2

I'm writing a basic chat service, using php and javascript, and it works well on my localhost server(XAMPP), when I'm using Chrome. Once logged in, it takes you to a chatroom. The problem arises when I'm using the Tor Browser. It generates the *.onion hostname successfully, and I'm even able to login. I have to disable NoScript, else weird errors pop up. But once I disable it, the chat page refuses to send any data. I can send a message with another user on my local machine (on Chrome), and that message shows up in the Tor Browser, but I am unable to send anything from it. I have tried this on my mobile, to get the same result.

Below is the code for the chatroom-

<?php
    session_start();
    if(isset($_SESSION['user']))
        $usr= $_SESSION['user'];
    else if(isset($_SESSION['admin']))
        $usr = $_SESSION['admin'];
    else{
        echo "You haven't logged in. Go back, you sly fox/vixen.";
        echo "<br>"."Redirect in 5 seconds";
        header('Refresh: 5; URL= /');
        exit();
    }
?>

<html>
    <head>
        <title>chatbox</title>
        <script type="text/javascript" src = "../js/jquery-3.2.0.min.js"></script>
        <script>
            function submitChat() {
                if (form1.msg.value == ''){
                    alert('message, bruh?');
                    return;
                }
                var msg = form1.msg.value;

                var xmlhttp = new XMLHttpRequest();
                xmlhttp.onreadystatechange = function() {
                    if (this.readyState == 4 && this.status == 200) {
                        var chatlogs = document.getElementById("chatlogs");
                        chatlogs.innerHTML = xmlhttp.responseText;
                    }
                }
                xmlhttp.open('GET', 'insert.php?msg='+msg, true);
                xmlhttp.send();
            }
            $(document).ready(function(e) {
                $.ajaxSetup({cache:false});
                setInterval(function(){$('#chatlogs').load('logs.php');}, 20);
            });
        </script>
    </head>
<body>
    <form name="form1">
        Name: <?php echo "$usr";?><br />
        <div id="chatlogs" style="font-family: 'Courier New'; overflow-y: scroll; height : 400px;">
            If you're seeing this, disable NoScript.
        </div>
        Message: <br />
        <input type ='text' name="msg" style="font-family: 'Courier New';""><br />
        <input id="Send" type="submit" value="Send" onclick="submitChat();" /><br /><br />
    </form>
</body>
</html>

The function submitChat() passes data to insert.php-

<?php
    session_start();
    if (isset($_SESSION['user']))
        $uname = $_SESSION['user'];
    if (isset($_SESSION['admin']))
        $uname = $_SESSION['admin'];
    $msg = $_REQUEST['msg'];
    //header("Location: /dummy.php");
    $connect = new mysqli('localhost','root','pword','chatbox');

    mysqli_query($connect,"INSERT INTO logs (`uname`,`message`) VALUES ('$uname', '$msg')");

    $result = mysqli_query($connect,"SELECT * FROM logs ORDER BY id DESC");

    while($row=mysqli_fetch_array($result)){
            echo $row['uname'] . ": " . $row['message'] . "<br>";
        }

?>

All in all, nothing is inserted into the database. Any ideas?

Improve this question
5
  • 1
    You know there's an obvious and trivial SQL injection there, right?
    – cacahuatl
    Mar 30, 2017 at 17:56
  • Also, see how to debug here: tor.stackexchange.com/questions/12245/how-to-debug-torbrowser/…
    – cacahuatl
    Mar 30, 2017 at 18:03
  • Open the javascript console and check the messages you get.
    – Jan Wytze
    Mar 30, 2017 at 20:15
  • @canonizingironize, I'm just getting started with the server, and MySQL. Regarding debugging, while nothing shows in the JS console, the network tab tells me that a logs.php file (which is just the display part of insert.php) is called, and status codes are occasionally 200, or there is no value. When the "Send" button is pressed, it sends something like - insert.php?msg=r, but with no status code. However, when I right-click on the entry, and say edit and resend, and resend from the inspector window, it sends, with a 200 status code.
    – Athena
    Apr 1, 2017 at 9:09
  • Strange, status code remains grey when I edit and resend some times, and other times it's green.
    – Athena
    Apr 1, 2017 at 9:13

1 Answer 1

Reset to default
0

Alright. Got a solution. As @canonizingironize recommended, I looked at the Inspector window, the network pane. I had to modify my code slightly. Made the request interval to 1 second, so the server could cope, and added a check, to see if data is sent or not. If not, well, send again.

Resulting in -

$(document).ready(function(e) {
                $.ajaxSetup({cache:false});
                setInterval(function(){$('#chatlogs').load('logs.php');}, 1000);
            });

and -

xmlhttp.open('GET', 'insert.php?msg='+msg, true);
                while(xmlhttp.status != 200){
                    xmlhttp.send();
                    if (xmlhttp.status == 200)
                        break;
                }

Thanks to @canonizingironize and @JanWytze for their inputs.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .