[PHP & MySQL] Problema sql injection guestbook

[Sbarboff2005]

si é vero ora ho risolto.

Ora mi sorge un altro problema che in locale sul mio pc funziona ma sul server hosting no!!

Praticamente non mi fa vedere l'immagine con in numeri e lettere per poi inserirli nell'apposito textfield e non capisco dove sta l'errore.

Pagina sign_guestbook.php

<?php
    include'connessione/connessione.php';
    require_once( 'class.captcha.php' );
    
    
    $ip = $_SERVER['REMOTE_ADDR'];
    $currentDate = date("d.m.Y - H:i:s");
    
    if (empty($_GET['session_code'])) 
        { $session_code = md5(round(rand(0,40000))); } 
    else 
        { $session_code=$_GET['session_code']; }    
    
    $my_captcha = new captcha( $session_code, '__TEMP__/' );
            
    

    $do = $_GET['do'];
    
    if ($do == 'verify')
    {
        if ($my_captcha->verify( $_POST['password'] ) )
        {
        $GB_callsign = $_POST['callsign'];
        $GB_name = $_POST['name'];
        $GB_email = $_POST['email'];
        $GB_datetime = $_POST['datetime'];
        $GB_sitename = $_POST['sitename'];
        $GB_siteurl = $_POST['siteurl'];
        $GB_oggetto = $_POST['oggetto'];
        $GB_comment = $_POST['comment'];
        $GB_ip = $_POST['ip'];
        mysql_select_db($database_name, $conn) or die (mysql_error());
        $sql = "INSERT INTO tb_guesbook (gb_callsign, gb_name, gb_linkName, gb_linkUrl, gb_dateTime, gb_object, gb_text, gb_email, gb_ip) VALUES (     '$GB_callsign',
                                    '$GB_name',
                                    '$GB_sitename',
                                    '$GB_siteurl',
                                    '$GB_datetime',
                                    '$GB_oggetto',
                                    '$GB_comment',
                                    '$GB_email',
                                    '$GB_ip')";
        $query = mysql_query(stripslashes($sql)) or die (mysql_error());
            if($query == true) {
            header("Location: guestbook.php");
            exit;    
        } }
    }

    $pic_url = $my_captcha->get_pic( 4 );
        
?>
<form name="form1" method="post" action="<?php echo $PHP_SELF;?>?do=verify&session_code=<?php echo $session_code;?>">
       
      
        <table width="500" border="0" align="center" cellpadding="0" cellspacing="0">
          <tr>
            <td width="250" class="TestoMenu">Callsign:</td>
        <td width="250" class="TestoMenu">Name:</td>
      </tr>
          <tr>
            <td><input name="callsign" type="text" class="BoxSearch" id="callsign" size="30"></td>
        <td><input name="name" type="text" class="BoxSearch" id="name" size="30"></td>
      </tr>
          <tr>
            <td></td>
            <td></td>
          </tr>
          <tr>
            <td><input name="datetime" type="hidden" id="datetime" value="<?php echo $currentDate;?>"></td>
        <td><input name="ip" type="hidden" id="ip" value="<?php echo $ip;?>"></td>
      </tr>
          <tr>
            <td class="TestoMenu">E-mail:</td>
        <td class="TestoMenu">Web Site Name: </td>
      </tr>
          <tr>
            <td><input name="email" type="text" class="BoxSearch" id="email" size="30"></td>
        <td><input name="sitename" type="text" class="BoxSearch" id="sitename" size="30"></td>
      </tr>
          <tr>
            <td></td>
        <td></td>
      </tr>
          <tr>
            <td class="TestoMenu">Web Site Url </td>
        <td></td>
      </tr>
          <tr>
            <td colspan="2"><input name="siteurl" type="text" class="BoxSearch" id="siteurl" value="http://" size="72"></td>
      </tr>
          <tr>
            <td></td>
        <td></td>
      </tr>
          <tr>
            <td class="TestoMenu">Object</td>
        <td></td>
      </tr>
          <tr>
            <td colspan="2"><input name="oggetto" type="text" class="BoxSearch" id="oggetto" size="50"></td>
      </tr>
          <tr>
            <td></td>
        <td></td>
      </tr>
          <tr>
            <td class="TestoMenu">Comment</td>
        <td></td>
      </tr>
          <tr>
            <td colspan="2"><textarea name="comment" cols="70" rows="8" class="BoxSearch" id="comment"></textarea></td>
      </tr>
          <tr>
            <td colspan="2"></td>
      </tr>
          <tr>
            <td colspan="2">[img][COLOR=red]captcha_image.php?img=<?php echo $pic_url;?>[/img][/COLOR]</td>
      </tr>
          <tr>
            <td colspan="2" class="TestoMenu"></td>
          </tr>
          <tr>
            <td colspan="2" class="TestoMenu">Displayed Code?

              

            <input type="text" class="BoxSearch" name="password"></td>
          </tr>
          <tr>
            <td colspan="2"></td>
          </tr>
          <tr>
            <td colspan="2"><input type="submit" name="Submit" class="BoxSearch" value="Insert Message"></td>
          </tr>
      </table>
</form>

file che dovrebbe visualizzare la foto, in locale funziona sul server no!

<?php

    /*
        Jax Captcha Class v1.o1 - Copyright (c) 2005, Andreas John aka Jack (tR)
        This program and it's moduls are Open Source in terms of General Public License (GPL) v2.0
    
        captcha_image.php         (captcha image service)
        
        Last modification: 2005-09-05
    */

    $tmp_dir_path               = "__TEMP__/";
    $captcha_expires_after = 420;
    // deactivate Cache
    header("Expires: Mon, 01 Jul 1990 00:00:00 GMT"); 
    header("Last-Modified: " . gmdate("D, d M Y H:i:s") ." GMT"); 
    header("Pragma: no-cache"); 
    header("Cache-Control: no-store, no-cache, max-age=0, must-revalidate");
    header("Content-Type: image/jpeg", true);
        
    if (!empty( $HTTP_GET_VARS['img'] ) )
        $img = $HTTP_GET_VARS['img'];
    else
    {
        echo 'no image file specified via &img=...';
        exit;
    }
    
    if (!$fh = fopen( $tmp_dir_path.'cap_'.$img.'.jpg', 'rb'))
    {
        echo 'could not open image file!';
    }
    else 
    {    
        fpassthru( $fh );
        fclose( $fh );
    }

    
    // clean up
    $tmp_dir = dir( $tmp_dir_path );
    while( $entry = $tmp_dir->read()) 
    {
        if ( is_file( $tmp_dir_path . $entry ) )
        {
            if ( mktime() - filemtime( $tmp_dir_path . $entry ) > $captcha_expires_after ) 
            {
                unlink( $tmp_dir_path . $entry );
            }
        }
    }
    
?>

in locale uso php 5 e sul server 4.3 credo, sono sicuro che non é la 5

Grazie Michel

Per vedere vai qui