vBulletin论坛hack:论坛自动友情连接

本人编了3个文件:link.php、golink.php、showlink.php内容依次如下:

link.php
//----------------------------------------------

<?echo "
<link rel="stylesheet" type="text/css" href="style.css">
<?
$id
=mysql_connect('localhost','root','zhpdfk760618');
$db=mysql_select_db('chinaphp',$id);
$page_size=20;
if (
$page=="")
 {
$page=1;}
?>


<?
if ($pub)
{  
    
$site=htmlspecialchars($site);
    
$url=htmlspecialchars($url);
    
$name=htmlspecialchars($name);
    
$email=htmlspecialchars($email);
    
$detail=htmlspecialchars($detail);
    
$imgurl=htmlspecialchars($imgurl);
    
$pub_time=date("Y")."-".date("m")."-".date("d");
    
$query="insert into link (site,url,imgurl,name,email,detail,pub_time) values ";
    
$query.="('$site','$url','$imgurl','$name','$email','$detail','$pub_time')";
    
$result=mysql_query($query);
    if (
$result){
        echo 
"<p>添加成功!<a href=javascript:window.close();>关闭窗口</a>、<a href='link.php'>查看友情连接</a></p>";
    }
    else{
        echo 
"<p>发布失败!同一站点不允许重复添加!</p>";
    }


}
else 
{
?>
<html>
<head>
<meta http-equiv="Content-Language" content="zh-cn">
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>加入璀璨友情连接</title>
<script language="JavaScript">
<!--
function Juge(theForm)
{

    if (theForm.site.value == "")
    {
        alert("谁家的站点没有名字?!");
        theForm.site.focus();
        return (false);
    }
    if (theForm.url.value == "")
    {
        alert("谁家的站点没有连接地址?!");
        theForm.url.focus();
        return (false);
    }

        if (theForm.name.value == "")
    {
        alert("谁家的站点没有站长?!");
        theForm.name.focus();
        return (false);
    }

        if (theForm.email.value == "")
    {
        alert("哪个站长没有email?!");
        theForm.email.focus();
        return (false);
    }

        if (theForm.detail.value == "")
    {
        alert("你站点没有内容?!");
        theForm.detail.focus();
        return (false);
    }


}

-->
</script>

</head>

<body>
<p align=center>填写表格,加入璀璨友情连接<hr width=70%><br><center>希望您也能给我的站点做个友情连接,多谢!</center></p>
<table border=0 align=center><tr><td><form method="POST" action="link.php" onsubmit="javascript:return Juge(this);">
 <p>站点名称:<input type="text" name="site" size="47"><br>
  连接地址:<input type="text" name="url" size="47"><br>
  内容简介:<input type="text" name="detail" size="47"><br>
  LOGO地址:<input type="text" name="imgurl" size="47"><br>
  站长名字:<input type="text" name="name" size="47"><br>
  站长信箱:<input type="text" name="email" size="47"><br>
  <br>
  <input type="submit" value="发送" name="pub">
  <input type="reset" value="重写" name="reset"></p>
</form>
</td></tr></table>
<hr width=70%>
<?php
if ($page){

    
$query="select count(*) as total from link";
    
$result=@mysql_query($query);
    
$message_count=@mysql_result($result,0,"total");
    
$page_count=ceil($message_count/$page_size);
    
$offset=($page-1)*$page_size;
    
$query="select * from link";
    
$result=mysql_query($query);
    if(
$result){
    
$rows=mysql_num_rows($result);
    
$i=1;
    echo 
"<center>目前本站友情连接站点共有<font color=red>".$message_count."</font>个&nbsp;&nbsp;";
    echo 
"共有<font color=red>".$page_count."</font>页&nbsp;&nbsp;"."您位于第<font color=red>".$page."</font>页&nbsp;&nbsp;</center><br>";
    
?>
   <table border=1 bordercolordark="#FFFFFF" bordercolorlight="#000000" align=center><tr><td width=200 bgcolor=#e0e4ff>站点名称</td><td width=70 bgcolor=#e0e4ff><center>站长</center></td><td bgcolor=#e0e4ff><center>发布时间</center></td><td bgcolor=#e0e4ff><center>人气</center></td></tr><tr>
   <?php

    
while($myrow=mysql_fetch_array($result)){
?>
   
    <td bgcolor=#e8e8e8><?php echo "<a href=golink.php?recid=$myrow[id] target=_blank title=$myrow[detail]>$myrow[site]</a></td><td bgcolor=f9f9f9><center><a href=mailto:$myrow[email]>$myrow[name]</a></center></td><td bgcolor=#e8e8e8>$myrow[pub_time]</td><td bgcolor=f9f9f9><font color=red><center>$myrow[hits]</center></font></td></tr>"?>
  

<?php
            $i
++;
            if (
$i<=$rows){
                echo 
"";
            }
        }
?>
   </table><center>
<?php
        $prev_page
=$page-1;
        
$next_page=$page+1;
        
?>

        <?php     echo "<form action=book.php method=post>";
        if (
$page<=1){
            echo 
"第一页";
        }
        else{
            echo 
"<a href='$PATH_INFO?page=1'>第一页</a>";
        }
        echo 
"&nbsp;";
        if (
$prev_page<1){
            echo 
"上一页";
        }
        else{
            echo 
"<a href='$PATH_INFO?page=$prev_page'>上一页</a>";
        }
        echo 
"&nbsp;";
        if (
$next_page>$page_count){
            echo 
"下一页";
        }
        else{
            echo 
"<a href='$PATH_INFO?page=$next_page'>下一页</a>";
        }
        echo 
"&nbsp;";
        if (
$page>=$page_count){
            echo 
"最后一页&nbsp;&nbsp;";
        }
        else{
            echo 
"<a href='$PATH_INFO?page=$page_count'>最后一页</a>&nbsp;&nbsp;";
        }echo 
"跳到第<input type=text title=输入页码 size=3 name=page>页";
    }
    else{
        echo 
"<p align='center'>现在还没有文章!</p>";
        echo 
"</form>";
    }

}

?>
<hr width=70%>
<br><br>
</body>
</html>
<?}?>
//----------------------------------------------


golink.php
//----------------------------------------------
<?
  $id
=mysql_connect('localhost','root','');
  
$db=mysql_select_db('chinaphp',$id);
 
?>
<?php

if ($recid)
{
    
$query="update link set hits=hits+1 where id=".$recid;
    
$result=mysql_query($query);
    
$query="select * from  link  where id=".$recid;
    
$result=mysql_query($query);
    if(
$result){
    
$url=mysql_result($result,0,'url');
    
header("Location: $urln");
 
    
  }
   else
   {
   echo        
"可能连接地址有误,请通知站长!" ;}
}
?>

//------------------------------------

showlink.php
//--------------------------------------------

<?php
    $id
=mysql_connect('localhost','root','zhpdfk760618');
    
$db=mysql_select_db('chinaphp',$id);  
    
$query="select count(*) as total from link";
    
$result=mysql_query($query);
    
$query="select * from link";
    
$result=mysql_query($query);
    if(
$result){
    
$rows=mysql_num_rows($result);
    
$i=1;
    while(
$myrow=mysql_fetch_array($result)){
    echo 
"document.write(" | <a href=golink.php?recid=$myrow[idtarget=_blank title=站长:$myrow[name]|内容:$myrow[detail]|点击$myrow[hits]>$myrow[site]</a>");";
              
$i++;
            if (
$i<=$rows){
                echo 
"";
            }
        }}
?>
//---------------------------------------------------
将这三个文件上传到服务器vB目录下


在vB数据库中增加了一个新表“link”,内容如下:
//----------------------------------------------
CREATE TABLE link (
   id int(11) NOT NULL auto_increment,
   site varchar(30) NOT NULL,
   pub_time date DEFAULT '0000-00-00' NOT NULL,
   detail varchar(50) NOT NULL,
   hits int(11) DEFAULT '0' NOT NULL,
   url varchar(60) NOT NULL,
   imgurl varchar(60) NOT NULL,
   name varchar(30) NOT NULL,
   email varchar(40) NOT NULL,
   PRIMARY KEY (id),
   UNIQUE site (site),
   UNIQUE url (url)
);
//-----------------------------------------

修改模板“loggedinusers”在最后面增加下面内容:
//-------------------------------------------
<tr bgcolor="{firstaltcolor}">
<td><img src="images/link.gif"></td>
<td colspan=4 align=center>
<smallfont><marquee behavior=scroll direction=left width=509 scrollamount=2  scrolldelay=1 onmouseover=this.stop() onmouseout=this.start()><a href=link.php target=_blank>欢迎加入友情连接</a>
<script language="JavaScript" src="showlink.php"></script>
</marquee><td nowrap align=center>
<a href=link.php target=_blank title=快点登记吧!>[加入友情连接]</a></td>
</smallfont></td>
</tr>

//-------------------------------------------