Unfortunately, although the people in the rule that an IP address is just an unsigned 32-bit integer, and is easy to determine, usually with $ _SERVER [ "REMOTE_ADDR"], where the real challenge – is in defining the range within which it must decide whether the IP address. IP ranges are usually divided into three categories (in increasing complexity):

1. Wild Card: 192.168.10 .*
2. Start-end: 10.1.0.0-10.1.255.255
3. * CIDR: 172.16.1.0/24

* Classless Inter-Domain Routing

The wild card method, or ‘class’, lets you in the class A (10 .*.*.*), Class B (172.16 .*.*) or Class C (192.168.10 .*) levels granularity of the things we like in the old days (before the web decided to make the popular internet). But still, this is just not granular enough for practice.

Thus was born CIDR (yes, I’m talking about skipping the end of last start now). CIDR was on the concept that we really do not need to create networks to 8, 16, 24-bit boundaries, and we could be more granular by using an arbitrary number (from 2-30) to a series of networks. Details about why you can not use “31″ beyond the scope of this article.

CIDR renaming of the former Class A, B and C networks / 8, / 16 and / 24, and reflects the left-most significant bits of the 32-bit IP address. Thus was born the possibility of very specific IP ranges in the form abcd / xx. However, part of the problem with this is that, although it succinctly describes the network beginning and end, the most normal mortal people could not decipher. CIDR addressing may also be in the form of a longer netmask, eg abcd/255.255.255.224

The simplified form of start-IP – IP in the end was just the place for mortals and is typically used by persons without networking background. There is also strong in the consumer broadband router, and especially in Microsoft Windows DHCP server.

To have declared, as a number, and hence that a network mask is, how can we use this knowledge to help us in determining whether an IP is in an area?

What this article will attempt to do if the design of algorithms for the verification of IP addresses easier.

Logically, Method 1 (the wildcard), the method can be easily 2 (start-end) through the use of setting start and end of the wildcard string and replaces the character “*” and 0 for the start and 255 for the end, for example, “192.168.10 .*” will “192.168.10.0-192.168.10.255″ which (I hope) will be for everyone apparently.

We can then assess whether Method1 and Method2 in the same way. In this, we simply use the PHP function in ip2long () for all 3 values and a mathematical test start <= IP <= end.

list ($ low, $ II) = explode ('-', $, 2);
        $ Lower_dec = ip2long ($ lower);
        $ Upper_dec = ip2long ($ top);
        $ Ip_dec = ip2long ($ ip);
        return (($ ip_dec> = $ lower_dec) & & ($ ip_dec <= $ upper_dec));

We have, however, a complicating factor here – PHP does not do unsigned integer (32 bit) – which would be necessary for this math to work. We can do this by switching to negate floating point datatypes. PHP stores floating species as 64-bit and thus will have no problem with the IPv4 address space (Note – This is obviously not enough for granular 128bit IPv6 addressing). It is the easiest way to solve the start <= IP <= end of problem with IP-and floating numers is the following piece of code:

$ Lower_dec = (float) sprintf ( "% u", ip2long ($ lower));
        $ Upper_dec = (float) sprintf ( "% u", ip2long ($ top));
        $ Ip_dec = (float) sprintf ( "% u", ip2long ($ ip));
        return (($ ip_dec> = $ lower_dec) & & ($ ip_dec <= $ upper_dec));

Next we have the challenge of handing the CIDR netmasks. What we can do is to create a format CIDR IP address / netmask, and calculate the start and end IP addresses of this block and proceed as before – but that would not take a joke – and would mean that I do not really taught by this article.

The method we use here is how the whole world of Internet routers, if a destination IP is in a given CIDR address space. And we receive and dirty with bitmask and bitwise logical operators.

This is a real world example, my web server IP 80.76.201.37 and the netblock in which it resides, is 80.76.201.32/27, how does this all mean?

Well, the / 27 indicates that the first 27 bits of the IP address are the same network and IP address in this network (area) have the same only 27 bits are identical. Bits 28-32 are variable and may be 5 bits of the variation. If you know your binary, so this means, 32 IP addresses. (However, with routing, you can not use the top and bottom of a range of IP addresses, because this special and the network and broadcast addresses. [This is also the reason why a / 31 is not much (except for PPP connections) you can not use the 2-addresses, which gives you room]).

So thinking logically, bitwise, if my IP address and CIDR specification, then all I have to do is verify that the first 27 bits are all involved, and I’m good. Right. How would we do this in PHP? Sounds simple, can only use PHP’s bitwise logical AND operator: &
Also correct.

To achieve this, we need to convert 27 in 27, which really means – a 32-bit number of 27 ones and zeros in binary-5 (which is what really looks like 255,255,255,224).

In pseudo-code that you then do if (IP & bitmask) == (RANGE & bitmask), then everything is good and you know that the IP is in the area.

Visualization of this with our IP address (using the Unix tool very handy ipcalc):

Address: 80.76.201.37 01010000.01001100.11001001.00100101
Netmask: 255,255,255,224 11111111.11111111.11111111.11100000
Wildcard: 0.0.0.31 00000000.00000000.00000000.00011111

Network: 80.76.201.32/27 01010000.01001100.11001001.00100000
HostMin: 80.76.201.33 01010000.01001100.11001001.00100001
HostMax: 80.76.201.62 01010000.01001100.11001001.00111110
Broadcast: 80.76.201.63 01010000.01001100.11001001.00111111
Hosts / Net: 30

You can do this in the wild card line-0.0.0.31, and the network-ored with wildcard results in the broadcast address: 80.76.201.63.

Knowing this, then the IP address ANDed with the network address is the same value as the margin ANDed with the network address and thus can be used as a comparison for an IP Broadcast resident in this area.

How can we network address in PHP, we have two strategies, one is in such a simple substr () and take the left bits of the number pad and then just to the right with 0s. Or we can do some math with “NOT from 2 to the power of the (32-area) – 1″. In order for our value / 27 This gives us the decimal value 31, NOTED results (65536-31) (representation in bit-form – PHP, it is considered a negative whole number, but we do not need to worry about that).

I am sure that from now on, you scream for some code (and if you are stuck in this long, you really deserve it).

Code to manipulate a number / netmask in a broadcast address, with mathematics, provided:

      $ Ip = "80.76.201.37";
      $ Row = "80.76.201.32";
      $ Netmask = 27;

We can change the IP addresses too long integers with ip2long (with variable_dec – December is the abbreviation for decimal):

      $ Range_dec = ip2long ($ range);
      $ Ip_dec = ip2long ($ ip);

This gives us the basis of our mathematics, we need now only to the broadcast address.

Strategy 1 with str_pad to a string by padding with 0s and 1s.

      $ Netmask_dec = bindec (str_pad ('', $ netmask,'1 ')
       . str_pad ('', 32 - $ netmask,'0 '));

We can achieve the same result if the mathematics of NOTtin wildcard value. That is our strategy 2:

      $ Wildcard_dec = pow (2, (32 - $ netmask)) - 1;
      $ Netmask_dec = ~ $ wildcard_dec;

Once we know that the netmask address (decimal), as we have here, we know that if Anding this with the original IP results to check against the margin ANDed with the netmask, the IP is in the area, defined by the range / mask.

This can be done simply with:

      return (($ ip_dec & $ netmask_dec) == ($ range_dec & $ netmask_dec));

I moved all this logic in an easy to make the file to a single function ip_in_range ($ ip, $ range) in which $ ip is the IP address you want to validate and $ field is a one of the above formats , Wild Card, start-end solution or CIDR. The function is a simple TRUE or FALSE, if the IP is in this area.

To test these functions I will use the following string.

$string = 'wibble';

md5()
This function returns the hash as a 32-character hexadecimal number. The md5() function is used quite a bit and most PHP programmers will have come across it at some point.

md5($string);
//returns 50eccc6e2b0d307d5e8a40fb296f6171

The md5() and sh1() functions have a second parameter which makes the function return binary data if set to true (the default is false). This returns binary data, which can be turned back into a hexadecimal number by using the bin2hex() function.

bin2hex(md5($string, true));

This function returns the same as in the previous example.

sha1()
sha1() returns the sha1 hash as a string 40 characters long. This function is more secure than the md5() function as there is a lesser chance of guessing what the original string was.

sha1($string);
//returns 02e0182ae38f90d11be647e337665e67f9243817

The sha1() function can also be made to return binary data if the second optional parameter is set to true.

crc32()
This isn’t really a cryptographic function, but it can be used in a similar way as a string will always come out with the same result. This function returns the crc32 polynomial of a string as an integer.

crc32($string);
//returns 489363548

Because of the way that PHP stores integers (as signed), quite a few of the results of this function will be negative. For example, the string “wibble” will return a positive integer, but the string “wobble” will return a negative number, which must be compensated for. This can be fixed by using the “%u” formatter of the sprintf() function, which will return a string containing the correct integer value.

This hashing function is intended to be used as part of a hash table and not as a mechanism of security. This is because it is very easy to generate a “hash collision” where two separate strings have the same hash value. I include this here to give you that warning.

sprintf("%u", crc32($string));
// returns 489363548

crypt()
The crypt() function will take a string as input and produce a variety of different outputs depending on the current system and environment. The salt is the second parameter and if you don’t include this the function will generate a salt for you, which causes the outcome of the hash to be different every time. An important thing to note is that the value of the salt value effects what hashing algorithm is used. There are a set of constants that can be used if you want to detect if an encryption algorithm is available.

if ( CRYPT_STD_DES == 1 ) {
 crypt($string, 'st');
}
// returns something like "stNPuLMaoIxdU"

If you want to compare a password then you must pass the entire result of crypt() as the salt for a crypt of the password. For example, the following is incorrect.

$one = crypt('one');
$two = crypt('one');
var_dump($one == $two); // returns false

Adding a salt to the second crypt() call gives us the correct answer.

$one = crypt('one');
$two = crypt('one', $one);
var_dump($one == $two); // returns true

As with all hashing functions there is no decrypt function as this is a one way process.

hash()
The hash() function is a multi use function that takes two parameters as a default. The first is the hashing algorithm that will be used and the second is the string to be hashed. To encode the string using the whirlpool algorithm use the following code.

hash("whirlpool&quotl, $string);
// returns 91cefc6cc8eecf3a0ef18889bc3b06e7217ce7d41e1d0d5e37709415c3a98e450c53e62ae57680a011a08ef65429e6ba76701c703fcfc4c63938a4aa61737c38

To find out what hashing algorithms your system supports you can use the hash_algos() function. This returns an array of the available algorithms.

print_r(hash_algos());

If you have haval256,5 available in this list then I suggest you use it as it produces the safest hash value. More information about the hash functions can be found in the hash section of the PHP documentation.

Breaking The Code
It isn’t possible to break a md5 of sha1 encoded string, but this can only be done by trying to guess the original value. The site md5.rednoize.com can break a string that you enter, but only because it contains 47 million hashes and can therefore reverse engineer the value of the hash.

To stop this happening to your passwords you can use what is called a salt value. Rather than directly encode the value of the password you store the password along with a salt, which is kept secret. An attacker needs to know the value of the salt value before they can correctly guess a users password.

image.php;

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

<?php
function createimg () {
session_start();
ini_set("session.gc_maxlifetime","36000");
	$fontnum=6;  //count of fonts
	$numbers = strtoupper(substr(rand(0,999999999999),-3)); 
	$_SESSION["guv"] = $numbers; 
	$im = imagecreatetruecolor(125, 75); 
	$white = imagecolorallocate($im, 255, 255, 255);
	imagefilledrectangle($im, 0, 0, 400, 200, $white); 
	for ($i=0;$i<strlen($numbers);$i++)
		{
			$font = "fonts/".rand(1,$fontnum).".TTF";
 
			if ((rand(2,6)%2)) { $angel=rand(0, 30); } else { $angel=rand(330, 360); }
			imagettfnumbers($im, 25, $angel, 10+$i*35, 49, imagecolorallocate($im, rand(1,250), rand(1,250), rand(1,250)), $font,$numbers[$i]);
		}
	$x=100; $y=100; $size=200;
	header("Content-type: image/png");
	imagepng($im);
	imagedestroy($im);
}
createimg();
?>

You need 6 fonts in ./fonts directory like;
1.TTF
2.TTF
3.TTF
4.TFF
5.TFF
6.TFF

usage example;

1
2
3

<img src="imgcode.php" alt="security" name="guv" id="guv"/>
<!-- and also i made a relod image button here it is; -->
<img src="images/reload.gif" width="16" height="16" border="0" alt="refresh" onclick="i=i+1; document.getElementById('guv').src='imgcode.php?id='+i"/>

Here is the a screen shot;