Showing posts with label SEO. Show all posts
Showing posts with label SEO. Show all posts
Wednesday, October 16, 2013
Protecting your website from Vulnerable Script Tags and Codes
It's really important for you to protect your website from hackers, but without removing any features from your website.
In this post we are going to understand how to solve the problem of XSS - Cross Site Scripting problems.
What is XSS:
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy.
-Source Wikipedia
Now to prevent our website from XSS attack, we are going to use a PHP function called: htmlentities()
This function of PHP will help your website to parse all harmful tags safely.
For example, if you have a website which displays comments submitted by the user and that comment system is XSS vulnerable, then if a user will enter some comment like this:
Javascript Code:
<script type="text/javascript">
<script type="text/javascript">
window.location = "http://www.google.com";
</script>
and now this comment is stored in your website's comment database. So whenever any user will meet the page where this comment is loaded from your database. Then the user will re-directed to the specified website.
So to prevent this problem we are going to use PHP function: htmlentities()
This function will replace all the < > / " ' = & and other symbols to a non-vulnerable signs. Like to display and in your website we use HTML Entities: &
So in the similar way we are going to covert the vulnerable symbols in to non vulnerable HTML Entities.
You'll just need to wrap htmlentities() to the variable from which you POST the comment to the database.
PHP Code:
<?php
$comment = htmlentities($_POST['comment_area']);
?>
So that's how you can protect your website from XSS. In the next post we'll be discussing about how to prevent our website from getting hacked using SQL-injections.
About the javascript code, if we parse it using the htmlentities() function then this is the safe result and this can be added in our database.
Result:
<script type="text/javascript">
window.location = "http://www.google.com";
</script>
What we have done:
PHP Code:
<?php
$comment =
<<<comment
<script type="text/javascript">
window.location = "http://www.google.com";
</script>
comment;
echo htmlentities($comment);
?>
Liked the post ? subscribe us with your email to get upcoming tutorials directly in your inbox:window.location = "http://www.google.com";
</script>
What we have done:
PHP Code:
<?php
$comment =
<<<comment
<script type="text/javascript">
window.location = "http://www.google.com";
</script>
comment;
echo htmlentities($comment);
?>
Monday, October 14, 2013
Counting your website's loading time using PHP
Counting your website's loading time is very useful and helpful for you to know that you need to make it more efficient or not.
Here, in this tutorial we are going to use PHP microtime() function to get the time and we'll be formatting it using number_format() function.
PHP code:
<?php
$mt = microtime(true);
$format_time = number_format(microtime(true) - $mt, 2)." Seconds";
echo $format_time;
?>
If you are trying this code block on your on a blank page then probably you'll get 0.00 Seconds in results.
So to test it on a blank page follow this block of code:
PHP code:
<?php
$mt = microtime(true);
file_get_contents("http://www.thecodepress.info");
$format_time = number_format(microtime(true) - $mt, 2)." Seconds";
echo $format_time;
?>
I'll always recommend you to use this but if you don't want to display it on your website then you can do something like commenting it something like this:
echo "<!--".$format_time."-->";
So after using that method the seconds will display in your website's HTML source code.
Another method which some other sites are using is to add the seconds at the bottom of the page (footer) you can too follow that.
Liked the post ? subscribe us with your email to get upcoming tutorials directly in your inbox:
Saturday, September 21, 2013
Getting Page URL using Javascript
Getting Page URLs using Javascript is very useful in real life projects, it's been used by Facebook, Twitter for their share/tweet buttons, because when we click on the share button then we get the URL of the page we are browsing, and that's done using Javascript.
var url= "";
if (typeof this.href === "undefined") {
url = document.location.toString().toLowerCase();
}
else {
url= this.href.toString().toLowerCase();
}
Liked the post ? subscribe us with your email to get upcoming tutorials directly in your inbox:
Sunday, June 23, 2013
Non-database page views counter using PHP
Page views counter is very helpful to get numbers of visitors visiting your website, but most of time many people saves that in database and in text files. In this tutorials we are going to save it in text files.
The ideal way to use this script is not to make the numbers of hits visible to your users, but if you want so make it visible then read the file and print it.
Add this block of code after calling the function 'hits()'.
PHP:
PHP:
<?php
function hits(){
$ips = Array("127.0.0.1"); //Enter ip address which you don't want count
$file = "hits.txt"; //file name
$ip = $_SERVER["REMOTE_ADDR"]; //getting ip address
if($ips[0]!=$ip){ //checking that 'ips' are not matched with var 'ip'
if(file_exists($file)){ //checking for hits.txt exists or not
$fr = fopen($file, "r"); //Opening file for reading
$fre = fread($fr, filesize($file))+1; //reading and incrementing 1
$fh = fopen($file, "w"); //Opening file for writing
$fw = fwrite($fh, $fre); //writing
}elseif(!file_exists($file)){ //if not exists var 'hits.txt' then to create one
$fh = fopen($file, "w"); //opening file for writing
$fw = fwrite($fh, "0"); //writing 0 to start from zero
echo "File Created."; //displaying a positive message
}
}
}
hits(); // calling our function
?>
The ideal way to use this script is not to make the numbers of hits visible to your users, but if you want so make it visible then read the file and print it.
Add this block of code after calling the function 'hits()'.
PHP:
$fr = fopen("hits.txt", "r"); //open file to read
$read = fread($fr, filesize("hits.txt")); //read the file
echo "Total Views: ".$read; // print the contents of file 'hits.txt'
$read = fread($fr, filesize("hits.txt")); //read the file
echo "Total Views: ".$read; // print the contents of file 'hits.txt'
Friday, May 24, 2013
A button hit counter for your PHP website.
In this tutorial, i'm going to share how to make a button hit counter, it's a basic level PHP so many can understand it and modify it. For this tutorial i'm going to save the counts in a text file, but if you want you can store it in a database.
Subscribe to:
Posts (Atom)
