.htaccess and MySQL

[Techykid3]

I want to pull a list of banned IP's from a MySQL database.

And/or, how does forum software ban IP addresses, does it somehow insert into a .htaccess file?

Orrr... Is there a way to ban users without using .htaccess, what I want to do is use a php file, to ban someone, I would put a link, that would be like this: http://mysite.com/xxxxxx/ban.php?ip=xx.xx.xx.xx

[traq]

why ip banning is useless

additionally, I would strongly recommend not using a url as your user interface. Anyone who knows (or discovers) the location of your banning script could start banning legitimate users from your site, without your knowledge.

the internet is designed so that GET requests (in the url, after the ?) are solely for asking for info from a site. To make changes, you should be using forms and the POST request method.

--------------------------
now that that's cleared up, here's what you want to do:

1. set up a database to hold the banned ip addresses.
2. php can use $_SERVER['REMOTE_ADDR'] to get the ip address of the user.*
3. check the current ip against those in the database. if there is a match, stop the script (or redirect, etc.).

to add an address to your banned list:
1. make a form where you can submit the ip address.
2. add the address to your database.

*_supposed_ ip address. read my first link above.

forum software will all have different approaches, but they're all equally ineffective. it's pretty easy to find tutorials, though.

[JShor]

I concur with everything Adrian just said, and I add that you should just modify your .htaccess file with PHP, and just ignore MySQL entirely. Not only does it make things much slower, it's also more elegant.

[traq]

true, but if you go that route, make sure your script is very well-written, secure, with tight validation. one typo in .htaccess will kill your whole site. and an inserted line will give it to someone else.

[djr33]

What do you mean by "give it to someone else. "?

[traq]

for example, if the script is poorly validated, a malicious user might figure out a way to insert entire lines in your htaccess file. issue redirects to a spoof site. password-protect it and lock you out, maybe.

unlikely, but possible. and you can delete the file via ftp if you have to. but it's still a risk.

[djr33]

Ah, yes. ".htaccess injection". That's a new one. Good point.

[traq]

as I said, unlikely - it's far more likely you'll just break your site with a typo. but htaccess is _far_ more powerful than most people realize.

[Techykid3]

And how would I list the banned IP's on a website, if I did use PHP.

And how do I use PHP to connect to the .htaccess file?

[JShor]

You would open the file remotely, ensuring that only your server has read/write permission on the file. Then you would write to it, and close the file.

Something like this:

$ip = "192.168.0.1";
$dir = "/home/directory/.htaccess";

$htaccess = fopen($dir);
$contents = file_get_contents($dir);

fwrite($htaccess, $contents."\nDENY FROM $ip");
fclose($htaccess); 

This is purely sample code for demonstration only. Please don't sue me.