Hab's mal versucht, weiß nicht ob es richtig ist oder funktioniert.
Wär' nett wenn's jemand testen könnte.
Code:
<?php
require("./inc/config.inc.php");
$sqlServ = mysqli_connect(SQL_HOST, SQL_USER, SQL_PASS);
if (mysqli_connect_errno())
{
echo "<b>Die Verbindung zum Datenbank-Server ist fehlgeschlagen!<b><br>
<a href='http://board.servername.de/'><b>Forum</b></a>";
die;
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<link rel="stylesheet" type="text/css" href="style.css">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title><?PHP echo $serverSettings['titel_page'];?></title>
<script src='https://www.google.com/recaptcha/api.js'></script>
</head>
<body>
<div class="wrapper">
<div class="logo">
<img src="img/logo.png" alt="logo_s">
</div>
<div class="main_head">
<h1>⇒ Registration für die BETA</h1>
</div>
<div class="main_content">
<div class="youtube">
<iframe width="340" height="290" src="//www.youtube.com/embed/OKzLC3P0AYI" frameborder="0" allowfullscreen></iframe>
</div>
<div class="registerx">
<p>Alle Felder sind Pflichtfelder.</p>
<?php
$username = mysqli_real_escape_string($sqlServ, $_POST['username']);
$passwort = mysqli_real_escape_string($sqlServ, $_POST['passwort']);
$email = mysqli_real_escape_string($sqlServ, $_POST['email']);
$delete = mysqli_real_escape_string($sqlServ, $_POST['delete']);
$captcha = mysqli_real_escape_string($sqlServ, $_POST['g-recaptcha-response']);
if(!isset($_POST['username']) OR !isset($_POST['passwort']) OR !isset($_POST['email']) OR !isset($_POST['delete']) OR !isset($_POST['g-recaptcha-response']))
{
?>
<form action="/" method="post">
<input class="txtbox" type="text" size="24" maxlength="50" name="username" placeholder="Benutzername"><br>
<input class="txtbox" type="password" size="24" maxlength="50" name="passwort" placeholder="Passwort"><br>
<input class="txtbox" type="text" size="24" maxlength="50"name="email" placeholder="[Only registered and activated users can see links. Click Here To Register...]"><br>
<input class="txtbox" type="text" size="24" maxlength="50"name="delete" placeholder="1234567"><br>
<input class="register" type="submit" value="Start">
<div class="g-recaptcha" data-sitekey="6Lewu_8SAAAAALvaTwOmGIq7OhYgUIXqkBG0RdWF"></div>
</form>
<?php
}
elseif($_POST['username']=="" OR $_POST['passwort'] == "" OR $_POST['email'] == "" OR $_POST['delete'] == "" OR $_POST['g-recaptcha-response'] == "")
{
echo "<p>Registration fehlgeschlagen.1</p>";
echo '<br><a href="http://www.myscha.de">Versuch es nochmal!</a>';
}
else
{
$response=file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=6Lewu_8SAAAAAAZPv4q4ZUZ9fgEbYza45Jq6KUjt&response=".$captcha."&remoteip=".$_SERVER['REMOTE_ADDR']);
if($response.success==false)
{
echo "<p>Registration fehlgeschlagen.</p>";
echo '<br><a href="http://www.myscha.de">Versuch es nochmal!</a>';
}
else
{
$result = mysqli_query($sqlServ, "SELECT id FROM account.account WHERE login LIKE '$username'");
$menge = mysqli_num_rows($result);
if($menge == 0)
{
$passwort = md5($passwort);
$ip= $_SERVER['REMOTE_ADDR'];
$eintrag = "INSERT INTO account.account (login, password, email, social_id, last_play, web_aktiviert) VALUES ('".$username."', '".$passwort."', '".$email."', '".$delete."', '".date("Y-m-d H:i:s",time());."', '1')";
$eintragen = mysqli_query($sqlServ, $eintrag);
if($eintragen == true)
{
echo "<p>Der Benutzer wurde erstellt.<br>Viel Spaß in der BETA!";
}
else
{
echo $username;
echo $passwort;
echo $email;
echo $delete;
echo '<p>Registration fehlgeschlagen.</p><br><a href="http://www.myscha.de">Versuch es nochmal!</a>';
}
}
else
{
echo '<p>Registration fehlgeschlagen.</p><br><p>Benutzername schon vorhanden. </p><br><a href="http://www.myscha.de">Versuch es nochmal!</a>';
}
}
}
?>
</div>
</div>
<div class="main_bot">
<a href="http://www.Forum.de">Ab ins Forum</a>
</div>
<div class="footer">
<p>Copyright by <a href="lnk"><?PHP echo $serverSettings['titel'];?></a>. All rights reserved.<br>
Design by <a href="lnk">NyBu</a>.<br>
Code by <a href="lnk">M.YSCHA</a>
</div>
</div>
</body>
</html>
Ich werde sicherlich keinen direkten Angriff ausführen der dir schadet, allerdings als kleines Beispiel.