

if ($_POST["txtbook"] && $_FILES["F1"]["name"] ) {

mysql_query("INSERT INTO tbl_booksen SET fname='" . $_POST["txtbook"] . "' , fg = '$lgroub'") or die(mysql_error()) ;

$_nid = mysql_insert_id() ;

if ($_nid)

{

if ($_FILES['F1']['name'])

{

$nfilename = $_FILES['F1']['name'];

$nfilename = "newbooken_$_nid" . substr($nfilename, (strlen($nfilename) - 3) - 1, 4);

$uploadfile = "upload/" . $nfilename;

@move_uploaded_file($_FILES['F1']['tmp_name'], $uploadfile);

//=========

mysql_query("UPDATE tbl_booksen SET filepath = '$nfilename' WHERE fid = $_nid");

} //@copy

}

$content = '<b><font face="Tahoma" size="2" color="#008000">Book add successfully</font></b>';

$content .= '<br/><a href="?action=opengen&add=1&lgroub=' . $lgroub . '">Add new book</a>';

} else {

$content = '<b><font face="Tahoma" size="2" color="#FF0000">Error : data not complete</font></b>';

$content .= '<br/><a href="?action=opengen&lgroub=' . $lgroub . '">Back</a>';

}

//================================================== ===

} else {

$page_title = "Administration massege" ;

$content = '<b><font face="Tahoma" size="2" color="#FF0000">unauthorized access to this page</font></b>';

}

//================================================== ================================

// BROWS ENGLISH books <------------

//================================================== ================================

// SEARCH books ------------>

//================================================== ================================

if ($action=="search") {

if ($_SESSION["islogin"]=="yes") {

$lbookname = $_POST["txtbookname"] ;

$page = $_GET["page"];

if (!$page) $page= 0;

$page_title = "نتائج البحث عن : " . $lbookname ;

$content = '

<p align="center">قراءة</td>

<p align="center">تحميل</td>

<p align="center">التقييم</td>

<p align="center">مرات التحميل</td>

<p align="right"> اسم الكتاب</td>

</tr>' ;

$cur_start = ($page * 10);

if ($page==0) $cur_start = 1;

$res = mysql_query("SELECT * FROM tbl_books WHERE fname like '%$lbookname%'") ;

$resx = mysql_query("SELECT * FROM tbl_books WHERE fname like '%$lbookname%'") ;

@$totpages = (mysql_num_rows($resx )/10) - 1 ;

if ($res) {

while($lROW = mysql_fetch_assoc($res)) {

$content .= '

<p align="center"><a href="upload/' . $lROW["filepath"] . '">قراءة</a></td>

<p align="center"><a href="download.php?&id=' . $lROW["fid"] . '">تحميل</a></td>

<p align="center"><span lang="en-us">' . do_stars($lROW["fvote"]) . '</span></td>

<p align="center"><span lang="en-us">' . $lROW["floadscount"] . '</span></td>

<p align="right"><span lang="en-us">' . $lROW["fname"] . '</span></td>

</tr>' ;

}

$content .= '</table></div>';

// paging -------------------------------------->

} else {

$page_title = "رسالة إدارية" ;

$content = '<b><font face="Tahoma" size="2" color="#FF0000">وصول غير مصرح يتوجب عليك التسجيل</font></b>';

}

<head>

<title>المكتبة الالكترونية</title>

function dohelp() {

pop = window.open("help.htm",'helpwindow','width=400,hei ght=600') ;

}

</script>

</head>

<tr>

<td>

<tr>

<td>

<td>

<tr>

<td>

</tr>

<tr>

<td>

</tr>

<tr>

<td>

</tr>

</table>

</td>

</td>

<td>

</tr>

</table>

</td>

</tr>

<tr>

<tr>

<tr>

<tr>

<font color="#FFFFFF"><b> القائمة الرئيسية</b></font>

</td>

</tr>

<tr>

<tr>

</tr>

<tr>

</tr>

<tr>

</tr>

<tr>

</tr>

</table>

</td>

</tr>

<tr>

<td>

</tr>

</table>

<table>

<tr><td><label style="width:80">اسم الكتاب :<label></td></tr><tr><td><input type="text" name="txtbookname" style="width:100"><input type="submit" value="البحث"></td></tr>

</table>

</form>

</p>

</marquee></p>

<tr>

<font color="#FFFFFF"><b> تسجيل الدخول</b></font></td>

</tr>

<tr>

<label style="width:100; font-weight:700">اسم المستخدم : </label></td></tr>

<label style="width:100; font-weight:700">كلمة المرور : </label></td></tr>

</table>

</form>

</td>

</tr>

<tr>

<td>

</tr>

</table>

</td>

<tr>

</tr>

<tr>

</tr>

</table>

</td>

</tr>

</table>

</td>

</tr>

</table>

</td>

</tr>

<tr>

<td>

<tr>

<td>

<td>

</tr>

</table>

</td>

</tr>

</table>

</body>

</html>

ولكم جزيل الشكر

سؤال للمختصين في امن ال Php 2

مواضيع مشابهة