Warning: Creating default object from empty value in /home/design/public_html/wp-content/plugins/paged-comments/paged-comments.php on line 31
Secure Guestbook Script with Image Verification · Dagon Design

Welcome to Dagon Design. In addition to free scripts, WordPress plugins, and articles, we offer a variety of services including custom theme design, plugin creation, and PHP scripting. Contact me for more information.

Version 2.45   Updated Wednesday, July 1st, 2009 at 7:19pm

Secure Guestbook Script with Image Verification

This is the latest version of my secure PHP guestbook script. A lot of new features have been added since the last release including support for entry moderation, separate configuration and language files, improved code and session handling, and much more. The purpose of this script is to provide an easy to use, yet secure guestbook which features image verification to keep out spam bots as well as other security measures. It uses a flat-file storage method so that it will work for users without database access and contains many other features not found in most standard guestbook scripts.

Download

  If you have found this page useful, please consider donating. Thanks!

Included Languages

The script current includes files for the following languages: English, Dutch, Formal German, French, Italian, Norwegian, Portuguese, Romanian, Spanish, Swedish, Turkish

See it in action

I have a demo guestbook here: Demo guestbook

Installation

  • Download ddgb.zip and uncompress
  • Upload all files into a directory of your choosing
  • Give write-access to /dat/.entries and /dat/.banlist (chmod 666 or 777)
  • Configure the options in config.php
  • Run the script by calling ddgb.php

Changelog

  • 07-01-09 – Not a version update, but the spanish language file has been updated, and the missing header.php file (when used in stand-alone mode) has been restored.
  • 02-22-09 v2.45 – Several new features from contributor Hans Nordhaug, including: alt attributes added for valid xhtml, increased spam protection (honeypot field), made page navigation translateable, various visual changes.
  • 07-27-07 Vv2.44 – PHP short-tag bug fixed. Italian language file added.
  • 06-20-07 v2.43 – File locking feature is now an option (disabled by default), instead of automatically enabled
  • 06-13-07 v2.42 – Security update
  • 04-04-07 – Spanish language file has been added
  • 03-24-07 – Romanian language file has been added
  • 01-14-07 v2.41 – Fixed bug related to display of entries
  • 11-01-06 v2.4 – Moderation/display issues 100% resolved – Smilies are now clickable – Various bug fixes
  • 10-22-06 v2.31 – Further improvements to the session code – Should work better on Windows servers now
  • 10-21-06 v2.3 – Fixed bug with display of entries when moderating – Improved session code – Dutch language file has been added
  • 10-17-06 – Not a version update – Swedish and Portuguese language files have been added
  • 09-07-06 v2.2 – Bug fixed (verification problems in non-standalone mode)
  • 09-01-06 v2.1 – Various minor fixes – Added Norwegian language file
  • 08-24-06 v2.0 – This is a very big update. Because of this, almost all of this page has been rewritten. Unfortunately, previous data files will not work with this release because of the new data structure. The advantage is that new fields can be added in the future without loosing the old data! The new data file is also simple enough that you should be able to manually add your old entries into it. New features include:
    - Separate config and language files
    - Option to require manual approval/moderation of entries
    - Improved session handling (no more separate verification file!)
    - Option to run as stand-alone script, or through another page
    - Secure data file storage method already implemented
    - Now supports basic smilies
    - Can disable image verification if not supported
    - New option to protect email addresses
    - And more – read below
  • 05-17-06 – Not a version update, but I added instructions on making the guestbook even more secure.
  • 05-03-06 v1.31 – Fixed a bug when editing entries – Name, website, and email fields can now be modified on existing entries.
  • 03-16-06 v1.3 – Revised layout a tiny bit – Now checks for GD support and gives error if missing – Adds http:// prefix if not entered in web address – IP addresses of posters shown in admin box – Can now ban posters by IP (removes all of their posts too) – Added confirmation before deleting and banning
  • 02-16-06 v1.2 – Added option to allow or disallow html in posts – Fixed a magic quotes bug
  • 02-06-06 v1.1 – Added option to prevent search engine robots from following links posted by visitors (using the nofollow tag)
  • 02-02-06 v1.0 – First public release!

Some of the features

  • Flat-file storage with precautions in place to prevent data files from being viewed.
  • Various security measures to prevent abuse.
  • Separate config and language files.
  • Image verification support (can be disabled if your server does not support the GD library).
  • Administrative interface to edit and delete entries, ban IPs (and automatically remove entries from that IP), and an option to enable manual approval of entries.
  • Implements ‘nofol’ tag to prevent search engine spiders from following links in entries (discourages some spammers).
  • HTML in posts disabled by default – you can enable this if you like, but it is a big risk.
  • Option to run as stand-alone script or included through another page.
  • Smilies are supported (either enter in the code, or click to add!)

Notes

If you want to include this script inside another page, be sure to set the proper ’stand alone’ setting in the config file. You may also need to include the session_start function at the very top of the PHP file you are including the script from:

<?php session_start(); ?>

Then just include the script in your file like this:

<?php include 'ddgb.php'; ?>

Overview of the options

These options can be set in config.php file

Path to ddgb.php

This needs to be set to the full url of the ddgb.php file on your server. Example: http://www.yoursite.com/ddgb/ddgb.php

Path to ddgb-verify.php

This needs to be set to the full url of the ddgb-verify.php file on your server. Example: http://www.yoursite.com/ddgb/ddgb-verify.php

Locale Setting

This allows you to choose the language file the script will use. The current version includes English and Formal German. You can also create your own by using one of the existing files as a template. Just set this option to the name of the file (without the .php) that you want to use.

Administrator Password

This is the password used to perform the administrative functions – editing, deleting, banning, and moderating. Be sure to change the default password.

Administrator Email

Used for new entry notification, if the feature is enabled.

Send Notifications of New Entries

If enabled, admin will receive email for all new entries.

Run as Stand-Alone Script

If you plan to run this script by itself, leave this option set to TRUE. If you want to include it in another page, set it to FALSE, and take a look at the information above under the ‘Notes’ section.

Title Tag

This is the title of the page when the script is used in stand-alone mode.

Path to Data File

This is the location of the data file used to store entries. Be sure to give it write-access (chmod 666 or 777).

Path to Ban File

This is the location of the data file used to store banned IPs. Be sure to give it write-access (chmod 666 or 777).

Requre Manually Entry Approval

If enabled, this will require that the admin manually approve posts. To do this, simply log in using the admin link and you will see all of the posts (including the ones not yet approved). Just click the appropriate link to approve them, or delete them instead if you wish.

Enable Smiles

If enabled, this option will convert text-smilies into images. It will also show the available smilies on the ‘new entry’ page.

Show Introduction Text

This is an optional intro which can be shown above the guestbook. The text it uses can be found in the language file you are using. This is disabled by default.

Disable Image Verification

If this script tells you that your server does not support image verification because you do not have access to the GD library, or you simply wish to disable image verification, set this to TRUE.

Image Verification Colors

This allows you to easily change the colors of the verification image. You can enter either 3 or 6 character hex color codes.

Path to CSS File

This is the location of the script’s CSS file, which controls the look of the guestbook.

Entries Per Page

Determines how many entries will be shown on each page. If there are more entries than this number, the guestbook will be split up into multiple pages.

Allow HTML in Messages

This option is dangerous because it allows visitors to enter HTML, which is a big security risk. It is disabled by default.

Protect Email Addresses

With this option enabled, email addresses will be shown in the following format instead of as traditional links: someone [at] somewhere [dot] net.

Enable File Locking

File locking is not supported by all servers. If you would like to use this feature, set this to TRUE.

Email Notification of Posts

For those of you who would like to receive email notification anytime someone adds a new entry, here is a simple mod. First, find this line in the main script file (ddgb.php):

echo '<p>' . _ADDED_THX . '</p>';

Right after it, add the following:

mail('user@domain.com', 'New Guestbook Entry', 'A New Guestbook Entry was added!');

Be sure to set your email address. The second parameter is the subject, and the third parameter is the message.

You can also use the following variables for your email’s subject or message: $fm_name $fm_website $fm_email $fm_location $fm_message. For example:

mail('user@domain.com', 'New Guestbook Entry', 'A New Guestbook Entry was added by' . $fm_name);

If this method does not work for you, it may have to do with the way your server is configured. Some hosts require that you manually configure the sendmail parameters for the PHP mail function to work properly. If you think this might be the case, you can try the following code instead:

$to = "user@domain.com";
$from = "user@domain.com";
$subject = "New Guestbook Entry";
$body = "A new guestbook entry has been added to your site.";
ini_set("SMTP","localhost");
ini_set("sendmail_from",$from);
$result = mail($to, $subject, $body, "From: $from");

Changing the timezone

If you would like to change the timezone setting for the script, edit config.php and find the following line:

// *** START OF OPTIONS ***

After it, add the following:

date_default_timezone_set('TIMEZONE');

Where TIMEZONE is a valid timezone identifier.

Troubleshooting

If you are having trouble getting the verification code to display, one thing to try is setting the $verify_path option to the filename of the verfication file, instead of the full URL to it. Example:

$verify_path = "ddgb-verify.php";

Pages: [62] 61 60 59 58 57 56 55 54 53 521 » Show All

  1. You can buy rechargeable power products for any sort of operator.

    Cords can be controlled with zip cords, twist ties, or Velcro tie backs.
    Xbox 360 Wireless Controller: This award-winning, high-performance wireless
    controller features the Xbox Guide Button for quick, in-game access to friends and music.

  2. It will let you to see which apps aree maintaining the device “awake” and
    causing added battery drain.

  3. For the reason that the admin of this website is working, no question very rapidly it will be renowned, due to
    its quality contents.

  4. My relatives always say that I am wasting my time here
    at web, except I know I am getting familiarity daily by
    reading such nice posts.

  5. I used to be able t? find good info from your content.

Pages: [62] 61 60 59 58 57 56 55 54 53 521 » Show All

Leave a Comment

Before you comment: If you are having an issue with a script, please make sure you have read the entire article. Also, please read through the comments because most common issues have already been discussed many times. Thanks.


Be sure to wrap all code in <code></code> tags.