stoppt-den-Spam.info

[chris1993]

hi mein problem ist dass ich auch ohne captcha einen eintrag machen kann.Hier meine index vom gästebuch.Hier die internetseite
http://chris1993.kilu.de/book/

Code: Alles auswählen

<?php
session_start();

include("admin/config.php");
include("header.php");
?>
<h2><? echo $heading; ?></h2>


<form name="form" action='index.php' method='post'>
<table border="0" cellspacing="0" cellpadding="0">
  <tr>
    <td><table border='0' cellspacing='3' cellpadding='5'>
      <tr>
        <td width="79">Name * </td>
        <td width="192"><input type='text' name='name' /></td>
      </tr>
      <tr>
        <td>eMail * </td>
        <td><input type='text' name='mail' /></td>
      </tr>
      <tr>
        <td>Website</td>
        <td><input type='text' name='hp' /></td>
      </tr>

      <tr>
        <td>Captcha</td>
        <td>  <img src="http://chris1993.kilu.de/captcha/captcha.php" border="0" title="Sicherheitscode">  <input type="text" name="sicherheitscode" size="5">
      </tr>
      <tr>
        <td rowspan="2">Eintrag *</td>
        <td><?
if($smilies == true)
{ ?>
          <textarea name='eintrag' rows='7' cols='60'></textarea></td>
      </tr>
      <tr>
        <td><img src="smilies/bigeek.gif" width="15" height="15" onClick="icon(this);"  alt=":-O" />&nbsp;<img src="smilies/biggrin.gif" width="15" height="15" onClick="icon(this);" alt=":-D" /><img src="smilies/bigrazz.gif" width="15" height="15" onClick="icon(this);" alt=":-P" /><img src="smilies/cool.gif" width="15" height="15" onClick="icon(this);" alt="8-)" /><img src="smilies/dead.gif" width="15" height="15" onClick="icon(this);" alt="X-(" /><img src="smilies/mad.gif" width="15" height="15" onClick="icon(this);" alt=":-<" /><img src="smilies/rolleyes.gif" width="15" height="15" onClick="icon(this);" alt="%-)" /><img src="smilies/smilewinkgrin.gif" width="15" height="15" onClick="icon(this);" alt=":-P" /><img src="smilies/smilewinkgrin.gif" width="15" height="15" onClick="icon(this);" alt=":-P" /><img src="smilies/wink.gif" width="15" height="15" onClick="icon(this);" alt=";-)" /></td>
      </tr>
      <tr>
        <td>&nbsp;</td>
        <td><input type='submit' name='submit' value='Eintragen' />
      (* Pflichtfelder) </td>
      </tr>
    </table>
      </td>
    <td valign="top"><br />
      <script language='JavaScript' type='text/javascript'>
<!--
function icon(obj)
{
document.form.eintrag.value += obj.getAttribute('alt');
document.form.eintrag.focus();
}
//-->
</script>
<br /></td>
<? } ?> </tr>
</table>

</form>


<?

$start = $_GET["start"];
if (!$start) $start = 0;
$perpage = 10;

function showpages() {

global $start;
global $perpage;

$pages = ceil(mysql_num_rows(mysql_query("SELECT id FROM admyn_gbook"))/$perpage);
$next = 0;
$i = 1;

if ($pages > 1) {
echo "<div align='center'>Seite: ";
while ($i <= $pages) {
if ($next == $start) echo "<strong>$i</strong> ";
else echo "<a href='index.php?start=$next'>$i</a> ";
$next = $next+$perpage;
$i++;
}
echo "</div><br />";
}
}


if($_POST["submit"])
{
        echo"<br />";
        $name = $_POST["name"];
        $mail = $_POST["mail"];
        $eintrag = $_POST["eintrag"];
        $icq = $_POST["icq"];
        $hp = $_POST["hp"];
                if(!$name or !$mail or !$eintrag or !ereg(".+@+.+\.+.",$mail) or $icq > "0" and !ereg("[0-9]",$icq))
                {
                        echo "<span style='color:red'>Es wurden Felder falsch bzw. nicht ausgefüllt.</span><br />";
         if (!isset($_SESSION['captcha_spam']) || $_POST["sicherheitscode"] != $_SESSION['captcha_spam']) {
$err_text.="Der Sicheheitscode ist falsch<br>";
}
                }
                else {
                        if(!ereg("http://",$hp) and $hp != "")
                        {
                                $hp = "http://".$hp;
                        }
                        $eintrag = ereg_replace("<","&lt;",$eintrag);
                        $eintrag = ereg_replace(">","&gt;",$eintrag);
                        echo "<span style='color:green'>Dein Eintrag wurde hinzugef&uuml;gt</span><br />";
                        mysql_query("INSERT INTO admyn_gbook (hp, name, email, text, icq, date, ip) VALUES ('$hp', '$name', '$mail', '$eintrag', '$icq', '".time()."', '".$_SERVER['REMOTE_ADDR']."')") or die(mysql_error());
                }
}

//AUSGABE
$nr = mysql_num_rows(mysql_query("SELECT id FROM admyn_gbook"))-$start;

echo"<p>&nbsp;</p>";
echo"".showpages()."";

$result = mysql_query("SELECT * FROM admyn_gbook ORDER BY id DESC LIMIT $start,$perpage ");

echo"<table  width='80%' cellspacing='0' align='center'>";
while ($row = mysql_fetch_object($result))
{
$row->hp = str_replace("&","&amp;",$row->hp);
$row->text= htmlspecialchars($row->text);

//Smilies ersetzen
if($smilies == true)
{
$row->text = str_replace(":-O","<img src='smilies/bigeek.gif' alt='' />",$row->text);
$row->text = str_replace(":-D","<img src='smilies/biggrin.gif' alt='' />",$row->text);
$row->text = str_replace(":-P","<img src='smilies/bigrazz.gif' alt='' />",$row->text);
$row->text = str_replace("8-)","<img src='smilies/cool.gif' alt='' />",$row->text);
$row->text = str_replace(":-(","<img src='smilies/cry.gif' alt='' />",$row->text);
$row->text = str_replace("X-(","<img src='smilies/dead.gif' alt='' />",$row->text);
$row->text = str_replace(":->","<img src='smilies/laugh.gif' alt='' />",$row->text);
$row->text = str_replace(":love:","<img src='smilies/love.gif' alt='' />",$row->text);
$row->text = str_replace(":-<","<img src='smilies/mad.gif' alt='' />",$row->text);
$row->text = str_replace(":no:","<img src='smilies/no.gif' alt='' />",$row->text);
$row->text = str_replace(":-|","<img src='smilies/none.gif' alt='' />",$row->text);
$row->text = str_replace("%-)","<img src='smilies/rolleyes.gif' alt='' />",$row->text);
$row->text = str_replace(":-)","<img src='smilies/smile.gif' alt='' />",$row->text);
$row->text = str_replace(":-P","<img src='smilies/smilewinkgrin.gif' alt='' />",$row->text);
$row->text = str_replace(";-)","<img src='smilies/wink.gif' alt='' />",$row->text);
$row->text = str_replace(":yes:","<img src='smilies/yes.gif' alt='' />",$row->text);
}

echo"
  <tr>
    <td align='left' valign='top' style='border:1px $borderstyle $bordercolor; padding:10px;' nowrap width='20%'><span style='font-size:10px;'><em>Eintrag Nr. ".$nr."</em></span><br />
        <strong>".$row->name."</strong><br />".date("d.m.Y",$row->date)."&nbsp;-&nbsp;".date("H:i",$row->date)."<br />
        <a href='mailto:".$row->email."'><img style='border:0px;' src='mail.gif' alt='".$row->email."' /></a> ";
        if( $row->hp != "") { echo"<a href='".$row->hp."' target='_blank'><img style='border:0px;' src='home5.gif' alt='".$row->hp."' /></a> "; }
        if( $row->icq > 10000000 && is_numeric($row->icq)) { echo"<a href='http://wwp.icq.com/scripts/search.dll?to=".str_replace("-","",$row->icq)."'><img style='border:0px;' src='http://online.mirabilis.com/scripts/online.dll?icq=".str_replace("-","",$row->icq)."&amp;img=5' alt='".str_replace("-","",$row->icq)."' /></a> "; }
        echo"</td>
    <td align='left' valign='top' style='padding:10px; border:1px $borderstyle $bordercolor;'>".nl2br($row->text)."</td>
  </tr>
  <tr>
    <td style='height:30px;'>&nbsp;</td>
    <td>&nbsp;</td>
  </tr>";
  $nr--;
}
echo"</table>";

showpages();
?>

<? include("footer.php"); ?>

MFG
chris1993

[helado]

so wie es aussieht, hast du n denkfehler:

if(!$name or !$mail or !$eintrag or !ereg(".+@+.+\.+.",$mail) or $icq > "0" and !ereg("[0-9]",$icq))
{
echo "<span style='color:red'>Es wurden Felder falsch bzw. nicht ausgefüllt.</span><br />";
if (!isset($_SESSION['captcha_spam']) || $_POST["sicherheitscode"] != $_SESSION['captcha_spam']) {
$err_text.="Der Sicheheitscode ist falsch<br>";
}
}


schau dir mal das genauer an, du hast den rest des codes so gut hin bekommst, dann schaffst auch das...

mfg

thomas

[chris1993]

sorry aber ich habe überhaupt keine ahnung in php