Secure Guestbook Script with Image Verification
This is the latest version of my secure PHP guestbook script. A lot of new features have been added since the last release including support for entry moderation, separate configuration and language files, improved code and session handling, and much more. The purpose of this script is to provide an easy to use, yet secure guestbook which features image verification to keep out spam bots as well as other security measures. It uses a flat-file storage method so that it will work for users without database access and contains many other features not found in most standard guestbook scripts.
Download
If you have found this page useful, please consider donating. Thanks!
Included Languages
The script current includes files for the following languages: English, Dutch, Formal German, French, Italian, Norwegian, Portuguese, Romanian, Spanish, Swedish, Turkish
See it in action
I have a demo guestbook here: Demo guestbook
Installation
- Download ddgb.zip and uncompress
- Upload all files into a directory of your choosing
- Give write-access to /dat/.entries and /dat/.banlist (chmod 666 or 777)
- Configure the options in config.php
- Run the script by calling ddgb.php
Changelog
- 07-01-09 – Not a version update, but the spanish language file has been updated, and the missing header.php file (when used in stand-alone mode) has been restored.
- 02-22-09 v2.45 – Several new features from contributor Hans Nordhaug, including: alt attributes added for valid xhtml, increased spam protection (honeypot field), made page navigation translateable, various visual changes.
- 07-27-07 Vv2.44 – PHP short-tag bug fixed. Italian language file added.
- 06-20-07 v2.43 – File locking feature is now an option (disabled by default), instead of automatically enabled
- 06-13-07 v2.42 – Security update
- 04-04-07 – Spanish language file has been added
- 03-24-07 – Romanian language file has been added
- 01-14-07 v2.41 – Fixed bug related to display of entries
- 11-01-06 v2.4 – Moderation/display issues 100% resolved – Smilies are now clickable – Various bug fixes
- 10-22-06 v2.31 – Further improvements to the session code – Should work better on Windows servers now
- 10-21-06 v2.3 – Fixed bug with display of entries when moderating – Improved session code – Dutch language file has been added
- 10-17-06 – Not a version update – Swedish and Portuguese language files have been added
- 09-07-06 v2.2 – Bug fixed (verification problems in non-standalone mode)
- 09-01-06 v2.1 – Various minor fixes – Added Norwegian language file
- 08-24-06 v2.0 – This is a very big update. Because of this, almost all of this page has been rewritten. Unfortunately, previous data files will not work with this release because of the new data structure. The advantage is that new fields can be added in the future without loosing the old data! The new data file is also simple enough that you should be able to manually add your old entries into it. New features include:
- Separate config and language files
- Option to require manual approval/moderation of entries
- Improved session handling (no more separate verification file!)
- Option to run as stand-alone script, or through another page
- Secure data file storage method already implemented
- Now supports basic smilies
- Can disable image verification if not supported
- New option to protect email addresses
- And more – read below - 05-17-06 – Not a version update, but I added instructions on making the guestbook even more secure.
- 05-03-06 v1.31 – Fixed a bug when editing entries – Name, website, and email fields can now be modified on existing entries.
- 03-16-06 v1.3 – Revised layout a tiny bit – Now checks for GD support and gives error if missing – Adds http:// prefix if not entered in web address – IP addresses of posters shown in admin box – Can now ban posters by IP (removes all of their posts too) – Added confirmation before deleting and banning
- 02-16-06 v1.2 – Added option to allow or disallow html in posts – Fixed a magic quotes bug
- 02-06-06 v1.1 – Added option to prevent search engine robots from following links posted by visitors (using the nofollow tag)
- 02-02-06 v1.0 – First public release!
Some of the features
- Flat-file storage with precautions in place to prevent data files from being viewed.
- Various security measures to prevent abuse.
- Separate config and language files.
- Image verification support (can be disabled if your server does not support the GD library).
- Administrative interface to edit and delete entries, ban IPs (and automatically remove entries from that IP), and an option to enable manual approval of entries.
- Implements ‘nofol’ tag to prevent search engine spiders from following links in entries (discourages some spammers).
- HTML in posts disabled by default – you can enable this if you like, but it is a big risk.
- Option to run as stand-alone script or included through another page.
- Smilies are supported (either enter in the code, or click to add!)
Notes
If you want to include this script inside another page, be sure to set the proper ’stand alone’ setting in the config file. You may also need to include the session_start function at the very top of the PHP file you are including the script from:
<?php session_start(); ?>
Then just include the script in your file like this:
<?php include 'ddgb.php'; ?>
Overview of the options
These options can be set in config.php file
Path to ddgb.php
This needs to be set to the full url of the ddgb.php file on your server. Example: http://www.yoursite.com/ddgb/ddgb.php
Path to ddgb-verify.php
This needs to be set to the full url of the ddgb-verify.php file on your server. Example: http://www.yoursite.com/ddgb/ddgb-verify.php
Locale Setting
This allows you to choose the language file the script will use. The current version includes English and Formal German. You can also create your own by using one of the existing files as a template. Just set this option to the name of the file (without the .php) that you want to use.
Administrator Password
This is the password used to perform the administrative functions – editing, deleting, banning, and moderating. Be sure to change the default password.
Administrator Email
Used for new entry notification, if the feature is enabled.
Send Notifications of New Entries
If enabled, admin will receive email for all new entries.
Run as Stand-Alone Script
If you plan to run this script by itself, leave this option set to TRUE. If you want to include it in another page, set it to FALSE, and take a look at the information above under the ‘Notes’ section.
Title Tag
This is the title of the page when the script is used in stand-alone mode.
Path to Data File
This is the location of the data file used to store entries. Be sure to give it write-access (chmod 666 or 777).
Path to Ban File
This is the location of the data file used to store banned IPs. Be sure to give it write-access (chmod 666 or 777).
Requre Manually Entry Approval
If enabled, this will require that the admin manually approve posts. To do this, simply log in using the admin link and you will see all of the posts (including the ones not yet approved). Just click the appropriate link to approve them, or delete them instead if you wish.
Enable Smiles
If enabled, this option will convert text-smilies into images. It will also show the available smilies on the ‘new entry’ page.
Show Introduction Text
This is an optional intro which can be shown above the guestbook. The text it uses can be found in the language file you are using. This is disabled by default.
Disable Image Verification
If this script tells you that your server does not support image verification because you do not have access to the GD library, or you simply wish to disable image verification, set this to TRUE.
Image Verification Colors
This allows you to easily change the colors of the verification image. You can enter either 3 or 6 character hex color codes.
Path to CSS File
This is the location of the script’s CSS file, which controls the look of the guestbook.
Entries Per Page
Determines how many entries will be shown on each page. If there are more entries than this number, the guestbook will be split up into multiple pages.
Allow HTML in Messages
This option is dangerous because it allows visitors to enter HTML, which is a big security risk. It is disabled by default.
Protect Email Addresses
With this option enabled, email addresses will be shown in the following format instead of as traditional links: someone [at] somewhere [dot] net.
Enable File Locking
File locking is not supported by all servers. If you would like to use this feature, set this to TRUE.
Email Notification of Posts
For those of you who would like to receive email notification anytime someone adds a new entry, here is a simple mod. First, find this line in the main script file (ddgb.php):
echo '<p>' . _ADDED_THX . '</p>';
Right after it, add the following:
mail('user@domain.com', 'New Guestbook Entry', 'A New Guestbook Entry was added!');
Be sure to set your email address. The second parameter is the subject, and the third parameter is the message.
You can also use the following variables for your email’s subject or message: $fm_name $fm_website $fm_email $fm_location $fm_message. For example:
mail('user@domain.com', 'New Guestbook Entry', 'A New Guestbook Entry was added by' . $fm_name);
If this method does not work for you, it may have to do with the way your server is configured. Some hosts require that you manually configure the sendmail parameters for the PHP mail function to work properly. If you think this might be the case, you can try the following code instead:
$to = "user@domain.com";
$from = "user@domain.com";
$subject = "New Guestbook Entry";
$body = "A new guestbook entry has been added to your site.";
ini_set("SMTP","localhost");
ini_set("sendmail_from",$from);
$result = mail($to, $subject, $body, "From: $from");
Changing the timezone
If you would like to change the timezone setting for the script, edit config.php and find the following line:
// *** START OF OPTIONS ***
After it, add the following:
date_default_timezone_set('TIMEZONE');
Where TIMEZONE is a valid timezone identifier.
Troubleshooting
If you are having trouble getting the verification code to display, one thing to try is setting the $verify_path option to the filename of the verfication file, instead of the full URL to it. Example:
$verify_path = "ddgb-verify.php";
ops
Jump to Comments