• 08-12-2010, 16:06:05
    #1
    slmlar arkdaslar bugun bi forum sitesinde gordum sansa dustum uzerine sitemde acik varmis nasi kapaticagimi bilmiyorum yardim edermisiniz

    oyun.php
    <?
    require_once("extra.php");
    require_once("ayarlar.php");
    
    $yer="oyun";
    
    
    
    $id=$_GET["oyun"];
    
    $Data    =   $DB->get_row("SELECT adi,seo,kategori,aciklama,thumb FROM oyunlar WHERE seo='".$id."' ");
    
    $baslik=$Data->adi." Oyunu";
    $key2=$Data->adi.", ".$Data->kategori.", ";
    ?>
    
    <?
    require_once("header.php");
    ?>
    
    
    <?
    require_once("sidebar.php");
    ?>
    
    
    <!--- Sag Menü --->
    
    
    
    <div id="sag">
     
      
    <table id="oyunm" style="width: 100%">
    	<tr>
    		<td valign="top" style="width: 140px">
                     <a href="oyna_<? echo $Data->seo;?>.html" title="<? echo $Data->adi;?>" alt=""><img  src="<? echo $Data->thumb;?>" width="140" title="<? echo $Data->adi;?>" alt=""></a>
                    </td>
    		<td valign="top" style="padding-left:10px">
    		<table style="width: 100%; height: 100%">
    			<tr >
    				<td>  <a href="oyna_<? echo $Data->seo;?>.html" title="<? echo $Data->adi;?>" alt=""><? echo $Data->adi;?></a></td>
    			</tr>
    			<tr>
    				<td><? echo $Data->aciklama;?></td>
    			</tr>
    		</table>
    		</td>
    	</tr>
    </table>
    <div id="oyunm2">
    <a href="oyna_<? echo $Data->seo;?>.html" title="<? echo $Data->adi;?>" alt="" ><img src="imgs/oyna.png"></a>
    </div>
    
    
    <? echo $reklam2;?>
    </div>
    
    
    
    
    
    
    <div id="sag2">
     <?	
    $Datas   =   $DB->get_results("SELECT * FROM oyunlar where kategori='".$Data->kategori."' order by s_tarih desc limit 0,15");	
    foreach($Datas as $Datat)
    {
    ?>
    
    <div class="oyunkutu">
    <a href="oyun_<? echo $Datat->seo;?>.html" title="<? echo $Datat->adi;?>" alt=""><img  src="<? echo $Datat->thumb;?>" width="120" height="90"/ title="<? echo $Datat->adi;?>" alt=""></a>
    <div class="kbas">
      <a href="oyun_<? echo $Datat->seo;?>.html" title="<? echo $Datat->adi;?>" alt=""><? echo $Datat->adi;?></a>
    </div>
    </div>
    
    		<?
    		}
    		?>
    </div>
    
    
    
    <!--- ////////Sağ Menü\\\\\\\\\--->
    
    
    <?
    require_once("footer.php");
    ?>

    oyna.php

    <?
    require_once("extra.php");
    require_once("ayarlar.php");
    
    $id=$_GET["oyun"];
    $yer="oyna";
    $Data    =   $DB->get_row("SELECT adi,id,kategori,kategori_seo,swf,hit,e_tarih,aciklama,g,y FROM oyunlar WHERE seo='".$id."' ");
    $DB->updateRecords("oyunlar",array(
    				'hit'	        =>	($Data->hit+1),
    				's_tarih'	=>	Time(),
    			),"seo='".$id."'");
    $baslik=$Data->adi." Oyna";
    $key2=$Data->adi.", ".$Data->kategori.", ";
    
    
    ?>
    
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
    <html xmlns="http://www.w3.org/1999/xhtml">
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <title> <? echo $baslik." | ".$title;?></title>
    
    <meta name="keywords" content="<? echo $key2." ".$keys;?>" />
    <meta name="description" content="<? echo $desci;?>"/>
    
    <meta name="robots" content="index,follow" />
    <meta name="revisit-after" content="1 day" />
    <meta name="rating" content="general" />
    <meta name="audience" content="all" />
    <meta http-equiv="cache-control" content="no-cache" />
    <meta http-equiv="pragma" content="no-cache" />
    <meta http-equiv="expires" content="0" />
    <link href="css/reset.css" rel="stylesheet" type="text/css" />
    <link href="css/style.css" rel="stylesheet" type="text/css" />
    <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"/>
    
    <script type="text/javascript">
    function Bookmarkekle (strURL, strTitle)
    {
        if (window.sidebar) 
        { 
            // Mozilla Firefox Bookmark
            window.sidebar.addPanel(strTitle, strURL,"");
        }
        else if( window.external )
        {
            // IE Favorite
            window.external.AddFavorite(strURL, strTitle);
        }
        else if(window.opera && window.print)
        { 
            // Opera Hotlist
            var elem = document.createElement('a');
            elem.setAttribute('href',url);
            elem.setAttribute('title',title);
            elem.setAttribute('rel','sidebar');
            elem.click();
        }
    }
    </script>
    <script type="text/javascript" language="javascript" src="rungame.js"></script>
    
    </head>
    
    <body>
    
    
    
    <div id="header2">
     
     
     <div style="float:left;width:250px;">
       <blockquote>
         <p><a href="index.php"><img src="imgs/logo2.jpg"></a>
           <a href="/anasayfa" class="formi"><strong>Anasayfa</strong></a></p>
       </blockquote>
     </div>
     
    <div class="kutu3">
      <form id="form1" name="form1" method="get" action="ara.php">
        <input name="kelime" type="text" id="keyword2"  onfocus="this.value = ''" value = "Oyun ara..."  />
        <input type="submit"  id="ara2" value="" />
      </form>
    </div>
    <div style="clear:left"></div>
    </div>
    
      
      
    <div id="main" style="width:1130px">
    
    
    
    
    
    <div id="cont">
      <div id="ustreklam"><? echo $reklam4; ?></div>
    <?
    require_once("online.php");
    ?>
    
    
    
    
    <!-- Sol Menü -->
    <style type="text/css">
    .ista {
    	color: #080808;
    	font-size:12px;
    }
    .player{
    	display:block;
    	text-align:center;
    	background:#000;
    	color:#FFF;
    	margin:2px;
    	width:590px;
    	height:500px;
    }
    .oyun_ekrani{
    	text-align:center;
    	border:3px solid #D5FACE;
    	background:#000;
    	color:#FFF;
    }
    </style>
    
    
    <div id="sol" style="width:130px">
      
     
    	<form method="post">
    &nbsp;<!--webbot bot="Validation" s-display-name="--Kategoriler--" b-value-required="TRUE" b-disallow-first-item="TRUE" --><select onChange="location=this.options[this.selectedIndex].value;" style="font-size:10px">
    
    	<option >-- Kategoriler --</option>
    	<?
    $Datas   =   $DB->get_results("SELECT kategori,seo FROM kategoriler order by kategori ASC");	
    foreach($Datas as $Datat)
    {
    ?>
    <option value="<? echo $Datat->seo;?>.html"><? echo $Datat->kategori;?></option>
    
    		<?
    		}
    		
    		?>
    	</select>
    </form>
    <br/>
          <?
    $Datas   =   $DB->get_results("SELECT id,seo,thumb,adi,g,y FROM oyunlar ".$sqq." order by s_tarih desc limit 1,5");	
    foreach($Datas as $Datat)
    {
      
    ?>	
    <div id="oyunkutu">
    <a href="oyun_<? echo $Datat->seo;?>.html" title="<? echo $Datat->adi;?>" alt=""><img  src="<? echo $Datat->thumb;?>" width="120" height="90"/ title="<? echo $Datat->adi;?>" alt=""></a>
    <div class="kbas">
      <a href="oyun_<? echo $Datat->seo;?>.html" title="<? echo $Datat->adi;?>" alt=""><? echo $Datat->adi;?></a>
    </div>
    </div>
    
    		<?
    		}
    		
    ?>
      
    
    	
    		
    </div>
    
    
    <!--- Sag Menü --->
    
    
    
    
    
    
    
    
    
    
    
    
    <div id="sag3">
     
      
    <div id="oynam">
    
    <h2><? echo $Data->adi;?></h2>
    
    <p align="center">
     <?
    
    $turi=substr($Data->swf,-3);
    if(!$Data->g) $Data->g=800; 
    if ($turi=="dcr")
    {?>
      <object classid="clsid:166B1BCA-3F9C-11CF-8075-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab#version=8,5,0,0" width="800"<? echo $Data->g;?>" height="600"<? echo $Data->y;?>">
        <param name=swRemote value="swSaveEnabled='true' swVolume='true' swRestart='true' swPausePlay='true' swFastForward='true'   swContextMenu='true' "><param name='swStretchStyle' value='fill'><param name='bgColor' value='#000000'><param name='src' value='<? echo $Data->swf;?>'>
        <embed src='<? echo $Data->swf;?>' bgcolor='#000000' width='<? echo $Data->g;?>' height='<?echo $Data->y;?>' swRemote="swSaveEnabled='true' swVolume='true' swRestart='true' swPausePlay='true' swFastForward='true' swContextMenu='true'" swStretchStyle='fill' type='application/x-director' pluginspage='http://www.macromedia.com/shockwave/download/'></embed>
      </object>
      <?
    }elseif($turi=="swf"){
    ?>
      <object id="flashObject2" width="800" height="600" classid="CLSID:D27CDB6E-AE6D-11cf-96B8-444553540000' codebase='http://active.macromedia.com/flash2/cabs/swflash.cab#version=6,0,0,0">
        <param name="movie" value="<? echo $Data->swf;?>">
        <param name="allowScriptAccess" value="always">
        <param name="wmode" value="transparent">
        <param name="quality" value="high">
        <param name="scale" value="exactfit">
        <param name="menu" value="true">
        <embed id="flashObject1" allowScriptAccess="always" width="<? echo $Data->g; ?>"  height="<? echo $Data->y;?>" name="flGame" src="<? echo $Data->swf;?>" quality="high" scale="exactfit" menu="true" swLiveConnect="false" pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash"></embed>
      </object>
      <?
    }
    else {
    echo '
    <table width="100%" border="0" cellpadding="0" cellspacing="0" id="oyun_ekrani">
    <tr>
    <td width="80%" valign="top" bgcolor="#D5FACE">
    <div id="player" class="oyun_ekrani">
    <iframe src="botoyun.php?id='.$Data->id.'" width="'.$Data->g.'" height="'.$Data->y.'" scrolling="no" border="0" frameborder="0" name="oyun_ekrani" style="background:#000000">
    </iframe>
    </div>
    </td>
    </tr>
    </table>
    ';
    }
    
    ?><center><script type="text/javascript"><!--
    google_ad_client = "pub-8252759729508673";
    /* 468x15, oluşturulma 02.09.2009 */
    google_ad_slot = "7954194414";
    google_ad_width = 468;
    google_ad_height = 15;
    //-->
    </script>
    <script type="text/javascript"
    src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
    </script></center>
      <center><a href="http://get.adobe.com/shockwave/" target="_blank"><img src="shockwave.gif" width="309" height="32" /></a></center><br />
    <div id="eks" style="width:790px">
      <table style="width: 100%">
    	<tr>
    		<td style="width: 30%">
    		<a href="<? if($turi=="dcr" || $turi=="swf") echo $Data->swf;?>" target="_blank"><img src="imgs/tamekran.png" /> Tam Ekran</a></td>
    		<td style="width: 30%">
                     
    <a href="http://www.addthis.com/bookmark.php?v=250&pub=xa-4a5622575ea8679d" onmouseover="return addthis_open(this, '', '[URL]', '[TITLE]')" onmouseout="addthis_close()" onclick="return addthis_sendto()">
     <img src="imgs/paylas.png"/> Oyunu Paylaş
    </a>
    <script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js?pub=xa-4a5622575ea8679d"></script>
    
    
                      
                      
                  </td>
    
    
    		<td style="width: 40%"></td>
    	</tr>
    </table>
    
      </div>
            
            
    <p><strong style="color:red">Oyun Açıklaması: </strong> <? echo $Data->aciklama;?><br/><br/>
      Bu oyun <? echo $Data->hit;?> kez oynandı.<br/><br/>
      <? echo $Data->e_tarih;?> tarinde eklendi.<br/><br/>
    </p>
    </div>
    
    <div id="oynam">
     <h2> Yorumlar </h2>
    <div id="yorumlar">
    
    
    
     <?
    $QQ   =   $DB->num_rows("SELECT id FROM yorumlar where oyun='".$Data->id."' and durum='1'");
     
     if ($QQ<1) {
      echo "Yorum yapılmamış. İlk yorumu sen yaz.";
      
     }else{
    $Datas   =   $DB->get_results("SELECT isim,yorum FROM yorumlar where oyun='".$Data->id."' and durum='1' order by id ASC");	
    foreach($Datas as $Datat)
    {
    ?>
    
    <span><? echo $Datat->isim;?></span><br/>
    <? echo $Datat->yorum;?>
    <hr>
    		<?
    		}
    }
    		?>
    
    
    
    
    
    </div> 
    
    </div> 
    
    <div id="oynam">
     <h2> Yorum Yaz </h2>
    <?
    if ($yorumdurum=="2"){
      echo "Sistem yoruma kapatılmış.";
    }else{
      
    ?>
    <form method="post" action="oyunyorum.php?id=<? echo $Data->id;?>">
    	<table style="width: 100%">
    		<tr>
    			<td>
    			<table style="width: 100%">
    				<tr>
    					<td style="width: 50%">Ad Soyad&nbsp;
    					<input name="adi" type="text" class="formi" />&nbsp;</td>
    					<td style="width: 50%">E-Mail&nbsp;
    					<input name="mail" type="text" class="formi"/>&nbsp;</td>
    				</tr>
    			</table>
    			</td>
    		</tr>
    		<tr>
    			<td><textarea name="yorum" rows="4" style="width: 100%" class="formi"></textarea>
    			</td>
    		</tr>
                    		<tr>
    			<td  style=" text-align: right">
    			<input name="Submit1" type="submit" value="Yorum Gönder" class="formi2" /></td>
    		</tr>
    	</table>
    </form>
    <?
    }
    ?>
    
    </div>
    
    </div>
    
    
    
    
    
    
    <div id="sag5">
    <? echo $reklam3?>
    </div>
    
    
    
    <!--- ////////Sağ Menü\\\\\\\\\--->
    
    </div></div>
    
    
    <div id="header2">
      <div style="text-align:center;padding-top:10px;">
      Oyun Oyna En Hizli Oyunlar Hizlioyunlar.com Bedava 3D Oyunlar. Severek ve Eğlenerek Vakit Geçirebiliceginiz Hizlioyunlar.com artik sizlerle. Bu Oyun sitesinde Flash Oyunlar , unity oyunlar , shockwave oyunlar oynayabilirsiniz - <span style="font-size:11px"><a href="http://www.hizlioyunlar.com/iletisim.php" >İletişim</a> </span>
      </div>
    
       
    
    </div>  
    
    
    </body>
    </html>

    ikinsindede acik var :S

    http://95.154.241.21/oyna_magazada-h...yakala%27.html
    http://95.154.241.21/oyun_magazada-h...yakala%27.html
  • 08-12-2010, 16:08:58
    #2
    php'de parametre filan vermek varmı bilmiyorum ama, $id=$_GET["oyun"]; ile getirdiğin $id'de regex ile a-z 0-9 ve - harici tüm karakterlerin silinmesini sağlarsan injectionu engellersin.
  • 08-12-2010, 16:17:21
    #3
    nasi yapa bilirim bilen yokmu arama yaptimm bulamadim
  • 10-12-2010, 10:57:03
    #4
    $id 'ye replace yaptır. google'da "php replace" diye arattırırsan bulabilirsin.