1

I'm writing a basic chat service, using php and javascript, and it works well on my localhost server(XAMPP), when I'm using Chrome. Once logged in, it takes you to a chatroom. The problem arises when I'm using the Tor Browser. It generates the *.onion hostname successfully, and I'm even able to login. I have to disable NoScript, else weird errors pop up. But once I disable it, the chat page refuses to send any data. I can send a message with another user on my local machine (on Chrome), and that message shows up in the Tor Browser, but I am unable to send anything from it. I have tried this on my mobile, to get the same result.

Below is the code for the chatroom-

<?php
    session_start();
    if(isset($_SESSION['user']))
        $usr= $_SESSION['user'];
    else if(isset($_SESSION['admin']))
        $usr = $_SESSION['admin'];
    else{
        echo "You haven't logged in. Go back, you sly fox/vixen.";
        echo "<br>"."Redirect in 5 seconds";
        header('Refresh: 5; URL= /');
        exit();
    }
?>

<html>
    <head>
        <title>chatbox</title>
        <script type="text/javascript" src = "../js/jquery-3.2.0.min.js"></script>
        <script>
            function submitChat() {
                if (form1.msg.value == ''){
                    alert('message, bruh?');
                    return;
                }
                var msg = form1.msg.value;

                var xmlhttp = new XMLHttpRequest();
                xmlhttp.onreadystatechange = function() {
                    if (this.readyState == 4 && this.status == 200) {
                        var chatlogs = document.getElementById("chatlogs");
                        chatlogs.innerHTML = xmlhttp.responseText;
                    }
                }
                xmlhttp.open('GET', 'insert.php?msg='+msg, true);
                xmlhttp.send();
            }
            $(document).ready(function(e) {
                $.ajaxSetup({cache:false});
                setInterval(function(){$('#chatlogs').load('logs.php');}, 20);
            });
        </script>
    </head>
<body>
    <form name="form1">
        Name: <?php echo "$usr";?><br />
        <div id="chatlogs" style="font-family: 'Courier New'; overflow-y: scroll; height : 400px;">
            If you're seeing this, disable NoScript.
        </div>
        Message: <br />
        <input type ='text' name="msg" style="font-family: 'Courier New';""><br />
        <input id="Send" type="submit" value="Send" onclick="submitChat();" /><br /><br />
    </form>
</body>
</html>

The function submitChat() passes data to insert.php-

<?php
    session_start();
    if (isset($_SESSION['user']))
        $uname = $_SESSION['user'];
    if (isset($_SESSION['admin']))
        $uname = $_SESSION['admin'];
    $msg = $_REQUEST['msg'];
    //header("Location: /dummy.php");
    $connect = new mysqli('localhost','root','pword','chatbox');

    mysqli_query($connect,"INSERT INTO logs (`uname`,`message`) VALUES ('$uname', '$msg')");

    $result = mysqli_query($connect,"SELECT * FROM logs ORDER BY id DESC");

    while($row=mysqli_fetch_array($result)){
            echo $row['uname'] . ": " . $row['message'] . "<br>";
        }

?>

All in all, nothing is inserted into the database. Any ideas?

bumped to the homepage by Community yesterday

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • 1
    You know there's an obvious and trivial SQL injection there, right? – cacahuatl Mar 30 '17 at 17:56
  • Also, see how to debug here: tor.stackexchange.com/questions/12245/how-to-debug-torbrowser/… – cacahuatl Mar 30 '17 at 18:03
  • Open the javascript console and check the messages you get. – Jan Wytze Mar 30 '17 at 20:15
  • @canonizingironize, I'm just getting started with the server, and MySQL. Regarding debugging, while nothing shows in the JS console, the network tab tells me that a logs.php file (which is just the display part of insert.php) is called, and status codes are occasionally 200, or there is no value. When the "Send" button is pressed, it sends something like - insert.php?msg=r, but with no status code. However, when I right-click on the entry, and say edit and resend, and resend from the inspector window, it sends, with a 200 status code. – Nikhil Itty Apr 1 '17 at 9:09
  • Strange, status code remains grey when I edit and resend some times, and other times it's green. – Nikhil Itty Apr 1 '17 at 9:13
0

Alright. Got a solution. As @canonizingironize recommended, I looked at the Inspector window, the network pane. I had to modify my code slightly. Made the request interval to 1 second, so the server could cope, and added a check, to see if data is sent or not. If not, well, send again.

Resulting in -

$(document).ready(function(e) {
                $.ajaxSetup({cache:false});
                setInterval(function(){$('#chatlogs').load('logs.php');}, 1000);
            });

and -

xmlhttp.open('GET', 'insert.php?msg='+msg, true);
                while(xmlhttp.status != 200){
                    xmlhttp.send();
                    if (xmlhttp.status == 200)
                        break;
                }

Thanks to @canonizingironize and @JanWytze for their inputs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.