Forum Moderators: coopster

Message Too Old, No Replies

ip ban works on localhost, not on www

         

nshack31

8:13 pm on Apr 25, 2005 (gmt 0)

10+ Year Member



I have the following page to ban people from viewing my website...


<?php
$iptest = $_SERVER['REMOTE_ADDR'];

$data="";
$fp = @fopen("../ip.txt", "rb") or die("Couldn't open file");

while(!feof($fp))
{
$data .= fgets($fp, 1024);
}

fclose($fp);

$values = explode("\r\n", $data);

if(in_array($iptest, $values))
{
die('You have been banned from this site');
}
?>

The contents of ip.txt are in the following format..
81.59.75.xx
81.27.204.#*$!
80.127.6.xxx
212.32.102.xxx

If i add 127.0.0.1 and run this page from a localhost it bans me successfully but as soon as I upload the page it and add my IP to test it, it does not work on the web! Can anybody help?! thanks

mcibor

9:23 pm on Apr 25, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



You don't check the #*$!, and #*$ so why should it work?
the function in_array returns true if the string matches the whole field in array:

in_array("a", array("a", "b", "c")) returns true, but
in_array("a", array("ab", "a c", "a a")) returns false.

there's some way to do this with regex, however I don't know that very well. I'll try to think of something and post it here.

Michal Cibor

nshack31

9:27 am on Apr 26, 2005 (gmt 0)

10+ Year Member



81.59.75.xx
81.27.204.#*$!
80.127.6.xxx
212.32.102.xxx

please note ive placed the x's in to blank the ip's out, the actual text file has full ip's in

mcibor

7:30 pm on Apr 26, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



The problem lies within exploding. You don't explode to different ips, just creating a one element array with the whole file. This is what is being created:

array(0 => "1.2.3.4 123.123.123.123 1.1.1.1") not
array(0 => "1.2.3.4", 1 => "123.123.123.123", etc
it means that the explode doesn't find what it is exploded by. Maybe in file there's just \r or just \n.
However I would create array during reading the file:

$i = 0;
$replace = array("\r", "\n", "\"", "'", "\\");
while(!feof($fp))
{
$values[$i++] = str_replace($replace, "", fgets($fp, 1024));//this will get rid of new line and malicious code
}
//values = explode(...) - comment it

To check what's being generated write
foreach($values as $kye=>$value) echo "Key: $key; Value: $value<br>";