Php firewall script example with download

This is a simple firewall php script which filter form data against XSS SQLI FRI LFi attacks
I would like to say that i was playing around with it.
Note that some methods are not totally filtered (preg_match like ../) etc..
Either i dont have time to go back and edit it.
Do not use this code on your site until you know what you are doing, its just an sample!

Download

<?php
error_reporting(0);

// ###########################################
// simple firewall
// coded by Mikel Doka
// http://www.thecodertips.com
// its not something big, i was just playing around
// then moved to trash o.0 :P
// you can easily implement it to your site but dont take this as
// a functional firewall
// it has or may contain bugs
// i mean learn from code :D
// ###########################################

// get ip

$ip_logged = htmlentities($_SERVER['REMOTE_ADDR']);

// html

$html = "<html><head><title>Hack Attemp Logged</title></head><body style='background-color:red'><center><h1>$ip_logged<br />Hack Attemp Detected!<br />Your IP has been logged and will be reported to your ISP.</h1></center></body></html>";

// too long

$too_long = "<html><head><title>Data too long</title></head><body style='background-color:red'><center><h1>Try something more short.</h1></center></body></html>";

// ###########################################
// get post title
// ###########################################

if(isset($_GET['title'])){

$url = $_GET['title'];

if(strlen($url) > 300){
die($too_long);
}

// switch to lowercase, good sqli prevention

$url = strtolower($_GET['title']);

// anti sqli

if(preg_match("/--/", $url)){
die($html);
}
else
if(preg_match("/;/", $url)){
die($html);
}
else
if(preg_match("/0x/", $url)){
die($html);
}
else
if(preg_match("/@@/", $url)){
die($html);
}
else
if(preg_match("/alter/", $url)){
die($html);
}
else
if(preg_match("/char/", $url)){
die($html);
}
else
if(preg_match("/begin/", $url)){
die($html);
}
else
if(preg_match("/cast/", $url)){
die($html);
}
else
if(preg_match("/create/", $url)){
die($html);
}
else
if(preg_match("/cursor/", $url)){
die($html);
}
else
if(preg_match("/declare/", $url)){
die($html);
}
else
if(preg_match("/delete/", $url)){
die($html);
}
else
if(preg_match("/drop/", $url)){
die($html);
}
else
if(preg_match("/end/", $url)){
die($html);
}
else
if(preg_match("/fetch/", $url)){
die($html);
}
else
if(preg_match("/insert/", $url)){
die($html);
}
else
if(preg_match("/kill/", $url)){
die($html);
}
else
if(preg_match("/open/", $url)){
die($html);
}
else
if(preg_match("/select/", $url)){
die($html);
}
else
if(preg_match("/sys/", $url)){
die($html);
}
else
if(preg_match("/update/", $url)){
die($html);
}
else
if(preg_match("/union/", $url)){
die($html);
}
else
if(preg_match("/or/", $url)){
die($html);
}
else
if(preg_match("/from/", $url)){
die($html);
}
else
if(preg_match("/like/", $url)){
die($html);
}
else
if(preg_match("/and/", $url)){
die($html);
}
else
if(preg_match("/all/", $url)){
die($html);
}
else
if(preg_match("/group_concat/", $url)){
die($html);
}
else
if(preg_match("/order/", $url)){
die($html);
}
else
if(preg_match("/by/", $url)){
die($html);
}
else
if(preg_match("/version/", $url)){
die($html);
}
else
if(preg_match("/table/", $url)){
die($html);
}
else
if(preg_match("/database/", $url)){
die($html);
}

// anti xss

else
if(preg_match("/script/", $url)){
die($html);
}
else
if(preg_match("/alert/", $url)){
die($html);
}
else
if(preg_match("/img/", $url)){
die($html);
}
else
if(preg_match("/cookie/", $url)){
die($html);
}
else
if(preg_match("/href/", $url)){
die($html);
}
else
if(preg_match("/input/", $url)){
die($html);
}
else
if(preg_match("/form/", $url)){
die($html);
}

// anti rfi and outgoing scripts like .php .js etc..

else
if(preg_match("/http/", $url)){
die($html);
}
else
if(preg_match("/.php/", $url)){
die($html);
}
else
if(preg_match("/.js/", $url)){
die($html);
}
else
if(preg_match("/.asp/", $url)){
die($html);
}
else
if(preg_match("/phtm/", $url)){
die($html);
}

// anti lfi

else
if(preg_match("/etc/", $url)){
die($html);
}
else
if(preg_match("/passwd/", $url)){
die($html);
}
else
if(preg_match("/proc/", $url)){
die($html);
}
else
if(preg_match("/self/", $url)){
die($html);
}
else
if(preg_match("/environ/", $url)){
die($html);
}

// shell functions

else
if(preg_match("/passthru/", $url)){
die($html);
}
else
if(preg_match("/exec/", $url)){
die($html);
}
else
if(preg_match("/open/", $url)){
die($html);
}
else
if(preg_match("/load_file/", $url)){
die($html);
}
else
if(preg_match("/system/", $url)){
die($html);
}
else
if(preg_match("/show_source/", $url)){
die($html);
}

}

Sql Injection security tutorial | Web Security part 1

In this tutorial about preventing sql injection we will explain various methods to keep a blog safe against attackers.

We will focus on three php functions:
1. mysql_real_escape_string() 2.
int/is_numeric etc..
3. string length (tip)
Lets start with mysql_real_escape_string.
It's a php function made for the prupose of escaping dangerous charachters.

Before starting i suggest you read Php Mysql post to database and Building a blog with Php and Mysql


Now lets explain what mysql_real_escape_string does

1. Filters dangerous charachters against sql injection.
2. Keep us safe

Note! this function does not work when a nysql connection is not set, for filtering stuff when no mysql database is added we can use htmlspecialchars() or htmlentities()

Im gonna show a simple script which is vulerable to sql injection, i suppose you know to build one.
<?php
$user = $_POST['user'];
$pass = $_POST['pass'];
mysql_query("UPDATE users SET pass=$pass WHERE user=$user");
?>

That script suffers from Sql Injection and is not safe for use but we can make it to.

<?php
$user = mysql_real_escape_string($_POST['user']);
$pass = mysql_real_escape_string($_POST['pass']);
mysql_query("UPDATE users SET pass=$pass WHERE user=$user");
?>


We can also use htmlspecialchars or htmlentities with mysql_real_escape_string


Other things to try

1. trim (filters spaces and new lines)
2. htmlentities (cross site scripting security)
3. htmlspecialchars (cross site scripting security)
4. is_int (if is numeric)
5. strlen (string length)

And finally

1. php chaptcha (anti spam)
2. protecting folder using php
3. limiting string length tutorial

Conclusion, always use mysql_real_escape_string to prevent sql injection.