Project Detail

Description

Help!

Bluehost.com recently shut down our website. I created this website for a friend who has a small bookkeeping firm. The site is very simple with 5-6 pages of PHP along with a user interface to log in and share files with the site admin. There are a few user contact forms also.

The site is currently blocked by bluehost.com so you will need to be able to make the changes on your server and re-upload them to the bluehost account.

Afterwards the owner will confer with bluehost and I will find out if everything is ok with them. If everything is fixed they will give the ok and I will release payment.

Here is the message they sent. You will be given full access to log into the bluehost account, which is prefered to using FTP software, since you may have to change some things on the settings and database side.

********* Please do not bid unless you can start immediately around midnight US time or early morning European/MiddleEast Time *************

Here is what bluehost sent in an email:

The programs that operate database-driven sites are vulnerable to hackers, who can (and do) exploit bugs in those programs to gain unauthorized access to your site.

1. Set register_globals to OFF

2. Turn off Display Error/Warning Messages. set error_display to ZERO 3. Never run unescaped queries 4. Validate all user inputs. Items on Forms, in URLS and so on 5. Move Config and files containing Passwords to mysql to a Secure directory outside of the public_html folder 6. Access Control, U don't want ya user to have access to Admin function or Clean up scripts 7. htaccess is your friend use it to deny people (we also have a easy deny manager too in the cpanel) 8. PHP can parse any valid script, whether it is called foo.php, very_long_name.php.php.php, or even willeymtard.bat. Using the default extension of ".php" means that before your hackers start you have already told them you are using PHP. As mentioned, you can use any filename for your scripts - if you are using PHP for every script on your server, consider using the ".html" extension for your scripts and making PHP parse HTML files you can change your file extension by adding this line to the htaccess or turn it on via the add type handler in the cpanel (AddType application/x-httpd-php .php) 9. To protect against SQL injection attacks Sometimes hackers will try to screw up you database by inserting SQL code into your form input fields. They can for example, insert code that could delete all the data in your database!

To protect against this, you need to use this PHP function:

mysql_real_escape_string()

This function escapes (makes safe) any special characters in a string (programmers call text a 'string') for MySQL.

Example:

$name = $_REQUEST['name'];

$safe_name = mysql_real_escape_string($name); Now you know the variable $safe_name, is safe to use with your SQL code.

10. Keep the PHP code to yourself. If anyone can see it they can expliot vulnerabilities. You should take care to store your PHP files and the necessary passwords to access your MySQL databases in protected files or folders. The easy way to do this is to put the database access passwords in a file with a .inc.php extension (such as config.inc.php), and then place this file in a directory which is above the serverʼs document root (and thus not accessible to surfers of your site), and refer to the file in your PHP code with a require_once command. By doing things this way, your PHP code can read the included file easily but hackers will find it almost impossible to hack your site.

You can find more information about hardening your PHP scripts at: http://phpsec.org/projects/guide/

Thank you,

BlueHost.Com

Please bid with explination that you can fix every one of the listed problems and the time frame to get it done. If you cannot fix quickly and cheap do not bid. I believe these are easy changes, but I don't have time to research and do them myself.

Bids that are too high, or timeframes that are too long will be ignored.