Misc Links
Forum Archive
News Archive
File DB
 

Ads
 

Advertisement
Age of Valor - Ultima Online Free Shard
AoS/SE/ML/Custom - advanced code, dedicated staff, peerless bosses, non overpowered customs + much much more
 

Latest Forum Topics
dance crew
Posted by rovingcowboy
on Sep 05 2008, 8:28:45 am

Huge boobs
Posted by Red Squirrel
on Sep 04 2008, 5:15:53 pm

Google Chrome
Posted by Triple6_wild
on Sep 07 2008, 2:43:48 am

Epic failure at the Olympics
Posted by Red Squirrel
on Aug 14 2008, 6:35:29 pm

happy birthday ryan
Posted by MikeDB
on Aug 04 2008, 5:44:44 am

 



Creating your own content management system with php
Better control of site content and access
By Red Squirrel


First, before I start, just to let you know that the example we will be working with can be downloaded here (self extractor), and you can view an actual working version of it here.

There are various CMS systems available out there, such as phpnuke, IPB portal, VB portal and so on. Sure they are great, but they have a few problems.

1) Not original
It's not really original to just slap a script on, make a few changes and boom, you have your very own site...that someone else coded. It's always more fun to put some work into your site and get a unique result out of fully custom code.

2) They have security flaws
Allot of these portals are known to have security flaws. PHP Nuke for example has quite a few, and so does vB Portal, and while I never heard of any for IPB portal, I'm sure it has some too.

3) Most likely to have known security flaws
Having security flaws is one thing, and not as dangerous as having known security flaws. Basically, anything can have a security flaw. Heck maybe this article system has one that enables people to give it GET queries to execute code on the server (I highly doubt, don't bother trying) but it's not as dangerous as a known flaw in say, PHP Nuke. Because these systems are used by many people, and available to download by anyone, security flaws are more known, and can easily be found and targeted.

By making your own CMS system, you will minimize the chances of having security flaws (it will most likely be less complex, as it will be made simply for your very own needs), you will minimize the chances of script kiddies finding flaws, and you will make your site much more original. Script kiddies won't really be able to know how the back end of the site operates, because it's completely your own code, so if there are security flaws they will be nearly impossible to find without putting a bunch of noticeable stuff in your logs that will enable you to catch attempts at trying various things, before they have a chance to find a way in (most likely).

Another good security-related reason to make your own CMS is that you be much more familiar with it's code structure, because you made it.

In this article we'll go through the process of creating a very simple content management system. It will feature the following:

- Certain pages only viewable by registered members
- User can log in and out
- Ease of template editing - header, footer will separate from actual pages

While this will be a very simple CMS, it will give you an idea how you can make one, and add on more features from there, such as different permissions per user, email registration validation etc...

On the next page we'll take a look at the process of loading a CMS page from this basic system.


Next Page
spacer
8888 Hits Pages: [1] [2] [3] [4] 4 Comments
spacer


Latest comments (newest first)
Posted by Andy on October 10th 2004 (07:52)
LOL I was about to say. WOW this guest is smart. Why can't i find someone like that at my site. laugh.gif
spacer
Posted by Guest on October 10th 2004 (07:31)
mysql injection is mostly for when the user enters something that is put in a query, for example:

mysql_query("SELECT * FROM db where name='".$_POST[name]."'");

But normally there would be more security checks and escaping to avoid stuff like slashes etc..


Oops this was Red, was at college and forgot to log in.

spacer
Posted by anonymous on October 10th 2004 (22:20)
You've got a potential sql injection hole on line 6 of the script on page 4. You should escape $_POST[user] with addslashes()
spacer
Posted by q2_stefan on October 10th 2004 (14:14)
QUOTE
6: Finally, we end with the header, closing off the html output.
should be '6: Finally, we end with the footer, closing off the html output.'
spacer
View all comments
Post comment

Age of Valor Ultima Online Server

Top Articles Latest Articles
- What are .bin files for? (387617 reads)
- Big Brother and Ndisuio.sys (125255 reads)
- PSP User's Guide (102999 reads)
- SPFDisk (Special Fdisk) Partition Manager (71460 reads)
- Tutorial on how to burn an ISO image (62837 reads)
- Successfully Hacking your iPhone or iTouch (2698 reads)
- Ultima Online Newbie Guide (10482 reads)
- BBcode editor: PHP - The sensible approach (11300 reads)
- The Hitch Hikers guide to "the mouse" (10500 reads)
- Setting up a Backup Server (23554 reads)
corner image

This site best viewed in a W3C standard browser at 800*600 or higher
Site design by Red Squirrel | Contact
© Copyright 2008 Ryan Auclair/IceTeks, All rights reserved