HSAM(Health Services Advocates and Mediators)

'; //Navigation panel $output .= ' '; $output .= ' '; $output .= ' '; $output .= '

'; //########################################### end of header.php require_once ("includes/field_validator.php"); //validation routines require_once ("includes/functions.php"); //routines checktamper(); // Security check not required for logon screen. //Check security- divert to logon page if insuffient authority //securityOK(backtrace()); $goto = ''; if (isset($_REQUEST['$db']) && ($_REQUEST['$db'] == 'hsam' || $_REQUEST['$db'] == 'training' || $_REQUEST['$db'] == 'testing')) { $_SESSION['$db'] = $_REQUEST['$db']; } if (!isset($_SESSION['$db'])) { $_SESSION['$db'] = 'hsam'; } $output .= '

'; $output .= '

'; $errors = ''; $errors = ''; // ************************************************************** //Do the update? //echo '

 ' ;
// print_r($_GET) ;
// echo '

'; if (!isset($_SESSION['failed_logon_attempts'])) { $_SESSION['failed_logon_attempts'] = 0; } if (isset($_POST['submit'])) { $errorflag = 'n'; $errors .= validate_U_email($_POST['U_email']); $errors .= validate_user_password($_POST['user_password']); if ($errors != '') { // invalid email address $_SESSION['failed_logon_attempts'] += 1; // $sleep_time = pow($_SESSION['failed_logon_attempts'], 2); // delay multiple attempts if ($sleep_time > 25) { $sleep_time = 25; } // Dont go over timeout period //echo 'waiting ' . $sleep_time ; //sleep($sleep_time); $output .= $errors; $errorflag = 'y'; } else { //save username,password if (isset($_SESSION['signon_email']) && $_SESSION['signon_email'] != $_POST['U_email']) { //changed userid, so clear password unset($_SESSION['dbpass_encrypted']); } $_SESSION['signon_email'] = $_POST['U_email']; $_SESSION['$u_password'] = $_POST['user_password']; $errors .= check_user_ip($_POST['U_email']); // check that the email and ip is not bannned. } if ($errors == '') { // not banned email or ip global $connection; $errors .= dblogon(); //Attempt to login. } if ($errors == '') { //Logon to db successful //echo ' logon to db successfully'; if (!isset($_SESSION['global_rec'])) { require_once ("includes/set_global_rec.php"); //set the global record } //echo '

 ' ;
        //print_r($_SESSION['global_rec']) ;
        //echo '

'; $unit_of_work = db_query('START TRANSACTION;'); // turns off autocommit, starts a unit of work $sqlquery = "SELECT * FROM User WHERE `U_email` = '" . mysqli_prep($_POST['U_email']) . "';"; $user_set = db_query($sqlquery); confirm_query($user_set, $sqlquery); $num_users = mysqli_num_rows($user_set); $unit_of_work = db_query('rollback;'); //rollback any changes- none should be made, but better safe if ($num_users == 1) { $user_row = mysqli_fetch_array($user_set); if (check_password($user_row['U_passwordhashed'], $_POST['user_password'] . $_POST['U_email'])) { // userid and password correct, check other if ($user_row['U_nbrfailedloggins'] > 10) { $errorflag = 'y'; $errors .= '

User has been suspended. Please confer with site Administrator to reset user.'; $output .= $errors; } else { if ($user_row['U_expiry'] < date("Y-m-d")) { // expired userid? $errorflag = 'y'; $errors .= '

User expiry date of ' . $user_row['U_expiry'] . ' has passed. Please confer with site Administrator to reset user.'; $output .= $errors; } else { // 86400 = 60*60*24 ie no seconds in a day if (($user_row['U_lastlogintime'] + $_SESSION['global_rec']['param']['P_usernonuseexpiry'] * 86400) < strtotime('now')) { //user has not logged in recently- he is suspended $errorflag = 'y'; $errors .= '

User has been suspended due to inactivity(' . date($_SESSION['global_rec']['date_format'], $user_row['U_lastlogintime']) . '). Please confer with site Administrator to reset user.'; $output .= $errors; } else { //user passed-allow signon unset($user_row['U_passwordhashed']); // dont save hashed password in $global_rec unset($user_row[4]); // dont save hashed password in $global_rec if (isset($global_rec['user'])) { unset($global_rec['user']); } $global_rec['user'] = $user_row; unset($_SESSION['global_rec']['user']); $_SESSION['global_rec']['user'] = $global_rec['user']; //echo 'login success'; $sqlquery = "UPDATE User SET `U_nbrfailedloggins` = 0 "; if ($user_row['U_lastlogintime'] < time()) { //only set lastlogin time if less than current time. $sqlquery .= ", `U_lastlogintime` = " . time(); } $sqlquery .= " WHERE `U_email` = '" . mysqli_prep($_POST['U_email']) . "';"; $user_set = db_query($sqlquery); confirm_query($user_set, $sqlquery); //setcookie("user", $_SESSION['global_rec']['user']['U_email'], time() + 3600); setcookie("user", $_SESSION['global_rec']['user']['U_email']); //dont expire /* expire in 1 hour */ // echo '

 ' ;
                            // print_r($_SESSION) ;
                            // echo '

'; reset_user_ip($_POST['U_email']); //reset failed count in txt file if ((strtotime($user_row['U_lastpasswordchangedate']) + $_SESSION['global_rec']['param']['P_usernonuseexpiry'] * 86400) < strtotime('now')) { //password needs to be changed- redirect to change password screen. redirect_to('user_change.php?db=' . DB_NAME . '&fromlogon=yes'); } else { redirect_to('issue_view.php?db=' . DB_NAME); } } } } } else { //invalid password- update failed count $errorflag = 'y'; $output .= '

User email or password is invalid. Try again'; $sqlquery = "UPDATE User SET `U_nbrfailedloggins` = `U_nbrfailedloggins` + 1 " . "WHERE `U_email` = '" . mysqli_prep($_POST['U_email']) . "';"; $user_set = db_query($sqlquery); confirm_query($user_set, $sqlquery); $sleep_time = pow($user_row['U_nbrfailedloggins'], 2); // delay multiple attempts if ($sleep_time > 25) { $sleep_time = 25; } // Dont go over timeout period //sleep($sleep_time); } //echo '

 ' ;
            //print_r($user_row) ;
            //echo '

'; } else { // cant find userid or too many records effected!- so can't update counts $_SESSION['failed_logon_attempts'] += 1; $sleep_time = pow($_SESSION['failed_logon_attempts'], 2); // delay multiple attempts if ($sleep_time > 25) { $sleep_time = 25; } // Dont go over timeout period //sleep($sleep_time); $errorflag = 'y'; $output .= '

User email and password combination is invalid. Try again'; } $unit_of_work = db_query('commit;'); // ensure valid changes are committed, and back to autocommit } else { // cant logon to db!- so can't update DB counts $_SESSION['failed_logon_attempts'] += 1; $sleep_time = pow($_SESSION['failed_logon_attempts'], 2); // delay multiple attempts if ($sleep_time > 25) { $sleep_time = 25; } // Dont go over timeout period //sleep($sleep_time); $errorflag = 'y'; $output .= $errors; } if ($errorflag == 'n') { //no errors, exit if errors where encountered- redisplay the screen by bypasing the exit. $goto = 'endit'; } //else { // invalid signon- } } //if isset($_POST) // ******************************************************************************** if ($goto == '') { unset($user_row); // clear it $output .= $logoff_msg; // display the logoff message. $output .= '

Enter User email and password, then click GO to logon.
'; //Go button $output .= ''; $output .= ''; $output .= ''; if (strpos( __FILE__ ,"pellysoft/hsamtest") == false ) { $output .= ''; } else { $output .= ''; } $output .= ' '; $output .= ' '; $output .= ' '; $output .= '
'; //Reset button //$output .= '

'; } //endit: $output .= '

'; include ("includes/footer.php"); echo $output; ?> ``` ---

**Author:** ![Oxy](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/oxy/32/37989_2.png) [@Oxy](https://forum.infinityfree.com/u/Oxy)\ **Post date:** [February 19, 2023, 10:16pm UTC](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417/11 "2023-02-19T22:16:18Z")

It’s because you have a banned IP/user/word/domain in this file ![Screenshot 2023-02-19 231415](https://forum-cdn.infinityfree.net/original/3X/c/2/c24f121b867802bbb3d68c88942d18195577c397.png) btw. you have some kind of problem here > **Warning** : require\_once(includes/functions.php): failed to open stream: No such file or directory in **/home/vol15\_7/epizy.com/epiz\_23886065/htdocs/includes/connection.php** on line **3** > > **Fatal error** : require\_once(): Failed opening required ‘includes/functions.php’ (include\_path=‘.:/usr/share/pear/’) in **/home/vol15\_7/epizy.com/epiz\_23886065/htdocs/includes/connection.php** on line **3** ---

**Author:** ![skill\_and\_Determinat](https://forum.infinityfree.com/letter_avatar/skill_and_determinat/32/6_22734026db12803ebb3e059622ac3534.png) [@skill\_and\_Determinat](https://forum.infinityfree.com/u/skill_and_Determinat)\ **Post date:** [February 20, 2023, 3:11am UTC](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417/12 "2023-02-20T03:11:50Z")

> [@Oxy](#): > > It’s because you have a banned IP/user/word/domain in this file Nope. That’s not it. That file is only used to check the logon. The issue first appeared on a screen that is not checked against this file. The logon screen was then checked and it too exhibited the same issue- ie a blank screen. After too many failed attempts, botter was added to that file. Had it been an issue with that banned file, it should have displayed an error message, not a blank white screen, However, that: **Fatal error** : require\_once(): Failed opening required ‘includes/functions.php’ (include\_path=‘.:/usr/share/pear/’) in **/home/vol15\_7/epizy.com/epiz\_23886065/htdocs/includes/connection.php** on line **3** possibly could be the cause. I’ll check it/ test it tonight. I’ll keep you posted. Thanks for your help ---

**Author:** ![Oxy](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/oxy/32/37989_2.png) [@Oxy](https://forum.infinityfree.com/u/Oxy)\ **Post date:** [February 20, 2023, 11:55am UTC](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417/13 "2023-02-20T11:55:18Z")

You know your code It is possible that the ban is recorded somewhere in the DB and this file is for information only or log. I see the same all-white as you (I don’t see it as in your title → that PHP crashes) there is no E500. So it could be some form of the ban so the script just doesn’t want to continue or your code didn’t catch the error and doesn’t know what to display. It reacts to anything containing the word “botter” such as 1234botter ---

**Author:** ![skill\_and\_Determinat](https://forum.infinityfree.com/letter_avatar/skill_and_determinat/32/6_22734026db12803ebb3e059622ac3534.png) [@skill\_and\_Determinat](https://forum.infinityfree.com/u/skill_and_Determinat)\ **Post date:** [February 20, 2023, 12:42pm UTC](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417/14 "2023-02-20T12:42:50Z")

yep as you pointed out, it also fails (white screen) even when BOTTER or BOTER is surrounded by other text. Don’t be stuck on the banned functionality as the logon screen is only a quick way to demonstrate the issue. It was first reported on a client surname - once a user was already logged in. And also showed up when trying to view the log. As its also occurring on the logon screen, it proves that the issue is not related to the database, it has not connected yet. I commented out the line, that had the **Fatal error** : require\_once(): Unfortunately it made no difference and botter still fails. Without botter, some of the site works - but some pages complain about the missing require\_once. So I put it back in, as its not the issue. Its a real head scratcher. ---

**Author:** ![skill\_and\_Determinat](https://forum.infinityfree.com/letter_avatar/skill_and_determinat/32/6_22734026db12803ebb3e059622ac3534.png) [@skill\_and\_Determinat](https://forum.infinityfree.com/u/skill_and_Determinat)\ **Post date:** [February 20, 2023, 1:26pm UTC](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417/15 "2023-02-20T13:26:46Z")

In the firefox console log, i see this error message: Unknown category for SetEventRecordingEnabled: page\_load could it be the starting place to look? ---

**Author:** ![Oxy](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/oxy/32/37989_2.png) [@Oxy](https://forum.infinityfree.com/u/Oxy)\ **Post date:** [February 20, 2023, 5:22pm UTC](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417/16 "2023-02-20T17:22:49Z")

If I were in your place… For example notepad++ has the option to search for a term in all files in a directory, so if you have those php files locally, try searching for “botter” (inside dir) and see the results… Unless maybe some stupid thing happened and the two terms were combined through codes for example :one part is `bot` and some other codes add` ter` to it so you get that botter > [@skill\_and\_Determinat](#): > > It was first reported on a client surname The fastest solution is for the user to change his last name and make a new ID card 😄 ---

**Author:** ![Admin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/admin/32/36437_2.png) [@Admin](https://forum.infinityfree.com/u/Admin)\ **Post date:** [February 20, 2023, 7:51pm UTC](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417/17 "2023-02-20T19:51:23Z")

We do have some blocked keywords, but as far as I know “botter” isn’t one of them. As far as I can tell, this is due to your code. I tried to find the solution and did a little bit of debugging. But strangely enough when I added a little debug statement after line 92, it didn’t print the debug statement and instead redirected me back to the home page. What is actually supposed to happen in this case? Is the page supposed to redirect or show contents? * * * Also, probably unrelated, but you may be interested to know PHP has Output Buffering functions. That way, you can use all your regular echo statements or even close the PHP tag to write HTML, and at the end call `ob_flush()` to send the content. It’s up to you whether you want to use it, but it may be a bit easier to work with than writing everything to a string. ---

**Author:** ![skill\_and\_Determinat](https://forum.infinityfree.com/letter_avatar/skill_and_determinat/32/6_22734026db12803ebb3e059622ac3534.png) [@skill\_and\_Determinat](https://forum.infinityfree.com/u/skill_and_Determinat)\ **Post date:** [February 20, 2023, 8:37pm UTC](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417/18 "2023-02-20T20:37:10Z")

I did search for Botter, but not on the split term. I now have for BOT but nothing relevant showed up - except lots of BOTH and BOTTOM. I did ignore case. Searching TER is more problematic as its everywhere as in criteria, center etc. ---

**Author:** ![skill\_and\_Determinat](https://forum.infinityfree.com/letter_avatar/skill_and_determinat/32/6_22734026db12803ebb3e059622ac3534.png) [@skill\_and\_Determinat](https://forum.infinityfree.com/u/skill_and_Determinat)\ **Post date:** [February 20, 2023, 8:47pm UTC](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417/19 "2023-02-20T20:47:20Z")

Hi Admin. You wont be able to change the code. It will detect the change and reverse it. I saw 4 attempts to alter the code. I have had an issue in the past where a compromised trusted user had an infection that altered the site. Unfortunately this has also caused me to write the code that may be a bit difficult to follow. If you like I can temporarily disable this functionally. > [@Admin](#): > > but as far as I know “botter” isn’t one of them Can you please check. As that could explain the issue. I will also investigate the PHP Output Buffering functions. Thanks to everyone for your help. ---

**Author:** ![Admin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/admin/32/36437_2.png) [@Admin](https://forum.infinityfree.com/u/Admin)\ **Post date:** [February 20, 2023, 9:15pm UTC](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417/20 "2023-02-20T21:15:41Z")

> [@skill\_and\_Determinat](#): > > Hi Admin. You wont be able to change the code. It will detect the change and reverse it. I saw 4 attempts to alter the code. > I have had an issue in the past where a compromised trusted user had an infection that altered the site. > Unfortunately this has also caused me to write the code that may be a bit difficult to follow. > If you like I can temporarily disable this functionally. I’m curious how this system works exactly. Are you constantly re-uploading the files over FTP? Or does your PHP code do integrity checks on itself? Disabling this system would help a lot in trying to diagnose this. I promise I will try to leave the code exactly as I found it, but you may want to make sure you have a copy of the code yourself you can use to overwrite any live changes. > [@skill\_and\_Determinat](#): > > Can you please check. As that could explain the issue. Not really. I don’t have access to the full block lists and there are different block lists in different places, and none of them show the behavior we see on your site here. The fact that I was able to get this behavior to change by editing the code makes me believe that it’s not a hosting issue. And I don’t really feel like looking for something I think doesn’t exist and I don’t know where it would be if it did. [Next page](https://forum.infinityfree.com/t/the-text-botter-in-a-field-causes-php-to-crash/72417.md?page=2)

'; $output .= 'HSAM(Health Services Advocates and Mediators)'; $output .= '