Example PHP script for installing wordpress in the root of your domain.
This exact script is used in my new upcoming android app Wordpress Installer.
You can save it in a file, upload it to your host and run it in your browser.
It will download Wordpress, unzip the wordpress archive, launch the wordpress first-run script, afterwards this script will delete itself.
the $wpextr variable can be changed to install into a subfolder. Use a leading and a trailing slash.
<?php
// www.bartbosma.eu
// 2015
@ob_start();
function rrmdir($dir) {
if (is_dir($dir)) {
$objects = scandir($dir);
foreach ($objects as $object) {
if ($object != "." && $object != "..") {
if (filetype($dir."/".$object) == "dir") rrmdir($dir."/".$object); else unlink($dir."/".$object);
}
}
reset($objects);
rmdir($dir);
}
}
$wpextr="/wp/";
$wpextr="/";
$url = "https://wordpress.org/latest.zip";
$destination = "wordpress_latest.zip";
if (!file_exists($destination)){
if (function_exists("curl_init")){
$fp = fopen ($destination, 'w+');
$ch = curl_init();
curl_setopt( $ch, CURLOPT_URL, $url );
curl_setopt( $ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1" );
curl_setopt( $ch, CURLOPT_BINARYTRANSFER, true );
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, false );
curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, false );
curl_setopt( $ch, CURLOPT_AUTOREFERER, true );
curl_setopt( $ch, CURLOPT_CONNECTTIMEOUT, 100 );
curl_setopt( $ch, CURLOPT_FILE, $fp );
curl_exec( $ch );
curl_close( $ch );
fclose( $fp );
}else{
if (!file_put_contents($destination, fopen($url, "r"))){
$succes=false;
die("Cant download file..");
}
}
if (filesize($destination) > 0) {$succes= true;echo "Archive download succes.<br />";}else{$succes=false;}
}else{
echo "Archive already exists, no download required<br />";
$succes=true;}
if ($succes==true)
{
$zip = new ZipArchive;
if ($zip->open($destination) === TRUE) {
#echo $_SERVER['DOCUMENT_ROOT'].$wpextr;
$zip->extractTo($_SERVER['DOCUMENT_ROOT'].$wpextr);
$zip->close();
echo 'Archive extracted succes';
sleep(1);
if ($handle = opendir($_SERVER['DOCUMENT_ROOT'].$wpextr.'wordpress')) {
while (false !== ($fileName = readdir($handle))) {
if ($fileName!==".." ||$fileName!==".")
@rename($_SERVER['DOCUMENT_ROOT'].$wpextr."wordpress/".$fileName,
$_SERVER['DOCUMENT_ROOT'].$wpextr.$fileName);
}
closedir($handle);
@unlink("wpinst.php");
sleep(1);
rrmdir($_SERVER['DOCUMENT_ROOT'].$wpextr.'wordpress');
header("Location: http://".$_SERVER['HTTP_HOST'].$wpextr."/wp-admin/install.php");
}
} else {
echo 'ExtractTo function: Opening the wordpress zip file failed. Your webhost seems ancient.';
}
}
// www.bartbosma.eu xD
?>
Posts tonen met het label php. Alle posts tonen
Posts tonen met het label php. Alle posts tonen
maandag 16 maart 2015
maandag 9 maart 2015
MAMCWES, The most secure mysqli php class wrapper i've ever seen.
This post is all about...... mamcwes (GPL v3)
Basically, the required credentials for the mysqli connection are loaded only very briefly into the php memory, inside the class call. It is fully impossible for people to get the mysql login credentials.
Furtermore, it allows you to login as multiple mysql users based on your custom userlevel table, useful for hard-restricting permissions to the database, providing even more security.
One should use the escstr function to parse any kind of user input.
Looking at the class (functions) name(s), it won't be too hard figuring out how to make the DB connection / calls.
Usage example:
First add your database connection login to the cfg file.
#
What's that?
Easy to use PHP class for MySQL interaction, optionally allowing linking between multiple database user logins (with custom user rights on your databases/tables) and custom userlevels.For who is it?
PHP writers / developers / coders generally.What does it do, how does it differ from other mysqli classes?
Its an mysqli wrapper providing extensive security protection.Basically, the required credentials for the mysqli connection are loaded only very briefly into the php memory, inside the class call. It is fully impossible for people to get the mysql login credentials.
Furtermore, it allows you to login as multiple mysql users based on your custom userlevel table, useful for hard-restricting permissions to the database, providing even more security.
How does it work?
$this->gl_conf_ulvl in the mysqlcfgdata.inc.php is the userlevel setting. Default it loads from $_SESSION['rdmstring'].One should use the escstr function to parse any kind of user input.
Looking at the class (functions) name(s), it won't be too hard figuring out how to make the DB connection / calls.
Usage example:
First add your database connection login to the cfg file.
@session_start();
$_SESSION['rdmstring']="us0rlv0l";
$_SESSION['us0rlv0l']=1; # userlevel, optionally set by your own login
script. will be used to select login data (array) id from config file.#
For more protection you could use:
#$_SESSION['rdmstring']="md5(time());";#$_SESSION[${$_SESSION['rdmstring']}]=1; # userlevel
$mysqlerrordie=0;# 1 to terminate php execution on mysql error.
#$olddir=getcwd(); #optional
#chdir("classes");
include "mysql.class.5.php"; # note: when you put the class in another
folder, use chdir("classes"); first to navigate to that folder. go back
with chdir($olddir); if needed.
#chdir($olddir);
$sql=@new MYSQL();
$r=$sql->query("
SELECT badword
FROM `badwords` WHERE `badword` = '".$sql->escstr(customvalidatefunction($_POST['badword']))."'"
");
if (isset($r) && $sql->count_rows($r) > 0){
foreach($sql->db_array2($r) as $item){ #also available are db_array,
db_object(2) and db_assoc(2), whereas the 2 means more then 1 entry can
be fetched, thus requiring processing via foreach loop.
print_r($item);
echo $item[0];
}
Basically, if you build your own userlogin system with this class, you first connect with a readonly mysql user that retrieves your user table, retrieves the userlevel of the logged in person, and than you can use that userlevel variable to select the desired mysql user credentials (permissions) for that userlevel, while the userlevel will always be stored in a random Session variable.
Untracable and ultrasecure.
Download
mamcwes 0.2 (English)zaterdag 16 februari 2013
Android xml / rss tag / attribute parser for (image) display (in android app)
My first app was a very simple image gallery,
with 3 buttons, calling 3 different urls in a webview.
This url was a php script that i wrote.
The host with this script would be queried like this:
http://your.host/fde-xmlparser.php?latest=1
http://your.host/fde-xmlparser.php?id=40
http://your.host/fde-xmlparser.php (skips to the next id automatically, everytime)
which grabs image links from any RSS feed (in my case, supplied by phoca gallery). The script returns the contents of these files, so they can be directly viewed in any (mobile) webbrowser.
It supports alot:
None of the rss feed, php script, or the images need to be on the same host.
It reverts to local image fetching when script + images are on the same host, useful for hosts without url wrapper and curl. Note that in this case, the php script needs to be in the same or a parent folder of the images.
This feed can be queried with an html tag (setting) and attribute (setting).
Buildin support allows for file-location altering (find / replace), so for example, small thumbnail links can be changed into normal links.
These calls can be made from for example, google app-inventor like this:
It's not very hard to accomplish in android studio either, if you follow the
Android studio Training.
There you have it, an super easy image gallery, suitable for lots of digital artists.
Download here:
http://code.google.com/p/xml-links-to-app-inventor/
Dont forget to check out my main project, http://www.bartbosma.eu/freedomeditor/
with 3 buttons, calling 3 different urls in a webview.
This url was a php script that i wrote.
The host with this script would be queried like this:
http://your.host/fde-xmlparser.php?latest=1
http://your.host/fde-xmlparser.php?id=40
http://your.host/fde-xmlparser.php (skips to the next id automatically, everytime)
which grabs image links from any RSS feed (in my case, supplied by phoca gallery). The script returns the contents of these files, so they can be directly viewed in any (mobile) webbrowser.
It supports alot:
None of the rss feed, php script, or the images need to be on the same host.
It reverts to local image fetching when script + images are on the same host, useful for hosts without url wrapper and curl. Note that in this case, the php script needs to be in the same or a parent folder of the images.
This feed can be queried with an html tag (setting) and attribute (setting).
Buildin support allows for file-location altering (find / replace), so for example, small thumbnail links can be changed into normal links.
These calls can be made from for example, google app-inventor like this:
It's not very hard to accomplish in android studio either, if you follow the
Android studio Training.
There you have it, an super easy image gallery, suitable for lots of digital artists.
Download here:
http://code.google.com/p/xml-links-to-app-inventor/
Dont forget to check out my main project, http://www.bartbosma.eu/freedomeditor/
Filtering userinput for outputting filenames in PHP
So you have a string, want to turn it into a legit filename, or just display the string in html compatible mode?
if (!function_exists("filesystemcode")){
function filesystemcode($string, $arr1="a", $arr2="b") {
$c=array();
if (isset($arr1)) {
if (!isset(${$arr1}) || !is_array(${$arr1})){
${$arr1} = array('%21', '%2A', '%27', '%28', '%29', '%3B', '%3A', '%40', '%26', '%3D', '%2B', '%24', '%2C', '%2F', '%3F', '%25', '%23', '%5B', '%5D');
}}
if (isset($arr2)) {
if (!isset(${$arr2}) || !is_array(${$arr2})){
${$arr2} = array('!', '*', "'", "(", ")", ";", ":", "@", "&", "=", "+", "$", ",", "/", "?", "%", "#", "[", "]");}else{$b='';}
}
if (isset($a) && isset($b)){
return str_replace($a, $b, $string);
}else{return($string);}
}
}
Remove html compatible encoded illegal filename characters:
//$string="%21dad";
$string=filesystemcode($string, "a", "c");
//echo $string; //"dad";
Remove illegal filename chars:
//$string="/dad";
$string=filesystemcode($string, "b", "c");
//echo $string; //"dad";
Convert filesystem incompatible chars into html compatible chars:
//$string="!dad";
$string=filesystemcode($string, "b", "a");
//echo $string; //"%21dad";
Convert html compatible chars into filesystem incompatible chars:
//$string="%21dad";
$string=filesystemcode($string, "a", "b");
//echo $string; //"!dad";
Note, usually you would want to urlencode($string) afterwards.
if (!function_exists("filesystemcode")){
function filesystemcode($string, $arr1="a", $arr2="b") {
$c=array();
if (isset($arr1)) {
if (!isset(${$arr1}) || !is_array(${$arr1})){
${$arr1} = array('%21', '%2A', '%27', '%28', '%29', '%3B', '%3A', '%40', '%26', '%3D', '%2B', '%24', '%2C', '%2F', '%3F', '%25', '%23', '%5B', '%5D');
}}
if (isset($arr2)) {
if (!isset(${$arr2}) || !is_array(${$arr2})){
${$arr2} = array('!', '*', "'", "(", ")", ";", ":", "@", "&", "=", "+", "$", ",", "/", "?", "%", "#", "[", "]");}else{$b='';}
}
if (isset($a) && isset($b)){
return str_replace($a, $b, $string);
}else{return($string);}
}
}
Remove html compatible encoded illegal filename characters:
//$string="%21dad";
$string=filesystemcode($string, "a", "c");
//echo $string; //"dad";
Remove illegal filename chars:
//$string="/dad";
$string=filesystemcode($string, "b", "c");
//echo $string; //"dad";
Convert filesystem incompatible chars into html compatible chars:
//$string="!dad";
$string=filesystemcode($string, "b", "a");
//echo $string; //"%21dad";
Convert html compatible chars into filesystem incompatible chars:
//$string="%21dad";
$string=filesystemcode($string, "a", "b");
//echo $string; //"!dad";
Note, usually you would want to urlencode($string) afterwards.
The official CAPTCHA boycot.
Dear readers.
For years now, all the internet users have been proving to websites that they are not robots, thanks to a small group of exploiters, who automate crawlers to post their link everywhere on the internet.
For these same years, there have been alternate methods to keep spammers out, but webmasters and programmers are either too LAZY to adept, or too scared of not being mainstream, causing all of us to waste our energy into telling a computer for example that 2+2=4, as if a 50 year old computer couldn't calculate that.
So how can we stop this pure timewasting? Share this post to any webmaster or webprogrammer or website that you know.
If you arent one of those, then you are allowed to stop reading now, as the stuff below doesnt concern you.
Below here is the example of an alternate method to keep spammers out, this one is written in PHP, but any web programming language can use this method. Smallest issue is that anyone submitting a form using this method, needs to have cookies plus javascript enabled, but c'mon, this is 2013, not the middle ages. Most captcha scripts also require javascript enabled anyway.
------------------
form html:
-------------
<form class="sec" action="formhandler.php">
<input type="text" name='required"
onfocus="
var d= new Date();
$.get('handlers/token.php?'+d.getTime()+'='+d.getTime(),
function (txt){
$('.sec').append('<input type=\'hidden\' name=\'ts\' value=\''+txt+'\' />');
});
this.focus;this.select();
"
You can see this small part is written partly in jQuery markup, feel free to re-write it in normal javascript.
You can also note we need a token.php file.
------------
token.php:
------------
<?php
$ct=time();
setcookie('token',md5($_SERVER['SERVER_SIGNATURE'].$_SERVER['PATHEXT'].$_SERVER['HTTP_USER_AGENT'].$ct), 0, '/');
echo $ct;
?>
--------------
handler.php:
---------------
<?php
$formtimeout=60*20; # 20 minute for fill in a form
$override="o"; # "on" for disable spammerprotection
## anti spambot validation
if (isset($_POST['ts']) && isset($_COOKIE['token']) && $_COOKIE['token']==md5($_SERVER['SERVER_SIGNATURE'].$_SERVER['PATHEXT'].$_SERVER['HTTP_USER_AGENT'].$_POST['ts']) && (int)$_POST['ts']+$formtimeout > time()){
#$allowsql=true;
}else{ if ($override!="on"){
#spamprotect debugging
#echo md5($_SERVER['SERVER_SIGNATURE'] . $_SERVER['PATHEXT']. $_SERVER['HTTP_USER_AGENT']. $_POST['ts']). "<hr />";echo $_COOKIE['token']."<hr />";
#if ((int)$_POST['ts']+$formtimeout > time()){echo (int)$_POST['ts']+$formtimeout."<hr />";echo time();}
#possible unsafe user redirect to main page
#header("Location: ../index.html");
die("unsafe user");}
}
#your form processing here
?>
Abonneren op:
Posts (Atom)