Hey Guys,
I want to make a web development project based on php and mySQL. I have roughly around 3-4 weeks to make it.
Please suggest some ideas.
Thanks.
anuj_sharma -3 Junior Poster
somedude3488 228 Nearly a Posting Virtuoso
How about a project idea generator?
kireol 10 Posting Whiz
lol nice one kkeith29
diafol
I assume this is a coursework task. What are the objectives and assessment criteria?
If it is a low-level project, aim low-level, don't over-complicate things. You could end up spending too much time on one aspect at the expense of the rest. One thing is for sure, 3-4 weeks is not that much time! You'll need timescales / internal deadlines for each element of the project - be realistic. Don't underestimate the time needed for testing and debugging (including CSS issues with different browsers!). Do you need to provide documentation/manuals etc? These won't exist by good will alone.
ithelp 757 Posting Virtuoso Banned
Make a shopping cart .
cwarn23 387 Occupation: Genius Team Colleague Featured Poster
The easiest of all things is a search engine bot. I've made several of them before and are really easy to make with impressive results if you have enough cpu.
anuj_sharma -3 Junior Poster
What's a search engine bot??
diafol
:icon_rolleyes:
That's another day down. Just get on with it FFS, or you'll still be umming and aahing with a week to go.
cwarn23 387 Occupation: Genius Team Colleague Featured Poster
What's a search engine bot??
Have you wondered how google has ever collected all those search results. They don't have a human emailing every website owner asking for links and descriptions. Instead they have what's called a 'search engine bot' that scans the web for information which is then reported to the server for sorting and storing. And that is where 'search engine optimisation' comes in which is one of the basics of web design. Below is an example of a php site security tester bot that I made in my spare time.
<?
set_time_limit(0);
function domain($domainb) {
$bits = explode('/', $domainb);
if ($bits[0]=='http:' || $bits[0]=='https:')
{
return $bits[0].'//'.$bits[2].'/';
} else {
return 'http://'.$bits[0].'/';
}
unset($bits);
}
if (isset($_GET['site'])) {
echo '<head><title>Testing site security - '.domain($_GET['site']).'</title></head><body>';
} else {
echo '<head><title>PHP Site Security Tester</title></head><body>';
}
echo '<center><font size=5 face=\'arial black\'><b>PHP Site Security Tester</b></font><br><form method=\'get\' style=\'margin:0px; padding:0px;\'>
<input type=\'text\' name=\'site\' size=64 value="'.$_GET['site'].'"><input type=\'submit\' value=\'Test\'></form></center>';
if (substr_replace($_GET['site'],'',3)=='ftp') {
exit('You may not connect to the ftp protocole');
}
if (!isset($_GET['site'])) { exit(''); }
$_GET['site']=domain($_GET['site']);
function url_exists($durl)
{
// Version 4.x supported
$handle = curl_init($durl);
if (false === $handle)
{
return false;
}
curl_setopt($handle, CURLOPT_HEADER, true);
curl_setopt($handle, CURLOPT_FAILONERROR, true); // this works
curl_setopt($handle, CURLOPT_HTTPHEADER, Array("User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/20080623 Firefox/2.0.0.15") );
curl_setopt($handle, CURLOPT_NOBODY, true);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
$connectable = curl_exec($handle);
curl_close($handle);
if (preg_match('/200 OK/i',substr_replace($connectable,'',30))) {
return true;
} else {
return false;
}
}
//below function will only get links within own domain and not links outside the site.
function getlinks($generateurlf) {
$datac=file_get_contents($generateurlf);
preg_match_all('/(href|src)\=(\"|\')[^\"\'\>]+/i',$datac,$media);
unset($datac);
$datac=preg_replace('/(href|src)(\"|\'|\=\"|\=\')(.*)/i',"$3",$media[0]);
$datab=array();
foreach($datac AS $dfile) {
$generateurle=$generateurlf;
if (!in_array(substr_replace($dfile,'',4),array('http','www.'))) {
if (substr_replace($generateurle,'',0, -1)!=='/') {
$generateurle=preg_replace('/(.*)\/[^\/]+/is', "$1", $generateurle);
} else {
$generateurle=substr_replace($generateurle,'',-1);
}
if (substr_replace($dfile,'',1)=='/') {
if (domain($generateurle)==domain($generateurle.$dfile)) {
if (in_array(strtolower(preg_replace('/(.*)[.]([^.\?]+)(\?(.*))?/','$2',basename($generateurle.$dfile))),
array('html','htm','xhtml','xml','mhtml','xht','mht','asp','aspx','adp','bml','cfm','cgi','ihtml','jsp','las','lasso','lassoapp','pl',
'php','php1','php2','php3','php4','php5','php6','phtml','shtml','search','query','forum','blog','1','2','3','4','5','6','7','8','9',
'10','11','12','13','14','15','16','17','18','19','20','01','02','03','04','05','06','07','08','09','go','page','file'))
|| substr($generateurle.$dfile,-1)=='/' || !preg_match('/[\.]/i',basename($generateurle.$dfile))) {
$datab[]=$generateurle.$dfile;
}
}
} else if (substr_replace($dfile,'',1)=='.') {
while (preg_match('/\.\.\/(.*)/i', $dfile)) {
$dfile=substr_replace($dfile,'',0,3);
$generateurle=preg_replace('/(.*)\/[^\/]+/i', "$1", $generateurle);
}
if (domain($generateurle)==domain($generateurle.'/'.$dfile)) {
if (in_array(strtolower(preg_replace('/(.*)[.]([^.\?]+)(\?(.*))?/','$2',basename($generateurle.'/'.$dfile))),
array('html','htm','xhtml','xml','mhtml','xht','mht','asp','aspx','adp','bml','cfm','cgi','ihtml','jsp','las','lasso','lassoapp','pl',
'php','php1','php2','php3','php4','php5','php6','phtml','shtml','search','query','forum','blog','1','2','3','4','5','6','7','8','9',
'10','11','12','13','14','15','16','17','18','19','20','01','02','03','04','05','06','07','08','09','go','page','file'))
|| substr($generateurle.'/'.$dfile,-1)=='/' || !preg_match('/[\.]/i',basename($generateurle.'/'.$dfile))) {
$datab[]=$generateurle.'/'.$dfile;
}
}
} else {
if (domain($generateurle)==domain($generateurle.'/'.$dfile)) {
if (in_array(strtolower(preg_replace('/(.*)[.]([^.\?]+)(\?(.*))?/','$2',basename($generateurle.'/'.$dfile))),
array('html','htm','xhtml','xml','mhtml','xht','mht','asp','aspx','adp','bml','cfm','cgi','ihtml','jsp','las','lasso','lassoapp','pl',
'php','php1','php2','php3','php4','php5','php6','phtml','shtml','search','query','forum','blog','1','2','3','4','5','6','7','8','9',
'10','11','12','13','14','15','16','17','18','19','20','01','02','03','04','05','06','07','08','09','go','page','file'))
|| substr($generateurle.'/'.$dfile,-1)=='/' || !preg_match('/[\.]/i',basename($generateurle.'/'.$dfile))) {
$datab[]=$generateurle.'/'.$dfile;
}
}
}
} else {
if (domain($generateurle)==domain($dfile)) {
if (in_array(strtolower(preg_replace('/(.*)[.]([^.\?]+)(\?(.*))?/','$2',basename($dfile))),
array('html','htm','xhtml','xml','mhtml','xht','mht','asp','aspx','adp','bml','cfm','cgi','ihtml','jsp','las','lasso','lassoapp','pl',
'php','php1','php2','php3','php4','php5','php6','phtml','shtml','search','query','forum','blog','1','2','3','4','5','6','7','8','9',
'10','11','12','13','14','15','16','17','18','19','20','01','02','03','04','05','06','07','08','09','go','page','file'))
|| substr($dfile,-1)=='/' || !preg_match('/[\.]/i',basename($dfile))) {
$datab[]=$dfile;
}
}
}
}
unset($datac);
unset($dfile);
return $datab;
}
$loopurl['sites']=array($_GET['site']);
foreach (getlinks($_GET['site']) AS $link) {
if (!in_array($link,$loopurl['sites'])) {
$loopurl['sites'][]=$link;
}
}
unset($link);
//linux command
//; echo "<script>aaabbbcccdddeeabcefffggg</script>";
function generate($genurl) {
$data=file_get_contents($genurl);
$urlvars=explode('?',$genurl);
$newurl=$urlvars[0].'?';
$error1='None';
//error1
if (isset($urlvars[1])) {
$urlvar=explode('&',$urlvars[1]);
unset($varb);
foreach ($urlvar AS $var) {
$newurl.=preg_replace('/([^=]+)=(.*)/',"$1=; echo \"<script>aaabbbcccdddeeabcefffggg</script>\";",$var).'&';
$varb=1;
}
unset($var);
if ($varb==1) {
$newurl=substr_replace($newurl,'',-1);
if (url_exists($newurl)) {
$secondarydata=file_get_contents($newurl);
if (preg_match('/\<script\>aaabbbcccdddeeabcefffggg\<\/script\>/is',$secondarydata)) {
$error1='Page open to url injections by injecting code into the page via url.<br>The test url was: '.$newurl;
}
unset($secondarydata);
}
}
unset($varb);
}
unset($newurl);
//error2
preg_match_all('/\<form[^\>]+([^m][^e][^t][^h][^o][^d][^\=]([^\']|[^\"]|[^])([^p][^o][^s][^t]))(.*)\<\/form\>/i',$data,$forms);
$error2='None';
foreach($forms[0] AS $form) {
preg_match_all('/(input|textarea)[^\>]+name\=(\"|\'|)/i',$form,$field);
$fields=preg_replace('/(input|textarea)[^\>]+name\=(\"|\'|)(.*)/i',"$2",$field);
unset($field);
$newurls=explode('?',$genurl);
$newurl=$newurls[0];
unset($newurls);
$newurl.='?';
foreach ($fields AS $field) {
$newurl.=$field.'='.urlencode('<script>aaabbbcccdddeeabcefffggg</script>').'&';
$varb==1;
}
unset($field);
if ($varb==1) {
$newurl=substr_replace($newurl,'',-1);
if (url_exists($newurl)) {
$secondarydata=file_get_contents($newurl);
if (preg_match('/\<script\>aaabbbcccdddeeabcefffggg\<\/script\>/is',$secondarydata)) {
if ($error2=='None') { $error2='Forms may inject code into your page.<br>The page was: '.$genurl; }
}
unset($secondarydata);
}
}
}
unset($newurl);
unset($form);
unset($forms);
unset($varb);
//error3
$error3='None';
preg_match_all('/\<form(.*)(user|password)(.*)\<\/form\>/is',$data,$forms);
foreach ($forms[0] AS $form) {
if (preg_match('/\<form([^\>]+)method\=(\"|\'|)post/i',$form)) {
preg_match_all('/(input|textarea)[^\>]+name\=(\"|\'|)[^\'\"\=\>]+/is',$form,$field);
$fields=preg_replace('/(input|textarea)[^\>]+name\=(\"|\'|)(.*)([ ]+[a-zA-Z]+\=)?/i',"$3",$field[0]);
unset($field);
$postvars='';
foreach ($fields AS $field) {
$postvars.=$field.'=\' OR \'1\'=\'1\'&';
$varb=1;
}
unset($field);
if ($varb==1) {
$postvars=substr_replace($postvars,'',-1);
$ch = curl_init();
// set the target url
curl_setopt($ch, CURLOPT_URL,$genurl);
curl_setopt($ch, CURLOPT_HTTPHEADER, Array("User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/20080623 Firefox/2.0.0.15") );
// howmany parameter to post
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,$postvars);
curl_setopt($ch, CURLOPT_NOBODY, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result= curl_exec ($ch);
curl_close ($ch);
if (!preg_match('/(Log|Sign)([ _])?in/i',$result) && !preg_match('/(Log|Sign)([ _])?out/i',$data) && $result!==$data && !preg_match('/Register/i',$result)) {
if ($error3=='None') { $error3='SQL injections are possible on this page.<br>The page was: '.$genurl; }
}
}
//second attempt
preg_match_all('/(input|textarea)[^\>]+name\=(\"|\'|)[^\'\"\=\>]+/is',$form,$field);
$fields=preg_replace('/(input|textarea)[^\>]+name\=(\"|\'|)(.*)([ ]+[a-zA-Z]+\=)?/i',"$3",$field[0]);
unset($field);
$postvars='';
foreach ($fields AS $field) {
$postvars.=$field.'=" OR "1"="1"&';
$varb=1;
}
unset($field);
if ($varb==1) {
$postvars=substr_replace($postvars,'',-1);
$ch = curl_init();
// set the target url
curl_setopt($ch, CURLOPT_URL,$genurl);
curl_setopt($ch, CURLOPT_HTTPHEADER, Array("User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/20080623 Firefox/2.0.0.15") );
// howmany parameter to post
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,$postvars);
curl_setopt($ch, CURLOPT_NOBODY, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result= curl_exec ($ch);
curl_close ($ch);
if (!preg_match('/(Log|Sign)([ _])?in/i',$result) && !preg_match('/(Log|Sign)([ _])?out/i',$data) && $result!==$data && !preg_match('/Register/i',$result)) {
if ($error3=='None') { $error3='SQL injections are possible on this page.<br>The page was: '.$genurl; }
}
}
} else {
//now the $_GET attempt
preg_match_all('/(input|textarea)[^\>]+name\=(\"|\'|)[^\'\"\=\>]+/is',$form,$field);
$fields=preg_replace('/(input|textarea)[^\>]+name\=(\"|\'|)(.*)([ ]+[a-zA-Z]+\=)?/i',"$3",$field[0]);
unset($field);
$newurls=explode('?',$genurl);
$newurl=$newurls[0];
unset($newurls);
$newurl.='?';
foreach ($fields AS $field) {
$newurl.=$field.'='.urlencode('\' OR \'1\'=\'1\'').'&';
$varb=1;
}
unset($field);
if ($varb==1) {
$newurl=substr_replace($newurl,'',-1);
if (url_exists($newurl)) {
$secondarydata=file_get_contents($newurl);
//change if statement to if access granted
if (!preg_match('/(Log|Sign)([ _])?in/i',$result) && !preg_match('/(Log|Sign)([ _])?out/i',$data) && $result!==$data && !preg_match('/Register/i',$result)) {
if ($error3=='None') { $error3='SQL injections are possible on this page.<br>The page was: '.$genurl; }
}
unset($secondarydata);
}
}
//second attempt
preg_match_all('/(input|textarea)[^\>]+name\=(\"|\'|)[^\'\"\=\>]+/is',$form,$field);
$fields=preg_replace('/(input|textarea)[^\>]+name\=(\"|\'|)(.*)([ ]+[a-zA-Z]+\=)?/i',"$3",$field[0]);
unset($field);
$newurls=explode('?',$genurl);
$newurl=$newurls[0];
unset($newurls);
$newurl.='?';
foreach ($fields AS $field) {
$newurl.=$field.'='.urlencode('" OR "1"="1"').'&';
$varb=1;
}
unset($field);
if ($varb==1) {
$newurl=substr_replace($newurl,'',-1);
if (url_exists($newurl)) {
$secondarydata=file_get_contents($newurl);
//change if statement to if access granted
if (!preg_match('/(Log|Sign)([ _])?in/i',$result) && !preg_match('/(Log|Sign)([ _])?out/i',$data) && $result!==$data && !preg_match('/Register/i',$result)) {
if ($error3=='None') { $error3='SQL injections are possible on this page.<br>The page was: '.$genurl; }
}
unset($secondarydata);
}
}
}
}
unset($result);
unset($varb);
unset($form);
unset($forms);
//error4
$error4='None';
preg_match_all('/<form(.*)(user|password)(.*)<\/form>/is',$data,$forms);
foreach ($forms[0] AS $form) {
if (preg_match('/\<form([^\>]+)method\=(\"|\'|)post/is',$form)) {
preg_match_all('/(input|textarea)[^\>]+name\=(\"|\'|)[^\'\"\=\>]+/is',$form,$field);
$fields=preg_replace('/(input|textarea)[^\>]+name\=(\"|\'|)(.*)([ ]+[a-zA-Z]+\=)?/i',"$3",$field[0]);
unset($field);
$postvars='';
foreach ($fields AS $field) {
$postvars.=$field.'=<script>aaabbbcccdddeeabcefffggg</script>&';
$varb=1;
}
unset($field);
if ($varb==1) {
$postvars=substr_replace($postvars,'',-1);
$ch = curl_init($genurl);
// set the target url
curl_setopt($ch, CURLOPT_URL,$genurl);
curl_setopt($ch, CURLOPT_HTTPHEADER, Array("User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/20080623 Firefox/2.0.0.15") );
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,$postvars);
curl_setopt($ch, CURLOPT_NOBODY, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result= curl_exec ($ch);
curl_close ($ch);
if (strpos($result,'<script>aaabbbcccdddeeabcefffggg</script>')!==false) {
if ($error4=='None') { $error4='XSS/code injections are possible on this page.<br>The page was: '.$genurl; }
}
}
} else {
preg_match_all('/(input|textarea)[^\>]+name\=(\"|\'|)[^\'\"\=\>]+/is',$form,$field);
$fields=preg_replace('/(input|textarea)[^\>]+name\=(\"|\'|)(.*)([ ]+[a-zA-Z]+\=)?/i',"$3",$field[0]);
unset($field);
$newurls=explode('?',$genurl);
$newurl=$newurls[0];
unset($newurls);
$newurl.='?';
foreach ($fields AS $field) {
$newurl.=$field.'='.urlencode('<script>aaabbbcccdddeeabcefffggg</script>').'&';
$varb=1;
}
unset($field);
if ($varb==1) {
$newurl=substr_replace($newurl,'',-1);
if (url_exists($newurl)) {
$secondarydata=file_get_contents($newurl);
if (strpos($result,'<script>aaabbbcccdddeeabcefffggg</script>')) {
if ($error4=='None') { $error4='SQL injections are possible on this page.<br>The page was: '.$genurl; }
}
unset($secondarydata);
}
}
}
}
unset($result);
unset($varb);
unset($form);
unset($forms);
unset($data);
return '<tr><td colspan=4 bgcolor="#CCCCCC"><b>'.$genurl.'</b></td></tr>
<tr><td bgcolor="#CCCCCC"><b>Url to page code injections</b></td><td bgcolor="#CCCCCC"><b>$_GET Form to page code injections</b></td>
<td bgcolor="#CCCCCC"><b>Password entry SQL injections</b></td><td bgcolor="#CCCCCC"><b>Password entry XSS/code injections</b></td></tr>
<tr><td>'.$error1.'</td><td>'.$error2.'</td><td>'.$error3.'</td><td>'.$error4.'</td></tr>';
}
echo '<table border=1 cellpadding=0 cellspacing=0 width=100%>';
for ($loopid=0;isset($loopurl['sites'][$loopid]);$loopid++) {
if (url_exists($loopurl['sites'][$loopid])) {
foreach (getlinks($loopurl['sites'][$loopid]) AS $link) {
if (!in_array($link,$loopurl['sites'])) {
$loopurl['sites'][]=$link;
}
}
unset($link);
echo generate($loopurl['sites'][$loopid]);
flush();
}
usleep (5000);
}
echo '</table><p><b>Data analysis complete.</b></p></body>';
?>So above is a full search engine bot which you can try and will test a selected php website for security holes. Hope that helps you understand as I find bots easy and fun to make. But the only problem is they require a dedicated server to run 24/7 hours to scan the entire web. That is why I now only make bots that scan a single website instead of the entire internet. Like saying lets print out the internet when asking for a bot to scan the whole world wide web.
Be a part of the DaniWeb community
We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.