IP Blocking Script

[RevHavoc]

I've been trying to enforce an ip blocking feature on my website. Where if the user requesting any file within my site is on the blacklisted ip list it will block them and deny them access. I found a MySQL script online but I got an error when trying to upload it, something with the code (I'm not a programmer, can only edit & pick things out).

I also tried a search here but came up empty, too common search terms or something. Anyone?

[KoosHopeloos]

@ RevHavoc: If your website is hosted on Apache server you can edit your .htacces-file, see here and here.

Remember, it might be that your hoster does not let you use MySQL...

[RevHavoc]

Originally Posted by KoosHopeloos

@ RevHavoc: If your website is hosted on Apache server you can edit your .htacces-file, see here and here.

Remember, it might be that your hoster does not let you use MySQL...

Hosting specs:
Linux (I think I can change it to Windows also)
MySQL Admin server version: 4.1.22
MySQL Client version: 5.0.27 protocol 10

[RevHavoc]

Here is the error I get when trying to import the file to the MySQL database:

Error

There seems to be an error in your SQL query. The MySQL server error output below, if there is any, may also help you in diagnosing the problem

ERROR: Unknown Punctuation String @ 1
STR: <?
SQL: <?php

define("DB_HOST", "localhost");


SQL query:

MySQL said: Documentation
#1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '<?php

define("DB_HOST", "localhost")' at line 1

Ideas? Or anyone possibly have something else that may work please?

[gamerman0203]

by the looks of it, you're trying to use PHP within a mysql statement and that won't work. Here's what I would do:

You need to create a database first. Most hosting providers will supply a GUI (Graphical User Interface) to do this within your sites control panel.

Next, make a file and name it "db_connect.php". Put this in it:

PHP Code:

<?php
//This file will handle the connecting to your database

$host = "localhost" //replace "localhost" with your providors host name
$username = "root" //replace "root" with your username for the database
$password = "password" //replace "password" with your password
$db_name = "dbname" //replace "dbname" with your database's name

mysql_connect($host,$username,$password);
mysql_select_db($db_name);
?>

Create this file and name it "ip_table_create.php"

PHP Code:

<?php
//This file will only be used once!
include "db_connect.php"; //include connection data

mysql_query("CREATE TABLE ip(id INT NOT NULL AUTO_INCREMENT, PRIMARY KEY(id), ip VARCHAR(15))") or die(mysql_error());
//Above is a mysql query that creates a table named "ip" and puts 2 fields into it: id - which will be useful later down the road for identifying a record (if you decide to use it); and ip - which will store the actual IP Address.

echo "Successful";
//If the query runs fine without errors, you will see "successful" printed on the page, otherwise you'll see an error generated by mysql.
?>

Now, Create this file. It will get a little weird looking and complicated, but I'll explain it as best as possible. name it "add_ip.php"

PHP Code:

<?php
//this file is where you will add ip address to your database

include "db_connect.php";

if(isset($_REQUEST['ip'])){ //This line will look in the address bar for the term "?ip=blah" (blah being an IP address).  If it's there it will execute what is directly under it.  If it's not, it will execute what is under "else."
   include "db_connect.php"; //connect to database
   $ip = $_REQUEST['ip']; //assign the address bar data to a variable
   $query = mysql_query("SELECT * FROM ip WHERE ip = '{$ip}'") or die(mysql_error()); //query the database to see if the entered IP address already exists.
   $row = mysql_fetch_assoc($query); //assign the query's results to a variable
   if($row['ip']==""){ //check to see if the "ip" field is blank (meaning the IP address is not already in the database).  If it's blank to the following, otherwise do what comes after "else".
      mysql_query("INSERT INTO ip(ip) VALUES('{$ip}')") or die(mysql_error()); // if the IP address does exist in the db already, this query will run and put it in.
      echo "IP Successfully Added";  //You'll see this if the query ran fine, else you'll see the error
   }else{
      header("Location: http://{$_SERVER['HTTP_HOST']}/add_ip.php?m=1"); // this will run if the ip address already exists.  It will reload the page with "?m=1" as an argument.
   }
}elseif(isset($_REQUEST['m']) && $_REQUEST['m']=="1"){
//this checks to see if m=1 is in the address bar.  if it is, execute what comes next.
      echo "That IP Address Already is Blacklisted"; //this will tell you that the ip address is already in the database.
   }
?>
<!-- When the page first loads up, the bottom will execute.  It's a form where you can add an ip address to the database.  It will submit the information back to this page, but instead of seeing this, it will run what is above because "?ip=blah" will be in the address bar. -->
   <form action="?" method="GET">
   <table>
      <tr>
         <td>Ip Address:</td>
         <td><input type="text" name="ip"></td>
      </tr>
      <tr>
         <td colspan="2" align="center"><input type="submit" value="Submit"></td>
      </tr>
   </table>
   </form>

<?}?>

Last by not least, create this file and name it "ip_check.php":

PHP Code:


<?php

   include "db_connect.php"; //database connect
   $user_ip = $_SERVER['REMOTE_ADDR']; //This line gets the users IP address
   $query = mysql_query("SELECT * FROM ip WHERE ip = '{$user_ip}'") or die(mysql_error()); //this queries the database for the users ip address
   $row = mysql_fetch_assoc($query); //assign db data to variable
   if($row['ip']==$user_ip){
      header("Location: http://{$_SERVER['HTTP_HOST']}/blacklist.html");
   } //the above checks to see if the data retrieved from the db is the same as the users IP.  If it is, it redirects them to a page called "blacklist.html" where you can say whatever you want.  You can also change the page name to anything you want.  If they are not blacklisted, then it finishes the script without doing anything.

?>

LAST STEP, I promise:

Put this following AT THE VERY TOP of every page you want their ip address to be checked:

PHP Code:

<?php include "ip_check.php" ?>

There you go! That should work. If it doesn't, there is a typo some where so PM me about it.

[RevHavoc]

Thanks gamerman0203!!! That is actually a very similar setup and code I was trying to use. I will try it out and post back. I appreciate it.

[RevHavoc]

This is where I have been trying to create the ip block database. This is the only database GUI I have found. *see ref pic*
155290-1.jpg
I have never created a database before, only upped reg files via FTP and the like.
This isn't right is it?

[gamerman0203]

Thats the right place. Up at the top where it tells you your server and database names is saying that you already have a db made. I can't read the image very well, but it looks like "doac" or "doae". Anyways, that the name you want to put in the $dbname = "doac" variable. You can also create a table from that screen if you wish or just run the script that I provided. either will work fine.

[RevHavoc]

Originally Posted by gamerman0203

Thats the right place. Up at the top where it tells you your server and database names is saying that you already have a db made. I can't read the image very well, but it looks like "doac" or "doae". Anyways, that the name you want to put in the $dbname = "doac" variable. You can also create a table from that screen if you wish or just run the script that I provided. either will work fine.

Well, that's good news.

It's 'deac' (deactivate, want something descript for the database name ). I did edit the file accordingly.

How do I run the script without manually creating a table (which looks like a pita to do)? Can't I just upload those x.php files into the db or doesn't it work like that? I tried import but I got an error similar to the one I was experiencing before. I don't think it's an issue with the code, my be filename/ext, or my id10t mistake. I wouldn't be normally asking questions like this but I tried looking it up myself to no avail in manuals and using support.

[gamerman0203]

all you do is copy/paste those scripts into notepad or whatever you use to make your pages. If it's Dreamweaver or Frontpage, make sure you paste them into code view. Save them as the names I suggested. Now they are their own seperate pages. All you need to do is call the "ip_table_create.php" page once and it will make the table for you in the database. Once that is done, you don't have to worry about ever using that page again. Treat each of these as web pages. They don't belong to or go into the database in any way, they just communicate with it whenever called upon. So to run the "ip_table_create.php" page, you would upload it into your web site like you do everything else and then open up a browser and go to "http://www.yourwebsite.com/ip_table_create.php". This will run the script and create the table for you. If it works it will say "successful" and you can close the browser. If it doesn't work, it will give you an error and, in that case, post the error here. Create the other pages the same way and upload them into your website also. Once that is done, all you need to do to check the users IP is put the last section of script at the very top of every page you want the user to be checked on. To add an IP address to the database, just go to "http://www.yourwebsite.com/add_ip.php" and put the desired IP in the box and click submit. Easy as pie!

[RevHavoc]

Alright, that explanation / direction is making more sense.
I followed the instructions and havn't been able to create it yet.

This is the error I keep receiving when trying to "call up" ip_table_create.php in my browser after uploading the 4 files into my http root docs:

Parse error: parse error, unexpected T_VARIABLE in /home/content/d/c/p/(HostAcct)/html/db_connect.php on line 5

I've keep playing around with the db_connect.php file changing the host to something else to try and see if it was a prob with what I'm putting in, but I keep getting that error. Thanks for your help.

[gamerman0203]

oops!!! I'm an idiot!! I'm sorry...

After each line in db_connect.php, make sure there is a semi-colon ";". I'm sorry.