Thread: Secure a Lava Script (Wapdesire)

In this Tutorial i will explain the basics of how to secure a lava script:
1. Lets Remove the Sessions
The easiest way of removing the session in lava is to use

PHP Code:

session_start(); 


lets put that at the beginning of every page right after the <?php
ok that still dont removes the sessions right? Thats what we do next
Wapdesire right from the start checks if a session is already existing in a database we need to delete that and start a new session :

PHP Code:

  if (isset($_SESSION['sid']))
  {
  mysql_query("DELETE FROM ibwf_ses WHERE id='$_SESSION[sid]'");
  unset($_SESSION['sid']);
  
  }
  else
  {
  $_SESSION['sid'] = $sid;
  } 


ok now we go to every page again you will note the

PHP Code:

$sid = $_GET['sid']; 


there we are going to change it to

PHP Code:

$sid = $_SESSION['sid']; 


after we have done that you can securly remove the &amp;sid=$sid from the links
We have just removed the sessions from the url congrats
2. Secure posted data like you might have noted there are a lot of $_GET or $_POST statements lets secure them here is a simple function that will do the job simply put it in core.php

PHP Code:

function getget($name, $def = '') {
  if (isset($_REQUEST[$name]))
    return $_REQUEST[$name];
  else 
    return $def;
} 


and instead of $_GET or post we use

PHP Code:

$pass = getget('pass', $pass);
$user = getget('user', $user); 


for example

3. Lets secure the gallery

use phpthumb for gallery simply look in google for phpthumb then in user profiles or in gallery use it the way how to use it is discribed in the phpthumb file

hope this helps you guys

i agree with DjMatrix its more secure than to do nothing