Originally posted by me on HF
I was bored today so I decided to do this little project in PHP.
This script is insecure from start, and even more now when it's shared.
So, what is it?
It's text field where you put a code in the format 0000-0000-0000.
The code isn't checked through a database, it's checked with an algorithm.
Again, this is just an insecure experiment script, please don't use it for serious stuff.
What do you think?
I was bored today so I decided to do this little project in PHP.
This script is insecure from start, and even more now when it's shared.
So, what is it?
It's text field where you put a code in the format 0000-0000-0000.
The code isn't checked through a database, it's checked with an algorithm.
5514-1391-0190
5514-1131-0120
5514-9399-9383
5514-7397-1121
5514-4004-6223
5514-1261-2122
5514-1131-0120
5514-9399-9383
5514-7397-1121
5514-4004-6223
5514-1261-2122
ABCD-EFGH-IJKL
ABCD is always 5514.
E is rand(0, 9).
F is rand(0, 3).
G is F*3.
H is E.
I is F*H.
J is rand(0, 3).
K is either 2, 4, 8 or 9.
L is rand(0, 3);
ABCD is always 5514.
E is rand(0, 9).
F is rand(0, 3).
G is F*3.
H is E.
I is F*H.
J is rand(0, 3).
K is either 2, 4, 8 or 9.
L is rand(0, 3);
redeem.php (Enter code here)
generate.php
PHP:
<?php
if (isset($_POST['code'])) {
$code = explode("-", $_POST['code']);
$valid = true;
if ($code[0] !== "5514") $valid = false; // XXXX-0000-0000
if ($code[1][0] !== $code[1][3]) $valid = false; // 0000-X00X-0000
if ((int)$code[1][2] !== ($code[1][1]*3)) $valid = false; // 0000-0XX0-0000
if ((int)$code[2][0] !== ($code[2][1]*$code[2][3])) $valid = false; // 0000-0000-XX0X
if (!in_array((int)$code[2][2], array(2, 4, 8, 9))) $valid = false; // 0000-0000-00X0
if (strlen($_POST['code']) !== 14) $valid = false; // XXXX-XXXX-XXXX
if ($valid) {
echo "<span style=\"color:green\">Valid code.</span>";
} else {
echo "<span style=\"color:red\">Invalid code.</span>";
}
}
?>
<br />
<form action="redeem.php" method="post">
<input type="text" name="code" value="<?php echo $_POST['code']; ?>"><input type="submit" value="Validate">
</form>generate.php
PHP:
<?php
function genCode() {
// 1st section
$code = "5514-";
// 2nd section
$i = rand(0, 9);
$ii = rand(0, 3);
$iii = $ii*3;
$code .= $i.$ii.$iii.$i."-";
// 3rd section
$ii = rand(0, 3);
$iiii = rand(0, 3);
$i = $ii*$iiii;
$iii = substr(str_shuffle("2489"), 0, 1);
$code .= $i.$ii.$iii.$iiii;
return $code;
}
echo genCode();
?>Again, this is just an insecure experiment script, please don't use it for serious stuff.
What do you think?