[PHP] array and strpos Need HELP!

[Ramazan]

I'm trying to make something I can find on websites those words have or not but I can't print which word I have found.

 

[693840]

I'm trying to make something I can find on websites those words have or not but I can't print which word I have found.
View attachment 176011

Loop through $crawl with a for or foreach loop. You are now trying to put the method on an array instead of the strings inside the array.

I'm on my phone now, but maybe someone else can type it out.

@Gogol Deleted member 923340

 

[Ramazan]

Loop through $crawl with a for or foreach loop. You are now trying to put the method on an array instead of the strings inside the array.

I'm on my phone now, but maybe someone else can type it out.

@Gogol Deleted member 923340

I see I'm not good at those things but trying to make free tools for website owners. If anyone helps me with code I'm really appricaited

 

[TomTheCat]

I see I'm not good at those things but trying to make free tools for website owners. If anyone helps me with code I'm really appricaited

<?php

if (isset($_POST['checker'])) {
    $content = file_get_contents($_POST['checkurl']);
    $content = htmlspecialchars($content);
    $words = [
        'HAPpY', 'Demo', 'Thing'
    ];

    foreach ($words as $word) {
        if (strpos($content, $word) !== false) {
            echo $word . ' found!' . PHP_EOL;
        } else {
            echo $word . ' not found!' . PHP_EOL;
        }
    }
}

Next time, post the code inside CODE tags, not as image

 

[693840]

<?php

if (isset($_POST['checker'])) {
    $content = file_get_contents($_POST['checkurl']);
    $content = htmlspecialchars($content);
    $words = [
        'HAPpY', 'Demo', 'Thing'
    ];

    foreach ($words as $word) {
        if (strpos($content, $word) !== false) {
            echo $word . ' found!' . PHP_EOL;
        } else {
            echo $word . ' not found!' . PHP_EOL;
        }
    }
}

Next time, post the code inside CODE tags, not as image

My man! I gave up on my phone because of that haha, didn't want to type that all over

 

[Ramazan]

<?php

if (isset($_POST['checker'])) {
    $content = file_get_contents($_POST['checkurl']);
    $content = htmlspecialchars($content);
    $words = [
        'HAPpY', 'Demo', 'Thing'
    ];

    foreach ($words as $word) {
        if (strpos($content, $word) !== false) {
            echo $word . ' found!' . PHP_EOL;
        } else {
            echo $word . ' not found!' . PHP_EOL;
        }
    }
}

Next time, post the code inside CODE tags, not as image

Thank you so much and mb. You are right. Actually I don't wanna show them which words I'm searching for. When I found a word on website I could show which word is they have. Thanks for your time again.

 

[Gogol]

<?php

if (isset($_POST['checker'])) {
    $content = file_get_contents($_POST['checkurl']);
    $content = htmlspecialchars($content);
    $words = [
        'HAPpY', 'Demo', 'Thing'
    ];

    foreach ($words as $word) {
        if (strpos($content, $word) !== false) {
            echo $word . ' found!' . PHP_EOL;
        } else {
            echo $word . ' not found!' . PHP_EOL;
        }
    }
}

Next time, post the code inside CODE tags, not as image

Should work, however...

That file_get_contents call may (and will) result in LFI attack.
It's unsanitized user input.

For example what if I send / etc / passwd (remove spaces, cf is weird) as the checkurl?

 

[693840]

Should work, however...

That file_get_contents call may (and will) result in LFI attack.
It's unsanitized user input.

For example what if I send / etc / passwd (remove spaces, cf is weird) as the checkurl?

 

[Ramazan]

Should work, however...

That file_get_contents call may (and will) result in LFI attack.
It's unsanitized user input.

For example what if I send / etc / passwd (remove spaces, cf is weird) as the checkurl?

<form action="page.php" method="POST">
      <input type="text" name="checkurl">
      <button name="checker">Check</button>
    </form>

I'm using like this. There is no db connection or something. Only one-page work for this.

 

[Gogol]

<form action="page.php" method="POST">
      <input type="text" name="checkurl">
      <button name="checker">Check</button>
    </form>

I'm using like this. There is no db connection or something. Only one-page work for this.

Yeah the code should work like i said. If thats all you have, you should be ok. However if you use the content further, e.g. print the value of $content, it will print sensitive server files (in other words, LFI or local file inclusion).

 

[TomTheCat]

Should work, however...

That file_get_contents call may (and will) result in LFI attack.
It's unsanitized user input.

For example what if I send / etc / passwd (remove spaces, cf is weird) as the checkurl?

He should turn on open_basedir

 

[Gogol]

He should turn on open_basedir

Hmm does that work? Not sure, i gotta check that setting. What I would do in this case is break the string apart with / and \ and then take the last member of the array, which should be the filename. Ofcourse, this could also be overflown or something, but it can be handled with a try catch.

Or a better approach would be to use a switch case and compare the input against known cases. Like

case 'blabla':
Do bla bla;
break;

That way, you never get anything unexpected.