Overture type security script

[bzprod]

Hello,

Does anyone know what type of script Overture uses on its view bid security.

This is where you have to enter in a 4 digit number that is displayed dynamically in order to view the bid prices. I would like to incorporate this type of password protection on my sites. Thanks

God Bless,
Patrick

[Birdman]

You will have to create a bunch of images of the security codes and display them on a rotating basis. Then, you can create a database and have two columns.
col 1: filename
col 2: security_code

Then in the destination script you check that the security code entered matches the corresponding filename.

Something like that ;) It could be done quite a few ways, I imagine.

[bzprod]

Thanks...that does seem pretty simple. I will experiment with this later today.

God Bless,
Patrick

[nosanity]

The harder way (of course) is to dynamically generate an image, generate a random name, and index the two in some sort of database. This of course would be alot more difficult to implement, but it can be done.

noSanity

[Birdman]

Nosanity, I think your idea is blilliant and may actually easier using PHP [php.net] image [php.net] functions, such as: imagechar() [php.net] imagecreatefromgif() [php.net] imagecreatetruecolor() [php.net] imagepsslantfont() [php.net] and many more. It's pretty awesome what you can do.

[jatar_k]

Can you imagine how many ridiculous little images overture would have in that dir if they were all static images. ;)

create the string dynamically and use the var to create the image and then use it for the comparison as well. Should be pretty straight forward, though a little fiddly.

[mavherick]

I've been using something similar for a while. Now keep in mind that it's quite simple and surely not bullet proof but it does the job and no need for a db. So here it goes (I kept just the essential code to keep it short)

So my main page where the image display has the following:

...
<? $num_code = rand(1000,9999);?>
<img src="image.php?num_code=<?=$num_code?>" />
...
<form action="validate.php" ...>
<input type="hidden" name="num_code" value="<?=$num_code?>" />
...

image.php goes like this:

$code = $_GET['num_code'];
// just so I don't use num_code straigth in there
$code = substr(md5($code),16,4);

$png = ImageCreate(100,50);
$bgColor = ImageColorAllocate($png,0,0,0);
$textColor = ImageColorAllocate($png,255,128,128);
ImageFilledRectangle($png,0,0,100,50,$bgColor);
ImageString($png,9,20,20,$code,$textColor);

// check your GD library version (I use png here because GIF is supported in read only in mine
header("content-type: image/png");
ImagePng($png);

and then process.php:

if (substr(md5($_POST['num_code']),16,4) == $_POST['user_input'])
{
// valid
} else {
// invalid
}

again this is quite basic.
hope that helps

mavherick

[jatar_k]

nice mavherick

[nosanity]

Beautiful. *Claps Hands*

noSanity

[Birdman]

Yes, very nice! I added some code to image.php so that the characters are not in a straight line. This way a text reading app can't figure it out. I'm sure there is a more elegant way using an array.

<?php
$code = $_GET['num_code'];
// just so I don't use num_code straigth in there
$code1 = substrmd5($code,16,1);
$code2 = substrmd5($code,17,1);
$code3 = substrmd5($code,18,1);
$code4 = substrmd5($code,19,1);

$png = (ImageCreate(100,50);
$bgColor = ImageColorAllocate($png,0,0,0);
$textColor = ImageColorAllocate($png,255,128,128);
ImageFilledRectangle($png,0,0,100,50,$bgColor);
ImageString($png,9,20,15,$code1,$textColor);
ImageString($png,9,40,25,$code2,$textColor);
ImageString($png,9,60,15,$code3,$textColor);
ImageString($png,9,80,25,$code4,$textColor);

header("content-type: image/png");
ImagePng($png);
?>

[bzprod]

wow...I leave for a few hours and this is what I come back to. You guys are great...

God Bless,
Patrick

[mavherick]

Glad we could help!

I've updated my own with Birdman's improvement but had trouble with it at first, then realized it's just a few typos, but by that time rewrote it with arrays like he suggested so here it goes (image.php):

$code = substr(md5($_GET['num_code']),16,4);

for($i=0; $i<=3; $i++) { $code_letters[$i] = substr($code,$i,1); }

$png = ImageCreate(100,50);
$bgColor = ImageColorAllocate($png,0,0,0);
$textColor = ImageColorAllocate($png,255,128,128);
ImageFilledRectangle($png,0,0,100,50,$bgColor);

for($i=0; $i<=3; $i++) {
($i % 2)? $yCoor = 15 : $yCoor = 25;
$xCoor = ($i + 1) * 20;
ImageString($png,9,$xCoor,$yCoor,$code_letters[$i],$textColor);
}

header("content-type: image/png");
ImagePng($png);

mavherick