I have a couple of working script that do this and my only guess that it could be either my host or something in the security script but I'll post the script in question for you guys to look at it. For whatever reason, when the user submits SOMETIMES (which is why this is hard for me to figure out), the script will hang and then fail, and then return to the previous page stating that invalid input was specified when there truly wasn't. Here is the script I'm using. I'm no expert at PHP and quite frankly this is my first website where I've actually utilized it. I love it, but this one thing is hold me back!!!
at one point I did use the set time limit function and got back this error:
This is referencing the OWASP ESAPI PHP library I use for protection and is regarding the logger. At first, the config xml file stated that the log was being made outside the root and I corrected that. Now, I dont know what's going on!
Code:
<?php
$first_name = $_POST["first_name"];
$last_name = $_POST["last_name"];
$email = $_POST["email"];
$telephone = $_POST["telephone"];
$contact_time = $_POST["contact_time"];
$detail = $_POST["detail"];
$service_type = $_POST["service_type"];
$req_id = $_POST["req_id"];
$date = time();
//-------SETUP----------------
session_start();
require ("noHack/mathAuth/ClassMathGuard.php");
require ("noHack/RSA/rsa.class.php");
require ("noHack/SecCC.php");
$userpiced = $_POST['numcheck'];//What picture did the user pick?
$fake_uno = $_POST['Likesite'];//The first box that shouldn't have data
$fake_dos = $_POST['YourAge'];//The second box that shouldn't have data
function fail_val() {
header("Location: servicereq.php?msg=invalid");
die();
}
$fromdomain = $_SERVER['HTTP_REFERER'];
$getdomain = parse_url($fromdomain);
$setdomain = strtolower($getdomain["host"]);//Where the request actually came from
$lookdomain = "keyjaycompound.com";//The domain the request needed to come from
$RSA = new RSA();
$keys = $RSA->generate_keys ($gate1, $gate2, 0);
if (isset($_SESSION['END_VALUE'])!=""){
$check_data = $RSA->decrypt ($_SESSION['END_VALUE'], $keys[2], $keys[0]); //Decrypt requested number
}
else
{
fail_val();
}
//-------------------------------
//--------VALIDATION-------------
if (MathGuard :: checkResult($_REQUEST['mathguard_answer'], $_REQUEST['mathguard_code'])&&
($userpiced == $check_data) && //Was the pic the user clicked correct?
($setdomain == $lookdomain) &&//Was the domain the request came from correct?
(isset($_SESSION['CLICK_SEND'])==1) &&//Did the user click the picMe?
($fake_uno == "")&&($fake_dos == "")//Did the user fill these fields?
)
{
unset($_SESSION['END_VALUE']);
unset($_SESSION['CLICK_SEND']);
//echo ("Great!"); //insert your code that will be executed when user enters the correct answer
} else {
fail_val();
}
//----Case Number Generator
//Note: Status Numbers:
//0 = Not Approved
//1 = Pending
//2 = Approved
//3 = Completed Note: Once this status is made, data from server (files and folder) will be deleted within 30 days. You will need to notify client of this should he need to download some data from you. DO NOT delete the client request out of the request database. Once this is up, the client will have the option of submitting a review that will be posted in the servicer database.
//4 = Dismissed
//Note: This number will also be used by you to search up service requests and to update them as per necessary. When a user submits his request, a database entry will be made with their information and this request. On that administration side on a seperate page, this will first enter the pending stage. If you approve the request, a folder will be created on the server with that user's service request id (this number) where you can put file pertaining to their request in as need be. To make it easier, it may be best to make this an upload form for you so you dont have to worry about site publishing. On the user side, there will need to be a payment button. On your side, you will need to be able to adjust the payment amount as see fit wich then gets routed to paypal. Note also that for the user to see the status of their request, they will have to enter their email and the service request number.
//-------------------------
//NOTE: Dont forget to ammend the conditions for voice over and web to enclude the additional scripts from music when done.
//-------Connection Script------
require("tmp_includesfld/db_config_service.php");
$connection = mysql_connect($db_host,$db_user,$db_password) or die("Unable to Connect to Database!");
mysql_select_db ($db_name,$connection);
//-----------------------------
//--------------------INPUT VALIDATION--------
//---LEVEL 1 ESCAPE MOST
$first_name = mysql_real_escape_string(str_replace(" ", "", $first_name));
$last_name = mysql_real_escape_string(str_replace(" ", "", $last_name));
$email = mysql_real_escape_string(str_replace(" ", "", $email));
//---LEVEL 2 OWASP
require_once dirname(__FILE__) . '/noHack/ESAPI/src/ESAPI.php';
$ESAPI = new ESAPI(dirname(__FILE__) . "/noHack/ESAPI/config/ESAPI.xml");
require_once dirname(__FILE__) .'/noHack/SecCC.php';//My Security Control Classes
global $ESAPI;
$validator = ESAPI::getValidator();
if ((($validator->isValidInput("First Name",$first_name, "AccountName", 25, false)) &&
($validator->isValidInput("Last Name",$last_name, "AccountName", 25, true)) &&
($validator->isValidInput("Phone Number",$telephone, "Phone", 25, true)) &&
($validator->isValidInput("Email Address",$email, "Email", 50, false)))) {
//Input Was Correct
}
else{
$error2 = "msg=invalid2&fn=".$first_name."&ln=".$last_name."&em=".$email."&tl=".$telephone;
header("Location: servicereq.php?".$error2);
exit();
}
//----------
$clean_contact = new cleantoHTML; //New Object using my class using ESAPI to Canonolize and Encode to HTML
$clean_detail = clone $clean_contact; //Clone of the object above for Detail
//----------
//CONTACT TIME -----------
$contact_time = $clean_contact->getcano($contact_time,0);
//JOB DETAILS -----------
$detail = $clean_detail->getcano($detail,0);
//-------------------------
//--------------------------------------------
$locate = "Location: Service_RequestSent.php?nm1=".$first_name."&nm2=".$last_name."&em=".$email."&rqi=".$req_id;
if ($service_type == 1){
$query = "INSERT INTO music (musicr_ID,first_name,last_name,email,phone,contact_time,service_details,case_ID,req_status) VALUE (NULL,'$first_name','$last_name','$email','$telephone','$contact_time','$detail','$req_id','1')";
$result = mysql_query($query,$connection) or die(mysql_error());
$str_service = "Music";
}
if ($service_type == 2){
$query = "INSERT INTO voice (voicer_ID,first_name,last_name,email,phone,contact_time,service_details,case_ID,req_status) VALUE (NULL,'$first_name','$last_name','$email','$telephone','$contact_time','$detail','$req_id','1')";
$result = mysql_query($query,$connection) or die(mysql_error());
$str_service = "Voice Acting";
}
if ($service_type == 3){
$query = "INSERT INTO web (web_ID,first_name,last_name,email,phone,contact_time,service_details,case_ID,req_status) VALUE (NULL,'$first_name','$last_name','$email','$telephone','$contact_time','$detail','$req_id','1')";
$result = mysql_query($query,$connection) or die(mysql_error());
$str_service = "Website";
}
//-----------
// EMAIL SECTION
//-----------
//----Email Modirator Notifyer-----
function send_email($from, $to, $subject, $message){
$headers = "From: ".$from."\r\n";
$headers .= "Reply-To: ".$from."\r\n";
$headers .= "Return-Path: ".$from."\r\n";
$headers .= "Content-type: text/html\r\n";
if (mail($to,$subject,$message,$headers) ) {
} else {
echo "\n email couldn't be sent";
exit();
}
}
//-----------------------------------------
//----Email Client Notifyer-----
function send_email2($from2, $to2, $subject2, $message2){
$headers2 = "From: ".$from2."\r\n";
$headers2 .= "Reply-To: ".$from2."\r\n";
$headers2 .= "Return-Path: ".$from2."\r\n";
$headers2 .= "Content-type: text/html\r\n";
if (mail($to2,$subject2,$message2,$headers2) ) {
} else {
echo "\n email couldn't be sent";
exit();
}
}
//-----------------------------------------
//----Modirator Message-----
$subject = "NEW ".$str_service." SERVICE REQUEST!";
$message .= "<html><body>";
$message .= "You have a new service request!<br>";
$message .= "Name: ".$first_name." ".$last_name."<br>";
$message .= "Email: ".$email."<br>";
$message .= "Phone: ".$phone."<br>";
$message .= "Appropriate contact time: ".$contact_time."<br>";
$message .= "Details:<br> ".$detail."<br>";
$message .= "Request ID: ".$req_id;
$message .="<br/>";
$message .="<br/>";
$message .="To modify data, <a href=\"http://keyjaycompound.com/admin_j.php\">Head to KJC Administrative Console. </a> ";
$message .= "</body></html>";
//-----------------------------------------
//----Client Message-----
$subject2 = "Your service request has been filed!";
$message2 .= "<html><body>";
$message2 .= "To ".$first_name." ".$last_name.":<br>";
$message2 .= "Thank you for contacting me in regards to my ".$str_service." services.<br>";
$message2 .= "Your request is very important to me and I will notify you at my <br>";
$message2 .= "earliest convenience. <br/>";
$message2 .= "<br/>";
$message2 .= "<b>So what happens now?:</b>";
$message2 .= "<br/>";
$message2 .= "Please read this information carefully! This email entails full details about how my services work. ";
$message2 .= "<br/>";
$message2 .= "After your service request has been reviewed and preapproved, A personal email will be sent to ";
$message2 .= "clearly identify your request(s). Once a final agreement has been reached, your service number ";
$message2 .= "will be activated and any further information or resource requests will be sent to your email via form or business email.";
$message2 .= " Once your Service ID Number is activated, you will be able to log into the <a href=\"http://keyjaycompound.com/myservicerequest.php\">My Service Request Console. </a>";
$message2 .= " The console will have full details in regards to the present status of the project, additional info provided by the customer, payments received, ";
$message2 .= "and more! Through this console and email, you will know everything there is to know regarding the progress of your project.";
$message2 .= "<br/>";
$message2 .= "<br/>";
$message2 .= "After your project is complete, any information in regards to your project will be held on the server for 45 days. If you do not download";
$message2 .= " your information within that time, your data will be deleted with NO chance of recovery.";
$message2 .= "<br/>";
$message2 .= "Below is your service request account information. Please keep this information in a safe place:";
$message2 .= "<br/>";
$message2 .= "<br/>";
$message2 .= "<center>";
$message2 .= "USERNAME: $email";
$message2 .= "<br/>";
$message2 .= "SERVICE ID: $req_id";
$message2 .= "<br/>";
$message2 .= "<br/>";
$message2 .= "If you have any inquires or are having trouble, please email directly to:<br/> contact@keyjaycompound.com.";
$message2 .= "<br>";
$message2 .= "<br>";
$message2 .= "<br>";
$message2 .= "<br>";
$message2 .= "Thank you for doing business!<br>";
$message2 .= "Jamaal \"Key Jay\" Ephriam";
$message2 .= "</body></html>";
//---------------------------------------
send_email2("KJC Website", $email,
$subject2 ,
$message2);//Send Client Message
send_email("KJC Website", "contact@keyjaycompound.com",
$subject ,
$message);//Send Admin Message
header($locate);
//-------------------------------
echo("An error has occurred! If this error still persists, please contact the administrator.");
mysql_close();
?>
Code:
Fatal error: Maximum execution time of 20 seconds exceeded in \ez.xtreemmak\[removed]\ESAPI\lib\apache-log4php\trunk\src\main\php\appenders\LoggerAppenderRollingFile.php on line 32 PHP Fatal error: Maximum execution time of 20 seconds exceeded in \ez.xtreemmak\[removed]\ESAPI\lib\apache-log4php\trunk\src\main\php\appenders\LoggerAppenderRollingFile.php on line 32
Comment