I keep on getting an error when I got to a particular page. The bit of code I'm having problems with is:

PHP Code:

function init()
    {
        global $g;
        global $l;
        global $gc;

        $name = get_param("join_handle", "");
        $pass = get_param("join_password", "");
        $pass2 = get_param("verify_password", "");
        $mail = get_param("email", "");
        $mail2 = get_param("verify_email", "");
        $captcha = get_param("code", "");

        $this->message = "";

        if (strtoupper($captcha) != $_SESSION['code'])
        {
            $this->message .= $l['join.php']['incorrect_security_code'] . "<br>";
        }

        if (strlen($name) < 4 or strlen($name) > 20 or strpos($name, "'") !== false)
        {
            $this->message .= $l['join.php']['another_username'] . "<br>";
        }

        if ($mail != $mail2 or strlen($mail) > 100 or !preg_match("/^[a-zA-Z-_\.0-9]{1,100}@[a-zA-Z-_\.0-9]{1,100}\.[a-zA-Z-_\.0-9]{1,100}$/", $mail))
        {
            $this->message .= $l['join.php']['incorrect_email'] . "<br>";
        }

        if ($pass != $pass2 or strlen($pass) > 15 or strlen($pass) < 6 or strpos($pass, "'") !== false)
        {
            $this->message .= $l['join.php']['incorrect_password'] . "<br>";
        }

        if (DB::result("SELECT user_id FROM user WHERE name=" . to_sql($name, "Text") . ";") != "")
        {
            $this->message .= $l['join.php']['exists_username'] . "<br>";
        }

        if (DB::result("SELECT user_id FROM user WHERE mail=" . to_sql($mail, "Text") . ";") != "")
        {
            $this->message .= $l['join.php']['exists_email'] . "<br>";
        }

        $month = (int) get_param("month", 1);
        $day = (int) get_param("day", 1);
        $year = (int) get_param("year", 1980);

        if ($month < 1 or $month > 12 or $day < 1 or $day > 31 or $year < 1906 or $year > date("Y") - $g['options']['users_age'] + 1)
        {
            $this->message .= $l['join.php']['incorrect_date'] . "<br>";
        }

        if ($this->message == "")
        {
            set_session("j_name", $name);
            set_session("j_password", $pass);
            set_session("j_mail", $mail);
            set_session("j_month", $month);
            set_session("j_day", $day);
            set_session("j_year", $year);
            set_session("j_country", get_param("country", 1));
            set_session("j_orientation", get_param("orientation", 1));

            if ($g['options']['fast_join'] == "N" and isset($gc) and $gc) redirect("join_space.php");
            elseif ($g['options']['fast_join'] == "N") redirect("join2.php");
            else
            {
                $this->add_user();
                #echo get_session("user_id");
                redirect("profile.php");
            }
        }
    } 


The error I get is:

Message: Undefined index: code

If I remove:

PHP Code:

$captcha = get_param("code", ""); 


Then error I get is:

Message: Undefined variable: captcha

But if I remove:

PHP Code:

if (strtoupper($captcha) != $_SESSION['code'])
        {
            $this->message .= $l['join.php']['incorrect_security_code'] . "<br>";
        } 


Then the page loads.

I've checked through the page and the form is:

<img src="../../../Code/security-image.php?width=180" width="180" height="60" alt="Security Image" /></div>
         <label for="code">Enter the characters shown above: </label><input type="text" id="code" name="code" value="{code}" />

the security-image.php is:

PHP Code:

<?php
   // include security image class
   require('includes/security-image.inc.php');
  
   // start PHP session
   session_start();
  
   // get parameters
   isset($_GET['width']) ? $iWidth = (int)$_GET['width'] : $iWidth = 180;
   isset($_GET['height']) ? $iHeight = (int)$_GET['height'] : $iHeight = 60;
  
   // create new image
   $oSecurityImage = new SecurityImage($iWidth, $iHeight);
   $oSecurityImage->Create();

      // assign corresponding code to session variable
      // for checking against user entered value
      $_SESSION['code'] = $oSecurityImage->GetCode();
?>

and the security-image.inc.php is:

PHP Code:

<?php
   class SecurityImage {
      var $oImage;
      var $iWidth;
      var $iHeight;
      var $iNumChars;
      var $iNumLines;
      var $iSpacing;
      var $sCode;
      
      function SecurityImage($iWidth = 150, $iHeight = 30, $iNumChars = 5, $iNumLines = 30) {
         // get parameters
         $this->iWidth = $iWidth;
         $this->iHeight = $iHeight;
         $this->iNumChars = $iNumChars;
         $this->iNumLines = $iNumLines;
         
         // create new image
         $this->oImage = imagecreate($iWidth, $iHeight);
         
         // allocate white background colour
         imagecolorallocate($this->oImage, 255, 255, 255);
         
         // calculate spacing between characters based on width of image
         $this->iSpacing = (int)($this->iWidth / $this->iNumChars);
      }
      
      function DrawLines() {
         for ($i = 0; $i < $this->iNumLines; $i++) {
            $iRandColour = rand(190, 250);
            $iLineColour = imagecolorallocate($this->oImage, $iRandColour, $iRandColour, $iRandColour);
            imageline($this->oImage, rand(0, $this->iWidth), rand(0, $this->iHeight), rand(0, $this->iWidth), rand(0, $this->iHeight), $iLineColour);
         }
      }
      
      function GenerateCode() {
         // reset code
         $this->sCode = '';
         
         // loop through and generate the code letter by letter
         for ($i = 0; $i < $this->iNumChars; $i++) {
            // select random character and add to code string
            $this->sCode .= chr(rand(65, 90));
            
            /********************************************/
            /* alternatively replace the line above     */
            /* with the following code to enable        */
            /* support for arbitrary characters         */
            /********************************************/
            
            // characters to use
            // $aChars = array('A', 'B', 'C', '3', 'g');
            
            // get number of characters
            // $iTotal = count($aChars) - 1;

            // get random index
            // $iIndex = rand(0, $iTotal);

            // add selected character to code string
            // $this->sCode .= $aChars[$iIndex];
            
            /********************************************/
            /* End of optional code                     */
            /********************************************/
         }
      }
      
      function DrawCharacters() {
         // loop through and write out selected number of characters

         $_SESSION['code'] = $this->sCode;
         for ($i = 0; $i < strlen($this->sCode); $i++) {
            // select random font
            $iCurrentFont = rand(1, 5);
            $size = rand(12, 16);
            
            // select random greyscale colour
            $iRandColour = rand(0, 128);
            $iTextColour = imagecolorallocate($this->oImage, $iRandColour, $iRandColour, $iRandColour);
            
            // write text to image
            imagestring($this->oImage, $iCurrentFont, $this->iSpacing / 3 + $i * $this->iSpacing, ($this->iHeight - imagefontheight($iCurrentFont)) / 2, $this->sCode[$i], $iTextColour);
         }
      }
      
      function Create($sFilename = '') {
         // check for existance of GD PNG library
         if (!function_exists('imagepng')) {
            return false;
         }
        
         $this->DrawLines();
         $this->GenerateCode();
         $this->DrawCharacters();
        
         // write out image to file or browser
         if ($sFilename != '') {
            // write stream to file
            imagepng($this->oImage, $sFilename);
         } else {
            // tell browser that data is png
            header('Content-type: image/png');
            
            // write stream to browser
            imagepng($this->oImage);
         }
        
         // free memory used in creating image
         imagedestroy($this->oImage);
        
         return true;
      }
      
      function GetCode() {
         return $this->sCode;
      }
   }
?>

I've been through everything and can't find why this isn't working. I swapped the words 'join_handle' and 'code' to see what happened and this time it said that join_handle was the indefined index so I think that the problem bit of code is:

PHP Code:

 if (strtoupper($captcha) != $_SESSION['code'])
        {
            $this->message .= $l['join.php']['incorrect_security_code'] . "<br>";
        } 


Thanks in advance for any help that you can give.

Where is your get_param() function?

I think that if you put a print_r($_REQUEST); in get_param() you might be able to figure out why the index "code" is not set (it might be a typo or something).

Let me know if that helps,

Pod.

I can't find the get_param function. I've searched the entire site and can't find it at all. The get_param bit is in the init() function and the whole of that is:

PHP Code:

function init()
    {
        global $g;
        global $l;
        global $gc;

        $name = get_param("join_handle", "");
        $pass = get_param("join_password", "");
        $pass2 = get_param("verify_password", "");
        $mail = get_param("email", "");
        $mail2 = get_param("verify_email", "");
        $captcha = get_param("code", "");

        $this->message = "";

        if (strtoupper($captcha) != $_SESSION['code'])
        {
            $this->message .= $l['join.php']['incorrect_security_code'] . "<br>";
        }

        if (strlen($name) < 4 or strlen($name) > 20 or strpos($name, "'") !== false)
        {
            $this->message .= $l['join.php']['another_username'] . "<br>";
        }

        if ($mail != $mail2 or strlen($mail) > 100 or !preg_match("/^[a-zA-Z-_\.0-9]{1,100}@[a-zA-Z-_\.0-9]{1,100}\.[a-zA-Z-_\.0-9]{1,100}$/", $mail))
        {
            $this->message .= $l['join.php']['incorrect_email'] . "<br>";
        }

        if ($pass != $pass2 or strlen($pass) > 15 or strlen($pass) < 6 or strpos($pass, "'") !== false)
        {
            $this->message .= $l['join.php']['incorrect_password'] . "<br>";
        }

        if (DB::result("SELECT user_id FROM user WHERE name=" . to_sql($name, "Text") . ";") != "")
        {
            $this->message .= $l['join.php']['exists_username'] . "<br>";
        }

        if (DB::result("SELECT user_id FROM user WHERE mail=" . to_sql($mail, "Text") . ";") != "")
        {
            $this->message .= $l['join.php']['exists_email'] . "<br>";
        }

        $month = (int) get_param("month", 1);
        $day = (int) get_param("day", 1);
        $year = (int) get_param("year", 1980);

        if ($month < 1 or $month > 12 or $day < 1 or $day > 31 or $year < 1906 or $year > date("Y") - $g['options']['users_age'] + 1)
        {
            $this->message .= $l['join.php']['incorrect_date'] . "<br>";
        }

        if ($this->message == "")
        {
            set_session("j_name", $name);
            set_session("j_password", $pass);
            set_session("j_mail", $mail);
            set_session("j_month", $month);
            set_session("j_day", $day);
            set_session("j_year", $year);
            set_session("j_country", get_param("country", 1));
            set_session("j_orientation", get_param("orientation", 1));

            if ($g['options']['fast_join'] == "N" and isset($gc) and $gc) redirect("join_space.php");
            elseif ($g['options']['fast_join'] == "N") redirect("join2.php");
            else
            {
                $this->add_user();
                #echo get_session("user_id");
                redirect("profile.php");
            }
        }
    } 


Where would I need to add print_r($_REQUEST);?

Thanks

I added:

PHP Code:

if (isset($_SESSION['code']))
        die('It works!!');
        else
        {
             echo 'It doesn\'t work ';
             die(print_r($_SESSION));
        } 


but got an error saying:

It doesn't work Array ( ) 1

OMG. Undefined index is not an error, it is just a notice. They are not critical and they do not lead to any consequenses. Set your error reporting level to E_ALL ^ E_NOTICE and forget about it.

I set the reporting levels to that, but it didn't work. I'm pretty sure I put the E_ALL ^E_NOTICE in the right place, but just to double check I've included everything from the error handling section of the php.ini file:

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; Error handling and logging ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

; error_reporting is a bit-field.  Or each number up to get desired error
; reporting level
; E_ALL             - All errors and warnings (doesn't include E_STRICT)
; E_ERROR           - fatal run-time errors
; E_WARNING         - run-time warnings (non-fatal errors)
; E_PARSE           - compile-time parse errors
;E_NOTICE          - run-time notices (these are warnings which often result
;                     from a bug in your code, but it's possible that it was
;                     intentional (e.g., using an uninitialized variable and
;                     relying on the fact it's automatically initialized to an
;                     empty string)
; E_STRICT          - run-time notices, enable to have PHP suggest changes
;                     to your code which will ensure the best interoperability
;                     and forward compatibility of your code
; E_CORE_ERROR      - fatal errors that occur during PHP's initial startup
; E_CORE_WARNING    - warnings (non-fatal errors) that occur during PHP's
;                     initial startup
; E_COMPILE_ERROR   - fatal compile-time errors
; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)
; E_USER_ERROR      - user-generated error message
; E_USER_WARNING    - user-generated warning message
; E_USER_NOTICE     - user-generated notice message
;
; Examples:
;
;   - Show all errors, except for notices and coding standards warnings
;
;error_reporting = E_ALL & ~E_NOTICE
;
;   - Show all errors, except for notices
;
;error_reporting = E_ALL & ~E_NOTICE | E_STRICT
;
;   - Show only errors
;
;error_reporting = E_COMPILE_ERROR|E_ERROR|E_CORE_ERROR
;
;   - Show all errors, except coding standards warnings
;
error_reporting  =  E_ALL ^E_NOTICE

; Print out errors (as a part of the output).  For production web sites,
; you're strongly encouraged to turn this feature off, and use error logging
; instead (see below).  Keeping display_errors enabled on a production web site
; may reveal security information to end users, such as file paths on your Web
; server, your database schema or other information.
display_errors = Off

; Even when display_errors is on, errors that occur during PHP's startup
; sequence are not displayed.  It's strongly recommended to keep
; display_startup_errors off, except for when debugging.
display_startup_errors = Off

; Log errors into a log file (server-specific log, stderr, or error_log (below))
; As stated above, you're strongly advised to use error logging in place of
; error displaying on production web sites.
log_errors = On

; Set maximum length of log_errors. In error_log information about the source is
; added. The default is 1024 and 0 allows to not apply any maximum length at all.
log_errors_max_len = 1024

; Do not log repeated messages. Repeated errors must occur in same file on same
; line until ignore_repeated_source is set true.
ignore_repeated_errors = Off

; Ignore source of message when ignoring repeated messages. When this setting
; is On you will not log errors with repeated messages from different files or
; sourcelines.
ignore_repeated_source = Off

; If this parameter is set to Off, then memory leaks will not be shown (on
; stdout or in the log). This has only effect in a debug compile, and if
; error reporting includes E_WARNING in the allowed list
report_memleaks = On

; Store the last error/warning message in $php_errormsg (boolean).
track_errors = Off

; Disable the inclusion of HTML tags in error messages.
; Note: Never use this feature for production boxes.
;html_errors = Off

; If html_errors is set On PHP produces clickable error messages that direct
; to a page describing the error or function causing the error in detail.
; You can download a copy of the PHP manual from http://www.php.net/docs.php
; and change docref_root to the base URL of your local copy including the
; leading '/'. You must also specify the file extension being used including
; the dot.
; Note: Never use this feature for production boxes.
;docref_root = "/phpmanual/"
;docref_ext = .html

; String to output before an error message.
;error_prepend_string = "<font color=ff0000>"

; String to output after an error message.
;error_append_string = "</font>"

; Log errors to specified file.
;error_log = filename

Restart apache

I used /usr/sbin/httpd restart to restart the apache, but it still doesn't work - did I not restart it properly?

Usually it should be restarted with apachectl restart or [/usr/local]/etc/rc.d/apache restart. You can check whether your error_reporting changed with phpinfo(), also check that you don't set error_reporting(E_ALL) somewhere in your script.

It is very strange if your page does not load due to these notices, there may be something more severe than just a notice.

I checked the phpinfo() file and it said:
error_reporting E_ALL ^E_NOTICE E_ALL ^E_NOTICE
I also tried to restart using /etc/rc.d/apache restart but it said that there was no file. When you say check if error_reporting(E_ALL) is set elsewhere in the script do you mean the php.ini file or the php page?

If you see E_ALL ^E_NOTICE in phpinfo() output then it's ok and you don't need to restart apache anymore.

I mean your php script or any other php script included/required bythe one you execute.

I've gone through the site and changed all E_ALL to E_ALL ^ E_NOTICE, but it's still not working. The site is actually a software package that I bought and I needed to install an IonCube before it would work - could that have anything to do with it or could there be other pages that that have E_ALL in them that are encoded and I just can't see them?
Thanks for helping with this

Is it possible to suppress the E_NOTICE error for just that page?

Okay, I added
error_reporting(0);
to the page and it loaded it okay, but when I tested the security image by entering something different to what was in the image it acted as if I'd entered the right details. If I test just the security image it works