[RELEASE] UserSystem v1.0.0

[Naruto!]

PM me your msn

[Invent]

    while($furn = mysql_fetch_array($selectfurni))
    {
    echo('<a href="furni.php?mode=buy&id='.$furn[id].'"><img src="'.$furn[url].'" alt="Cost: '.$furn[price].' Credits" /></a>');
    }
    }
    }
    
    
    if($mode==buy)
    {
    $checkcreds = mysql_query("select * from usr_users where username = '$_SESSION[usr_name]'");
    $user = mysql_fetch_array($checkcreds);
    $selectfurni = mysql_query("select * from usr_furnidb where id = '$id'"); 

That is VERY insecure.

Infact the whole thing is.

You need to research var cleaning more.

[Tomm]

You did no cleaning on selection/drop down menus?

You MUST do satisfactory cleaning on ALL data that can be modified by the user.

I don't suppose you know that you can easily change the values of a dropdown box by typeing javascript (Prefixed by javascript in the address bar while viewing the site?

Emailer can be turned off for now, and i think default is set to off. u got any ideas how to fix it tho?

+

What vars arent cleaned? I know i didnt do most of the admin ones or select ones.

Thanks for advice tho :]

[Drompo]

There are many flaws of which i can see including the one's simon mentioned.

Also please use Hyphens and quote marks when using databse variables/Database queries and more... much easier to read and also use spaces

I also reccomend you use

<?php ?>

instead of

<? ?>

[Chippiewill]

hmm demo

http://habbies.blogdns.org/userssystem

[Tomm]

Plus, yes I know its a definition, but why copy my project name (Project: UserSystem, www.usersystem.net)?

[MrCraig]

Plus, yes I know its a definition, but why copy my project name (Project: UserSystem, www.usersystem.net)?

Exactly for the reason you said, it is a usersystem...

Im not trying to copy your project name

+

Simon, Yh, i will read up on var cleaning, dont know alot about security.

Thanks Anyways

[Drompo]

Exactly for the reason you said, it is a usersystem...

Im not trying to copy your project name

+

Simon, Yh, i will read up on var cleaning, dont know alot about security.

Thanks Anyways

So why release something that needs security

[Eccentric]

Sorry if im off topic but tomm is ures still avalible to download,
back on topic there are too many security holes for what im wanting for sorry cj555

[Tomm]

Also learn about seperating your layers, you should not have your presentation layer mixed up with your application layer & data layer.

Exactly for the reason you said, it is a usersystem...

Im not trying to copy your project name

+

Simon, Yh, i will read up on var cleaning, dont know alot about security.

Thanks Anyways

Sorry if im off topic but tomm is ures still avalible to download,
back on topic there are too many security holes for what im wanting for sorry cj555

Should be, do a quick search. However I can't remember if I hosted it on www.usersystem.net because if I did you'll need to wait for me to complete my server move (Moving to my new shiny server running Plesk)