pseudo-random URL generation - php

I'm writing python code to parse data from http://www.istockphoto.com/ and it seems like the URL that is generated from a search seems to be pseudo-random; For example if you do a 'photos' search for 'meow' you get the URL: http://www.istockphoto.com/search/text/meow/filetype/photos/source/basic#e2430b3
I've looked at the source code carefully, but since I don't know much about PHP/javascript (I assume that's how the URL is being generated), I can't figure out exactly which lines of code are generating this URL. Could someone please point me in the right direction and show me which lines of code are responsible for the URL?

It's not a (pseudo-)random url, as the first part is clearly unique for your search: http://www.istockphoto.com/search/text/meow/filetype/photos/source/basic
The last part, #e2430b3 is just an anchor to somewhere on the page, or used by some scripts.
It is not used by the query, as you can type the url without this part and it works the same.
This part perhaps can be used by the server as a cache identifier, to speed up repetitive requests.

Related

$_SERVER["HTTP_REFERER"] not returning full URL

I'm trying to apply a quick patch to address an issue with an extension we're using. As a result, please pardon this "bandaid-like" fix that I'm requesting assistance with. This is merely an effort to fix an issue in about 20 minutes or less and schedule in a permanent fix for later in the week.
That being said, I am struggling with grabbing a value that I would expect with using $_SERVER["HTTP_REFERER"]. Our URL is somewhat odd at the moment. A URL example is below...:
http://domain.com/custom-wheels-performance-tires/custom-wheels.html#/custom-wheels-performance-tires/custom-wheels.html?wheel_diameter=2663
When using $_SERVER["HTTP_REFERER"], the value I'm getting (for the URL above) is:
http://domain.com/custom-wheels-performance-tires/custom-wheels.html
Evidently, it is being cut off at the # in the URL. Common sense would be to remove that from the URL, but I'm going to have to dig into someone else's code to do that and it exceeds the time allocated for this patch. Is there a way to get the full URL (even if it isn't $_SERVER["HTTP_REFERER"])?
I appreciate any and all assistance!
Due to the way URL's are handled by browsers, the server never receives anything past the hash fragment identifier (#). The fragment is intended to be used by the browser to scroll a page to an anchor.
However, It is possible to utilize JavaScript to get the fragment, and send it to the browser.

Determining the source code of a website system

Ok, in work I use a particular system to look up part numbers for products. It's accessed in the browser and can only be accessed by company machines and I have a log on to use the system. Once logged in, I type in the part number and it prints a list into a rich text field with the part number, serial number, description and some other bits of info. It doesnt have the ability to search for multiple part numbers, so I literally have to type in the first, wait for the result, then the second, etc. What I'm looking to do is write some code that will loop through a text file and print out part of the result into the text file next to each part number. This kind of code I'm used to.
My problem however is that I dont know what the source code / function is for this company owned system. If I view the source I cant see a js file or anything similar with what I would think the script would live in, so assume its server side. If I watch the requests, I can see the parameters being passed, but I dont know how I could recreate this in code and obtain a result. Would be nice if it spat out some json, but I dont think its that easy :-)
Any pointers to get me going and areas I should look at?
Thoughts appreciated.
You can view the response headers in the browser's network tab, if it's php, by default it adds a header that you'll recognize.
But, how will you deploy your server side code if you don't have access to the server? And if you do, then why do you need to guess the language like this?

Using a QR code securely

All,
I'm going to use a QR code from the following URL:
http://qrcode.kaywa.com/
I want to use the URL option so when someone scans it they are sent to the URL that I specified on the code. I want to have something like the following URL:
http://www.website.com/web-page/?type=uplights&action=checkout
Based on the variables in the URL I want to allow my user to insert some data.
Is there a way to secure this do that I know a user got to this URL from scanning the QR code instead of just typing that information into the URL?
Thanks!
Short Answer: Not directly.
QR codes were not designed to keep content stored within it secret. Someone could use a QR reader to scan your URL, store it and keep using it over and over again, without actually scanning it again.
One way we used to circumvent this issue was to encrypt our URL such that our own application (Based on ZXing) would be the only one capable of reading our QR code. It then sends the actual request with a nonce over a secure channel such that a replay attack would also be rendered useless (in case someone was sniffing outbound connections). All other readers see the encrypted URL which isn't of any use.
Other than that, there isn't another way of ensuring the user actually does scan your QR and doesn't type it out/paste it in.
The way we implemented this:
We stored the URL as http://www.website.com/app.php?<encrypted_string>. If someone read our URL a different QR decoder, they would be taken to our app.php page, which urged them to read the QR using our application.
Our app itself, on encountering that URL stripped off the encrypted query-string, decrypted it, and formed its own request to the right page. In PHP, you could execute that request at the server-end itself, so it is never visible to the user. You could use mcrypt as detailed here for encryption.
You can add a secret-ish parameter to the URL and not publish the URL with that parameter. But basically, no, you still won't know if someone didn't just type in that URL. (For example, I may have used the QR code, then cut and paste the URL in an email to a friend, and that friend may have typed it in.) But you'll know that they probably didn't just type it in.
QR codes are just easily reversible encodings for text. There's no magic there. So there are things you can do to make it less likely that someone typed in the URL, but you can never be certain.

PHP CMS web page short URL?

I am buildiig a simple CMS and would like to know how to create short URLs (not the APACHE bit but the PHP bit).
example.com/?page=100
example.com/home/test
How would I interpret the ?page=100 into /home/test (Through select the database, but i couldn't figure out how) I can see if just one level /home/test because you probably can have a zoneID, but when it comes to /home/test/test. I become lost
And how do I parse back the /home/test to the page id.
Plus is there anyone can show a bit idea for the database design as well?
These resources can be useful to you:
https://stackoverflow.com/a/120411/370290
http://www.symfony-project.org/book/1_0/09-Links-and-the-Routing-System
http://codeigniter.com/user_guide/general/urls.html
http://www.phpaddiction.com/tags/axial/url-routing-with-php-part-one/
You need some kind of mod_rewrite for your server side.
That will help you to send route data to index.php (or somewhere else) file without filename in adress string. Than some php file will analyze the route and give correct html.
ok i think you need to definitely need to look at the way you are going to do your routing (through mod_rewrite)..for example
1.you can rewrite the page www.example.com/test to ..www.example.com/index.php?page=test and implement a way of getting page by the page name..and returning an id if a page name exists ..if multiple entries exist then maybe the last modified will be given precedence over the otheers ..you can get the following book CMS Design Using PHP and jQuery helped me alot

Passing variable to Google Charts URL

This is probably something really simple, however I am quite new to PHP, and havent done any HTML in years.
I need to get a PHP variable filled with an array of figures into Google Charts. My code for this so far is:
<img src="http://chart.apis.google.com/chart?
&chs=340x175
&chd=t:<?=$filedetail[1]?>
&cht=lc
&chtt=Test
">
However, Google reports an error, as it stops at the ?=$filedetail[1] for some reason. It doesnt seem that reading the variable is the problem, more that the API simply cant read past the start of the PHP tags.
Thanks,
Rob A.
EDIT: I have managed to make Google accept the URL, however now it is not showing anything on the chart, as its filling in the &chd=t: field with instead of the figures within that variable.
The URL reads like this:
http://chart.apis.google.com/chart?&chs=340x175&chd=t:%3C?=$filedetail[1]?%3E&cht=lc&chtt=Test
If oyu say Google is complaining about the ?=$filedetail, chances are you are doing this in a file that is not being parsed by PHP, for example a file that ends with .html or .htm.
You can see whether this is the case by looking into the page's source code in the browser. If you see the PHP command in the source as you wrote it above, the PHP code was never executed.
The easiest way to fix that, if that's the problem, would be to switch to a .php file extension.
In URLs, literal & should be written as &
Edit: And you can't do ?&chs -- it should be ?chs. The line breaks are probably going to break the URL too...

Categories