Nowadays almost every website applies CSRF protection in their forms to make it more secure and safe. In this post i'll be first create a Class called Security and then we'll be making some methods to achieve the goal of making a Cross Site Request Forgery secure forms. Because of Cross site request forgery vulnerability an attacker can simply submit or process the form on behalf of the user without knowing of the users. This kinds of attacks are mainly done on E-commerce websites to place bogus orders.

Creating the Class:

Using the Class:
What we are doing here is first creating the class and then creating the 'Static' methods. The first thing what we have done is to get the token and then to inject it into our HTML using hidden input field. We have chosen hidden input type because we don't want the token (hash) to be displayed on our webpage.
We are also saving the token in the session so that we can verify it when user submits the form.

To verify the token we have build up a method called 'checkToken()' which firsts checks whether the token in set or not and then checks whether the token submitted by the user matches the token saved in our session. If it is then it first unset the session and then it returns a boolean value TRUE. If not then it returns FALSE.

Note:
Make sure you before using the Class you use session_start() function to start the session.

While making a file uploading or sharing system many do mistakes while adding the extension checking functionality and because of that many users are able to upload vulnerable files such as upload a PHP or Javascript or any other file. To prevent it what we do is to make a list of allowed extensions. When the user will upload the file then we'll retrieve the file extension and check whether that file extension is in our list or not. This makes a beautiful layer of security and it's important to do it.

What mistakes many do?
The mistakes what many people do is to check the MIME type. It's not recommended to compare the MIME type. Because MIME type can be changed.
For example, let's take that a user has uploaded a PHP file which contains some terrible code that can produce a DDOS attack on your website. So if he has successfully uploaded that file and shared the URL to access it. If 10 users click on the same URL, then probably your website will go down. This will happen because of the server got crashed or if your host is strict against bandwidth then obviously the host will shut your website down.

What's the best option to protect against this problems?
The best option is to add a file extension check. So whenever a user tries to upload any file our script will first check for the extension. If the extension is in the list then the file can go for other checks like size etc. But if it's not in the list then we'll show an error to the user to notify him about it.

Live Demo Download Now
Here's the function:


Example usage:

Liked the post ? subscribe us with your email to get upcoming tutorials directly in your inbox:

Advantages:
Using Gmail’s SMTP servers for your application assures you that your email is sent, whereas sometimes when we use our own SMTP server we face problems like getting blocked or marked as spam by the automated spam filtering features. Another benefit I’ll like to mention here is if you use Gmail’s SMTP server then the emails which are sent from your application will be stored in Gmail’s Database. Another reason for using Gmail’s SMTP is that it’s not using Port 25 because there are many ISPs who are blocking the emails sent using Port 25.

Points to be noted:
Before starting to configure the Gmail’s SMTP server, it’s important for you to know that Gmail’s SMTP server only allows 99 emails per day. It means that you can only send 99 emails every day. The limit before was 250 emails per day, but because of high usage the limit decreased and came from 250 to 99 emails per day. Second point to note is that Gmail’s SMTP server requires authentication before sending emails. So make sure you have the password of the email which you’ll be using to send emails.

Configuration:
First you’ll need to login into Gmail account. After logging in navigate the settings button at the top right corner of your browser.

Now click on Settings, after clicking you’ll see a page like this:


Now click on Forwarding and POP/IMAP then you’ll see a like this:

Header function in PHP is quite powerful function. You have came across with such situations like: if some condition is false then the user should re-directed on the Index page of your website or may be after some seconds he should. Also Header function is useful while send the Content type of your webpage.

PHP: Re-directing to a webpage using Header Function.
<?php
   if(isset($_GET['id'])) {
        // Further Code..
   }else {
        header("Location: index.php");
   }
?>

PHP: Re-directing to a webpage after 10 seconds using Header Function.
<?php
   if(isset($_GET['id'])) {
       //Further code...
   }else {
       header("Refresh: 10; url=index.php");
   }
?>

PHP: Header Function to output a PDF file.
<?php
   header('Content-type: application/pdf');
?>

PHP: Header Function to convert PHP file into Text File.
<?php
   header('Content-Type: text/plain');
   echo "This is just a text file...we have converted a PHP file into a Plain Text File.";
?>

PHP: Header Function to convert PHP file into XML.
<?php
   header("Content-type: text/xml");
   echo "<?xml version='1.0' encoding='ISO-8859-1'?>";
   echo "<person>";
   echo "<name>Ashwin Pathak</name>";
   echo "<age>14</age>";
   echo "<twitter>@TheCodePress</twitter>";
   echo "</person>";
?>

Their are many other header functions you'll discover it by searching.

Liked the post ? subscribe us with your email to get upcoming tutorials directly in your inbox:

Liked the post ? subscribe us with your email to get upcoming tutorials directly in your inbox:

It's really important for you to protect your website from hackers, but without removing any features from your website.
In this post we are going to understand how to solve the problem of XSS - Cross Site Scripting problems.

What is XSS:
Liked the post ? subscribe us with your email to get upcoming tutorials directly in your inbox:

Counting your website's loading time is very useful and helpful for you to know that you need to make it more efficient or not.
Here, in this tutorial we are going to use PHP microtime() function to get the time and we'll be formatting it using number_format() function.
PHP code:
<?php
$mt = microtime(true);
        $format_time = number_format(microtime(true) - $mt, 2)." Seconds";
echo $format_time;
?>

If you are trying this code block on your on a blank page then probably you'll get 0.00 Seconds in results.
So to test it on a blank page follow this block of code:

PHP code:
<?php
$mt = microtime(true);
file_get_contents("http://www.thecodepress.info");
        $format_time = number_format(microtime(true) - $mt, 2)." Seconds";
echo $format_time;
?>

I'll always recommend you to use this but if you don't want to display it on your website then you can do something like commenting it something like this:

echo "<!--".$format_time."-->";

So after using that method the seconds will display in your website's HTML source code.
Another method which some other sites are using is to add the seconds at the bottom of the page (footer) you can too follow that.

Liked the post ? subscribe us with your email to get upcoming tutorials directly in your inbox:

We are using try..catch construct, which is a powerful exception-handling technique that was initially implemented in OOP languages. Basically, when an error happens at run time in the JavaScript code, an exception is thrown. The exception is an object that contains the details of the error. Using the try..catch syntax, we can catch the exception and handle it locally, so that the error won't be propagated to the user's browser.

Now we'll make url.php file to send the data from the server.
PHP: url.php source code.

<?php
   $url = "http://www.thecodepress.info";
   echo file_get_contents($url);
?>

Basically the url.php file loads the content of the specified URL which is fetched from variable url.
and then we are printing the contents of the file. So when our index.html tries to get the responseText from the server, the server sends the contents of the file and that's the reason for the website to be displayed.
Demo screenshots:

Before the page will load this will look like this and when we'll click the black header the page will load the website without refreshing the page.

When the user will click the black header then the specified website will load.

Liked the post ? subscribe us with your email to get upcoming tutorials directly in your inbox:

Have you ever noticed why blogger or wordpress or any other blogging platform have added a 'Next Page' button or you ever noticed that why facebook directly won't shows all the posts as well as twitter won't load the tweets ? The reason is: while loading tweets or loading status or articles from database developers loop over the database again and again and if their are many thousands or hundreds of status, tweets etc.. than the page get slow/crashes. That's the reason why they use pagination. By the way facebook and twitter loads their feed using Ajax.


After connecting let's move on adding tables and columns. First we'll create a table called 'page' and then we'll create column which name will be 'data' just for example i'm adding this names. You can even use PHPmyadmin (PMA) to make tables columns. Also i have added numbers from 1-20. Refer below image to understand it properly.

Page views counter is very helpful to get numbers of visitors visiting your website, but most of time many people saves that in database and in text files. In this tutorials we are going to save it in text files.

In the last post you have seen how to change background image of the website using PHP. But what if you want to change the background color of a website?. Let's see how to do it using PHP and CSS.

Have you seen the old TWITTER on which after every refresh the site changes it's background image not only twitter the old AOL was doing the same and many other major and minor sites are doing it. By using this method you can also change the background image of your website. In this post i have implemented few lines of code which will help to change your sites background image on every refresh. Don't forget to check the live demo.

Internet Protocol (IP) address is a unique key / number of your personal or your office computer. Most of the people who want to know their PC's / Laptop's IP Address, they directly go to IPChicken.com or any other IP Finding service. What if you create your own PHP Application which finds your PC's / Laptop's IP Address ?. In this post i'll show you few lines of PHP script which will help you to find your IP address and also it will find Remote Port.