[RE-UPLOAD]Vote for us

JohnHeatz · 08/26/2012, 03:24

What I see in here is, you "released" the file (which was not made by you), then removed and asked if anyone wanted it to simply PM you....and then, you said you were leaving the community.

Those 3 steps, made the file public, as you released it, giving the opportunity to anyone who got it, to make it public, just by changing one single letter (or even a space) would make it not "your" release, so there is absolutely nothing wrong on the release or "re-upload" of the script

tracker62 · 08/26/2012, 04:02

simple questions the player vote 12 hours after he did not receive ap

Fatal error: Call to undefined function mssql_connect() in /home/torrentf/public_html/vote/vote.php on line 27

~~mirazass~~ · 08/30/2012, 02:45

found 2 misstakes first one you can vote n times with proxy server second its injecteable

but for first steps its looking fine just nead to finish.

JohnHeatz · 08/30/2012, 02:51

That kind of exploit can be fixed by simply adding a condition on the user instead of IP address(yet I didn't find it working as a way to exploit points); while second one, by adding a security .php script on your host.

~~mirazass~~ · 08/30/2012, 03:33

well yes Jhon you are right but i hawe notice that not all players can create security.php or know anything about php its a 90% of server adm just know how to set up server but never created a single line in php ,asp or any other code lang so i think its abit wrong to put not secured scripts heare. Coder who respect him self newer do that. I hawe my own voting script its secured and you cant glich it or get N points but its hawe a smole hole( its not a hole just i think its shod be secured ) you cant use it if your ip is dinamic.

JohnHeatz · 08/30/2012, 04:07

The one file I was talking about is one that you just have to google and add, nothing anyone has to actually code.

About the "non-secured scripts" developers are releasing their codes/scripts, but they won't give all the work done, people need to understand that they need to learn a bit and use their brain as well when something is given to them; if someone is using this, it means they want to have a server, or already have one, so some basic knowledge on PhP, SQL, HxD, OllyDBG is completely needed.

And what exactly would be the issue if the IP is dynamic with your script? (Yet I would suggest, regarding that, to make a new thread and ask that so that any of the PhP Coders can reply back to you regarding that situation)

Sh1nra · 08/30/2012, 06:45

I don`t get ap after vote !!!!!

config.php

HTML Code:

<?php

        //---------------------------------------------------------- 
		// Give X coins
		// Dont forget to change this in votenow.php
        $Point = 25;
		
		// Yout website after vote was successfull
		// Add http:// in your list
        $votesite = "link from votingsite";
		
		// Time needed to vote again
		// You need to remove 1 minut from the time
		// 720 should be 12hours
		// Dont forget to change this in votenow.php
		$time_needed = "720"; // in mintutes
		
        
        // Insert your MSSQL info here 

        $mssql = array( 
          'host' => "127.0.0.1",
          'user' => "Shaiya", 
          'pass' => "my db password" 
        );
			
?>

vote.php

HTML Code:

<html>
    <head>
        <title>Vote Now!</title>
        <style>
           body { background-color: #202020; 
                  color: yellow;
                }	
        </style>
    </head>
	<body>
		<?php
        // Report all PHP errors (see changelog)
		error_reporting(E_ALL);
		
		// for gedimazs
		
		include ("config.php");
		
						
        //---DO NOT EDIT ANYTHING BELOW HERE UNLESS YOU KNOW WHAT YOU ARE DOING!! ---
		
		function clean($str){
			return is_array($str) ? array_map('clean', $str) : str_replace("\\", "\\\\", htmlspecialchars((get_magic_quotes_gpc() ? stripslashes($str) : $str), ENT_QUOTES));
		}

		  
		$mslink = mssql_connect($mssql['host'],$mssql['user'],$mssql['pass']);
		$ip = $_SERVER['REMOTE_ADDR'] ;
        $UserID = clean($_POST['UserID']);
		$date = date("Y-m-d G:i");
        
        if (empty($UserID)){
		
			echo '<SCRIPT LANGUAGE="JavaScript">alert("You didnt enter a account name! \n Please try again.")</script>';
			echo "<script type='text/javascript'>window.location='votenow.php';</script>";
			exit();

			
        } elseif(!preg_match("/[0-9a-zA-Z]?/", $UserID)) {
		
			echo '<SCRIPT LANGUAGE="JavaScript">alert("Incorrect account name format. \n Please try again.")</script>';
			echo "<script type='text/javascript'>window.location='votenow.php';</script>";
			exit();

			
        } else {
            
            $result1 = mssql_query("SELECT * FROM PS_UserData.dbo.Users_Master WHERE UserID= '".$UserID."' ",$mslink);
            $count1 = mssql_num_rows($result1);
			$row1 = mssql_fetch_row($result1);
			
			
			
            if($count1 == '0') {
			
				echo '<SCRIPT LANGUAGE="JavaScript">alert("Account not found. \n Please try again.")</script>';
				echo "<script type='text/javascript'>window.location='votenow.php';</script>";
				exit();


			} else {
			
			
			
				
					// he visted the dshop.. contiue
					// found account found in votes, get his info
					$result2 = mssql_query("SELECT * FROM PS_UserData.dbo.USER_VOTES WHERE UserID = '".$UserID."' ",$mslink);
					$row2 = mssql_fetch_row($result2);
					$count2 = mssql_num_rows($result2);
					
					
					$voted_ip = $row2[2];
					$voted_date = $row2[3];
					$voted_id = $row2[0];
					$voted_UserID = $row2[1];
					$to_time = strtotime($voted_date);
					$from_time = strtotime($date);
					
					//
					if($count2 == 1){
					//i found account in votes
					
					
						// check if time has expired
						if (round(abs($to_time - $from_time) / 60,2) > $time_needed) {
						// time expired,delete his info and add new one
							$Point = $Point;	
							
							mssql_query("DELETE FROM PS_UserData.dbo.user_votes WHERE UserID = '".$row1[1]."'",$mslink);
							mssql_query("INSERT INTO PS_UserData.dbo.user_votes (UserID,ip,date) VALUES ('".$UserID."','".$ip."','".$date."' ) ",$mslink);		
							mssql_query("UPDATE PS_UserData.dbo.Users_Master SET Point = Point+".$Point." WHERE UserID = '".$row1[2]."'",$mslink);	
							echo '<SCRIPT LANGUAGE="JavaScript">alert("Thank you for you vote!")</script>';
							echo "<script type='text/javascript'>window.location='$votesite';</script>";
							exit();
						
						} else { 
						// time not expired
							echo '<SCRIPT LANGUAGE="JavaScript">alert("You cant vote anymore! \n Vote time did not expire yet. \n Please try again later.")</script>';
							echo "<script type='text/javascript'>window.location='votenow.php';</script>";
							exit();
							
						}
							
							
							
					} else {
					
						// check is new account have voted IP
						$result3 = mssql_query("SELECT * FROM PS_UserData.dbo.user_votes WHERE ip = '".$ip."' ",$mslink);
						$count3 = mssql_num_rows($result3);
					
						
						if($count3 == 1){
							
							echo '<SCRIPT LANGUAGE="JavaScript">alert("You cannot vote anymore with this IP! \n Please wait until you time has expired.")</script>';
							echo "<script type='text/javascript'>window.location='votenow.php';</script>";
							exit();

						} else {
							
							$Point = $Point;	
							mssql_query("INSERT INTO PS_UserData.dbo.user_votes (UserID,ip,date) VALUES ('".$UserID."','".$ip."','".$date."' ) ",$mslink);
							mssql_query("UPDATE PS_UserData.dbo.Users_Master SET Point = Point+".$Point." WHERE UserID = '".$row1[0]."'",$mslink);			
							echo '<SCRIPT LANGUAGE="JavaScript">alert("Thank you for you vote!")</script>';
							echo "<script type='text/javascript'>window.location='$votesite';</script>";
							exit();
							
						}
						
						
					}
				}
			}
        
		mssql_close($mslink);
        ?>
	</body>
</html>

votenow.php

HTML Code:

<html>
	<head>
		<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
		<title> vote for coins</title>
		<style type="text/css">
			div#container
			{
			   width: 350px;
			   position: relative;
			   margin-top: 0px;
			   margin-left: auto;
			   margin-right: auto;
			   text-align: left;
			}
			body
			{
			   text-align: center;
			   margin: 0;
			}
		</style>
	</head>
	<body bgcolor="#202020" text="#FFD700">
		<div id="wb_Text1" style="position:absolute;left:10px;top:120px;width:240px;height:14px;z-index:0;" align="left">
			<font style="font-size:11px" color="#ffd700" face="Arial">You can vote every 12 hours. 1 vote = 25 AP</font>
        </div>
						<img src="http://www.xtremeTop100.com/votenew.jpg" border="0" alt="Shaiya Stars" style="position:absolute;left:250px;top:34px; >
        <div id="container">
            <div id="wb_Form1" style="position:absolute;left:0px;top:0px;width:239px;height:135px;z-index:3;" align="left">
                   <form name="Form1" method="post" action="vote.php" id="Form1">
                        <div id="wb_Text1" style="position:absolute;left:10px;top:15px;width:78px;height:14px;z-index:0;" align="left">
                            <font style="font-size:11px" color="#FFD700" face="Arial">Account name:</font></div>
                        <input type="text" id="Editbox1" style="position:absolute;left:10px;top:34px;width:200px;font-family:Courier New;font-size:16px;z-index:1" name="UserID" value="">
                        <input type="submit" id="Button1" name="Button1" value="Klicken zum Voten" style="position:absolute;left:10px;top:65px;width:200px;height:25px;font-family:Arial;font-size:13px;z-index:2">
                    </form>
                </div>
            </div>
		</div>
	</body>
</html>

Is there any wrong ?

I put the files in htdocs/Voting in xampp
then i type {myip}/Voting/votenow.php

I type acc name, vote search my server, but i don`t get ap

~~..Zeus..~~ · 08/30/2012, 20:19

i will help but you make a mistake

treica · 09/05/2012, 12:26

On the script you can't vote N times nor even with proxy as long your username is on the table.
Later when I got an computer I'll post the secured one.
@mirzass pls stop being a btch and be proud as long u request 100$ per month ... Grrrrr

To make this script work correctly all you need is a bit knowledge about PHP and SQL .
Regards.

Svinseladden · 09/07/2012, 08:24

anyone have odbc for this?

<- lazy guy.. use php manager for iis and made that work so not even tried anything else LOL

~~..Zeus..~~ · 09/12/2012, 13:46

you can easy translate this too odbc Good luck

Svinseladden · 09/12/2012, 15:15

you say easy and i scratch my head LOL

but i have friends:-)

sockie82 · 10/03/2012, 08:09

Do i have to upload this for each voting site or is there a way of linking it to more than one without uploading it multiple times with the different websites

[Boss]FemmeFatale · 11/09/2012, 00:59

I put each up seperately
Is there a way to do it all one page

~~bar2eldad~~ · 11/12/2013, 18:50

Error Line 27 Vote.php