Secure Guestbook Script with Image Verification

This is the latest version of my secure PHP guestbook script. A lot of new features have been added since the last release including support for entry moderation, separate configuration and language files, improved code and session handling, and much more. The purpose of this script is to provide an easy to use, yet secure guestbook which features image verification to keep out spam bots as well as other security measures. It uses a flat-file storage method so that it will work for users without database access and contains many other features not found in most standard guestbook scripts.

Download

• ddgb.zip

Included Languages

The script current includes files for the following languages: English, Dutch, Formal German, French, Italian, Norwegian, Portuguese, Romanian, Spanish, Swedish, Turkish

See it in action

I have a demo guestbook here: Demo guestbook

Installation

• Download ddgb.zip and uncompress
• Upload all files into a directory of your choosing
• Give write-access to /dat/.entries and /dat/.banlist (chmod 666 or 777)
• Configure the options in config.php
• Run the script by calling ddgb.php

Changelog

Some of the features

• Flat-file storage with precautions in place to prevent data files from being viewed.
• Various security measures to prevent abuse.
• Separate config and language files.
• Image verification support (can be disabled if your server does not support the GD library).
• Administrative interface to edit and delete entries, ban IPs (and automatically remove entries from that IP), and an option to enable manual approval of entries.
• Implements ‘nofol’ tag to prevent search engine spiders from following links in entries (discourages some spammers).
• HTML in posts disabled by default – you can enable this if you like, but it is a big risk.
• Option to run as stand-alone script or included through another page.
• Smilies are supported (either enter in the code, or click to add!)

Notes

If you want to include this script inside another page, be sure to set the proper ’stand alone’ setting in the config file. You may also need to include the session_start function at the very top of the PHP file you are including the script from:

<?php session_start(); ?>

Then just include the script in your file like this:

<?php include 'ddgb.php'; ?>

Overview of the options

These options can be set in config.php file

Path to ddgb.php

This needs to be set to the full url of the ddgb.php file on your server. Example: http://www.yoursite.com/ddgb/ddgb.php

Path to ddgb-verify.php

This needs to be set to the full url of the ddgb-verify.php file on your server. Example: http://www.yoursite.com/ddgb/ddgb-verify.php

Locale Setting

This allows you to choose the language file the script will use. The current version includes English and Formal German. You can also create your own by using one of the existing files as a template. Just set this option to the name of the file (without the .php) that you want to use.

Administrator Password

This is the password used to perform the administrative functions – editing, deleting, banning, and moderating. Be sure to change the default password.

Administrator Email

Used for new entry notification, if the feature is enabled.

Send Notifications of New Entries

If enabled, admin will receive email for all new entries.

Run as Stand-Alone Script

If you plan to run this script by itself, leave this option set to TRUE. If you want to include it in another page, set it to FALSE, and take a look at the information above under the ‘Notes’ section.

Title Tag

This is the title of the page when the script is used in stand-alone mode.

Path to Data File

This is the location of the data file used to store entries. Be sure to give it write-access (chmod 666 or 777).

Path to Ban File

This is the location of the data file used to store banned IPs. Be sure to give it write-access (chmod 666 or 777).

Requre Manually Entry Approval

If enabled, this will require that the admin manually approve posts. To do this, simply log in using the admin link and you will see all of the posts (including the ones not yet approved). Just click the appropriate link to approve them, or delete them instead if you wish.

Enable Smiles

If enabled, this option will convert text-smilies into images. It will also show the available smilies on the ‘new entry’ page.

Show Introduction Text

This is an optional intro which can be shown above the guestbook. The text it uses can be found in the language file you are using. This is disabled by default.

Disable Image Verification

If this script tells you that your server does not support image verification because you do not have access to the GD library, or you simply wish to disable image verification, set this to TRUE.

Image Verification Colors

This allows you to easily change the colors of the verification image. You can enter either 3 or 6 character hex color codes.

Path to CSS File

This is the location of the script’s CSS file, which controls the look of the guestbook.

Entries Per Page

Determines how many entries will be shown on each page. If there are more entries than this number, the guestbook will be split up into multiple pages.

Allow HTML in Messages

This option is dangerous because it allows visitors to enter HTML, which is a big security risk. It is disabled by default.

Protect Email Addresses

With this option enabled, email addresses will be shown in the following format instead of as traditional links: someone [at] somewhere [dot] net.

Enable File Locking

File locking is not supported by all servers. If you would like to use this feature, set this to TRUE.

Email Notification of Posts

For those of you who would like to receive email notification anytime someone adds a new entry, here is a simple mod. First, find this line in the main script file (ddgb.php):

echo '<p>' . _ADDED_THX . '</p>';

Right after it, add the following:

mail('user@domain.com', 'New Guestbook Entry', 'A New Guestbook Entry was added!');

Be sure to set your email address. The second parameter is the subject, and the third parameter is the message.

You can also use the following variables for your email’s subject or message: $fm_name $fm_website $fm_email $fm_location $fm_message. For example:

mail('user@domain.com', 'New Guestbook Entry', 'A New Guestbook Entry was added by' . $fm_name);

If this method does not work for you, it may have to do with the way your server is configured. Some hosts require that you manually configure the sendmail parameters for the PHP mail function to work properly. If you think this might be the case, you can try the following code instead:

$to = "user@domain.com";
$from = "user@domain.com";
$subject = "New Guestbook Entry";
$body = "A new guestbook entry has been added to your site.";
ini_set("SMTP","localhost");
ini_set("sendmail_from",$from);
$result = mail($to, $subject, $body, "From: $from");

Changing the timezone

If you would like to change the timezone setting for the script, edit config.php and find the following line:

// *** START OF OPTIONS ***

After it, add the following:

date_default_timezone_set('TIMEZONE');

Where TIMEZONE is a valid timezone identifier.

Troubleshooting

If you are having trouble getting the verification code to display, one thing to try is setting the $verify_path option to the filename of the verfication file, instead of the full URL to it. Example:

$verify_path = "ddgb-verify.php";