Virtual Keyboard Login – Version wicked.evil [avoid screenshots]
Mon, 28th Jul, '08
Ok, so we had virtual keyboards for some time on login pages being served worldwide. In fact so long that we had this. So we have virtual keyboards here again, and some smartness, some.
Earlier in this blog we covered some crypt way to send passwords to the server from the browser, and thanks to the response, i feel motivated enough. Now we are onto making a virtual keyboard, and yeah, this is a proof-of-concept and you are free to take it to the moon alongwith you.
We are just going to blank out all buttons just before the user is going to click on one. Basically do a backgroundColor = fontColor on all buttons to make it difficult what is written on the buttons on mouseover and restore on mouseout. Normally a user figures out which button to click on and then positions the mouse on the button and clicks, so if the button is showing what is written on it, definitely some proof-of-concept program can take a snapshot of the web page to figure out which button was clicked on. We are just going to wipe the face of the button off. For some more fun, we are going to randomize the order of buttons at will by calling randomizekeys() and supplying the order of the keys as an argument. And yeah, the styling class is closely tied to the javascript functions, so keep that in mind while playing with styles or the javascript. So here we go[look at the onload handler in the body tag] …
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=iso-8859-1">
<title>Virtual Login Panel</title>
<style>
.loginnumkey {
background:#000;
color:#FFF;
padding:5px 0 5px 0;
min-width:40px;
font-size:16px;
font-family:tahoma;
margin:1px;
}
</style>
<script>
function randomizekeys(assigncode, numkeysclass)
{
var j = 0;
var els = document.getElementsByTagName('input');
var elsLen = els.length;
var pattern = new RegExp('\\b'+numkeysclass+'\\b');
for (var i = 0; i < elsLen; i++)
{
if ( pattern.test(els[i].className) && j < assigncode.length)
{
els[i].value = assigncode[j];
j++;
}
}
}
function keysoff(numkeysclass)
{
var i = 0;
var els = document.getElementsByTagName('input');
var elsLen = els.length;
var pattern = new RegExp('\\b'+numkeysclass+'\\b');
for (i = 0; i < elsLen; i++)
{
if ( pattern.test(els[i].className) )
{
els[i].style.backgroundColor = '#FFF';
}
}
}
function keyson(numkeysclass)
{
var i = 0;
var els = document.getElementsByTagName('input');
var elsLen = els.length;
var pattern = new RegExp('\\b'+numkeysclass+'\\b');
for (i = 0; i < elsLen; i++)
{
if ( pattern.test(els[i].className) )
{
els[i].style.backgroundColor = '#000';
}
}
}
function clicknumkey(inputid, inputvalue)
{
document.getElementById(inputid).value =
document.getElementById(inputid).value + inputvalue;
}
</script>
</head>
<body onload="javascript:randomizekeys('1095673824', 'loginnumkey');">
<input type='text' id='passwordbox'>
<br><br>
<input type='button' id='lkey1' value='1' class='loginnumkey'
onclick="javascript:clicknumkey('passwordbox', this.value);"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
<input type='button' id='lkey2' value='2' class='loginnumkey'
onclick="javascript:clicknumkey('passwordbox', this.value);"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
<input type='button' id='lkey3' value='3' class='loginnumkey'
onclick="javascript:clicknumkey('passwordbox', this.value);"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
<br>
<input type='button' id='lkey4' value='4' class='loginnumkey'
onclick="javascript:clicknumkey('passwordbox', this.value);"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
<input type='button' id='lkey5' value='5' class='loginnumkey'
onclick="javascript:clicknumkey('passwordbox', this.value);"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
<input type='button' id='lkey6' value='6' class='loginnumkey'
onclick="javascript:clicknumkey('passwordbox', this.value);"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
<br>
<input type='button' id='lkey7' value='7' class='loginnumkey'
onclick="javascript:clicknumkey('passwordbox', this.value);"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
<input type='button' id='lkey8' value='8' class='loginnumkey'
onclick="javascript:clicknumkey('passwordbox', this.value);"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
<input type='button' id='lkey9' value='9' class='loginnumkey'
onclick="javascript:clicknumkey('passwordbox', this.value);"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
<br>
<input type='button' id='lkey0' value='0' class='loginnumkey'
onclick="javascript:clicknumkey('passwordbox', this.value);"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
<input type='button' id='lkeyclear' value='reset' class='loginnumkey'
onclick="javascript:document.getElementById('passwordbox').value='';"
onmouseover="javascript:keysoff('loginnumkey');"
onmouseout="javascript:keyson('loginnumkey');">
</body>
</html>
This may not work in IE, I mean this code snippet. If you want to make it work, just fiddle with i, j declarations in the function randomizekeys(), like moving them around in the function.
Animate this …
Fri, 20th Jun, '08
In a javascript world ruled by prototype and scriptaculous, all visual effects & animations in web pages are effected by them. But DIY still means Do-It-Yourself. Lets waste no time smelling the perfume and cut to the flesh …
function animateThis(fxargs, fxtp)
{
var fxargsstr = ”, argseparator = ”;
var fxname = fxargs.callee.toString();
fxname = fxname.substr(‘function ‘.length);
fxname = fxname.substr(0, fxname.indexOf(‘(‘));
for(var i = 0; i < fxargs.length; i++)
{
fxargsstr = fxargsstr + argseparator + “‘” + fxargs[i] + “‘”;
argseparator = ‘,’;
}
fnstr = fxname +’(‘+fxargsstr+’)';
setTimeout(fnstr, fxtp);
}
What is that?? Hmmm … I guess I am seeing settimeout on steroids. Put:
animateThis(arguments, <a span of your choice measured in milliseconds>);
in a function body and that function gets called every that many milliseconds with the exact argument set supplied to it as was supplied when the function was first called. So a Fade-In function in javascript using this function would look like this:
function fadeIn(elementID)
{
var el = document.getElementById(elementID);
var opac = el.style.opacity; //read the current opacity value of the target element
if(opac < 1) //if not reached full opacity
{
opac = parseFloat(opac) + 0.05; //increase the current opacity value
el.style.opacity = opac.toString();
animateThis(arguments, 20); //call this function every 20 milliseconds
}
}
and just call this on a div with opacity set as 0 and an ID of lets say ‘testdiv’, with something like:
<a href=’#’ onclick=”javascript:fadeIn(‘testdiv’);”>bring in</a>
and see the div come into view. Geekness.
The example will only work on Firefox but the function animateThis() has been tested on FireFox 2-3, IE 6-7, Safari, Opera. In case you find some issue, tell me and I will have things set right.
And yeah, CS students, this is not recursion. This is a timer.
Add content dynamically as you reach end of page with AJAX
Thu, 27th Dec, '07
You have a search page and as the results end you show a navigation bar with links to the other pages of the search. So boring. Seriously. This is the Web, and I am still turning pages.
And I think I am Pied Piper who will save you from this hell. The uber-cool solution is, detect as soon as a user is about to reach the end of the page and get new content[the second page of the search], just in time. Setting out, we need:
The height of the current document. So to this end, we will place a div with a decided upon ID at the end of the page. And all the content in the body will be loaded in another div just above this last div. We are detecting the document height by detecting where this ending div is located, pixel-wise, with this:
pageend = document.getElementById(‘laststop’).offsetTop;
So clearly, the ID of the last div is ‘laststop’. Next we need the screen resolution of the client window to find out how much of the document is visible right now. We do:
winheight = (typeof window.innerHeight != ‘undefined’ ? window.innerHeight : document.body.offsetHeight);
Now having this much, we need to detect when does the user scroll the page to the bottom. The following lines will give exactly how many pixels from the top have you scrolled to. Note that, this is the ‘height’ from the top of the document to the top of the visible area. The real end of the document is obtained by adding this ‘height’ and the window height retrieved earlier.
if(navigator.appName == “Microsoft Internet Explorer”)
alert(document.body.scrollTop);
else
alert(window.pageYOffset);
But these lines need to be run every few seconds to check as soon as as the user reaches the end of the current page. So we will do a setInterval() in the onload event of the body to do so. And keep the interval time to something a little over 2 seconds and nothing less than that, you of course don’t want your user’s browser to hang on them. It is annoying.
Said and done, this is what you end up with, demofile.php, annotated with explanatory comments:
<html>
<head>
<title>Page End Reached Detection Demo</title>
<script type=”text/javascript”>
var oRequest;
var pageend, winheight;
var howoften = 2000;
// this value implies that function howlow() will keep checking every
// 2000 milliseconds(2 seconds) to find out how low is the user on the page
var bufferHeight = 300;
// adjust bufferHeight, to take action as soon as the user is within these
// many pixels of the end of the page, so a larger buffer makes sure the user doesn’t
// see the dynamic page content loading. In this example, the script will fetch content
// as soon as you are within 200 pixels of the end of the page
// ooooo, ajax. ooooooo …
if(window.XMLHttpRequest)
oRequest = new XMLHttpRequest();
else if(window.ActiveXObject)
oRequest = new ActiveXObject(“Microsoft.XMLHTTP”);
function sendAReq()
// a generic function to send away any data to the server
// specifically ‘morecontent.php’ in this case, to get more content from the server
// all content fetched will be handled by showcontent()
{
oRequest.open(“POST”, “morecontent.php”, true);
oRequest.setRequestHeader(“Content-Type”, “application/x-www-form-urlencoded”);
oRequest.onreadystatechange = showcontent;
oRequest.send(null);
}
function showcontent()
{
if(oRequest.readyState == 4)
{
// now all the data that comes adds to the end of the page, specifically
// to the container div referenced with the ID ‘bodycontent’
if(oRequest.status == 200)
document.getElementById(‘bodycontent’).innerHTML = document.getElementById(‘bodycontent’).innerHTML + oRequest.responseText;
else
alert(‘No Response from Server. Try Again Later.’);
}
}
function calcParams()
{
// calculate the end coordinates of the page and the visibile height of a page
// at any time on the client’s desktop
pageend = document.getElementById(‘laststop’).offsetTop;
winheight = (typeof window.innerHeight != ‘undefined’ ? window.innerHeight : document.body.offsetHeight);
}
function isitend(curpos)
{
calcParams();
if((curpos + winheight + bufferHeight) > pageend)
{
alert(‘you are reaching the end of the page;’);
sendAReq();
}
else
{
alert(‘keep going’);
}
}
function howlow()
{
if(navigator.appName == “Microsoft Internet Explorer”)
isitend(document.body.scrollTop);
else
isitend(window.pageYOffset);
}
</script>
</head>
<body onload=”javascript:setInterval(‘howlow()’,howoften);”>
<div id=’bodycontent’>
<?php
for($index=0; $index<200; $index++)
echo ‘Line:’.$index.’<br>’;
?>
</div>
<div id=’laststop’/>
</body>
</html>
Oh and yeah, this sends a request using the XMLHttp object so we need another php file at the server to catch the request and send in additional content. This additional content will be appended to the div with ID ‘bodycontent’. So here is morecontent.php
<?php
for($index = 0; $index < 100; $index++)
echo ‘We Are New Lines:’.$index.’<br>’;
?>
That’s about it. Please do throw in your experiences with this in the comments section below and I will surely respond. I am jobless.
Preparing a secure login form with PHP & JavaScript
Wed, 26th Dec, '07
We have had encryption, we have had SSLs, … well we also had digitally signed certificates, but where’s the hack?? How can you cook up a secure login form that does the following:
[1] doesn’t send the login information in clear-text
[2] in case somebody is sniffing the line, he/she shouldn’t be able to login with the sniffed information
So, with the above information in hand, here is what we do, and how we do.
You need:
[1] http://www.webtoolkit.info/javascript-md5.html [javascript implementation of MD5]
[2] Two php functions. runquery($query) , which will run a query supplied as string & getcol($query) will get the column asked for in a select statement.
Now, create a table, if you don’t already have, to store user information. What we do want to be stored is the login timestamp.
create table user(
loginid varchar(200),
password varchar(200),
lastLoginTS bigint
);
Now your login.php file should look like this:
<html>
<head>
<title>Secure Login Form</title>
<script type=”text/javascript” src=”md5.js”></script>
</head>
<body>
<form action=”dologin.php” method=”post” onsubmit=”javascript:document.getElementById(‘phash’).value = MD5(document.getElementById(‘password’).value + document.getElementById(‘hts’).value); document.getElementById(‘password’).value = ” ;”>
LoginID: <input type=”text” name=”loginid”><br>
Password: <input type=”password” name=”password” id=”password”><br>
<?php
$TS = time(); //the current timestamp
echo “<input type=’hidden’ value=’”.$TS.”‘ name=’hts’ id=’hts’><br>”;
?>
<input type=’hidden’ name=’phash’ id=’phash’ value=”>
<input type=”submit” value=”send”>
</form>
</body>
</html>
This file assumes in the line “<script type=”text/javascript” src=”md5.js”></script>” that you have a file named md5.js in the same directory as login.php, and the javascript file should have a function named MD5(). So make sure this is the case. Next up is dologin.php:
<?php
$loginid = $_REQUEST['loginid'];
$phash = $_REQUEST['phash'];
$hts = $_REQUEST['hts'];
$password = getcolumn(“select password from user where loginid=’$loginid’;”);
$lastLoginTS = getcolumn(“select lastLoginTS from user where loginid=’$loginid’;”);
if(strlen($loginid) > 0 && strlen($phash) > 0 && $phash == md5($password.$hts) && $hts > $lastLoginTS)
{
runquery(“update user set lastLoginTS=’”.time().”‘ where loginid=’$loginid’;”);
echo “done”;
}
else
echo “failed”;
?>
That’s it. So now what is the deal here. This is your regular login form except that the password is hashed with a timestamp value sent in a hidden form field named ‘hts’. The hashing is done in the event handler for the Javascript onsubmit event, and the password field is cleared as well, to prevent it from being sent in the clear.
The server receives the loginid, timestamp and the hashed value from the client. Retrieve from your database the original password for the loginid specified and calculate another hash at the server with the help of the retrieved original password and the timestamp sent by the client. If the user typed the password correctly, the hashes will match.
This method of course, sort of, encrypts the password and hence prevents the password from being sent in clear, should anybody be sniffing the lines. But should anybody be really sniffing the lines, he/she can just store the values and send them again and again to validate him/herself at the server posing as the valid user. To prevent that, there is another check at the server just before validating. The timestamp sent by the client should be always greater than the last login timestamp stored in the database for that user. Since the last login timestamp is only updated on a successful login, as soon as a valid user logs in, the last login timestamp for the user is updated in the database, and as a result, the sniffed information is rendered stale. The hash now needs to be calculated again using a fresh timestamp and a password which only the user and server know.
I hope this suffices for most of you out there.
UPDATE : This is a proof of concept. The system described here lacks certain things which are very obvious and shouldn’t omit them just because I haven’t mentioned them here to make it simple to grasp. Foremost[thanks William], don’t store passwords in cleartext on the server. Try looking up “hashing password with salts” for that.
How long do your users stay on a page??
Tue, 25th Dec, '07
So … here’s the real deal into measuring how much time a user spends on each individual page by url, and measured in milliseconds.
[1] As soon as page loads, set the current time in a variable in javascript with the help of the onload event. Let this variable be called tstart.
[2] On the unload event, get the current timestamp, and subtract from this the starting timestamp, the first one. So tTotal = tend – tstart.
[3] Now send this time information alongwith location.href to your server, which will record this in a log file, or database to use later, maybe to serve relevant content by keeping in mind a users viewing and browsing patterns.You get the picture right.
So here are the files. Just store monitorme.html & logtimefile.php somewhere on your server and create a writeable file in the same directory named as timelog.txt. Now get monitorme.html and now refresh your page, navigate away to some other page or just plain close the window to find your timelog.txt file piling up with times you spent on the page.
monitorme.html
<html>
<head>
<title>Duration Logging Demo</title>
<script type=”text/javascript”>
var oRequest;
var tstart = new Date();
// ooooo, ajax. ooooooo …
if(window.XMLHttpRequest)
oRequest = new XMLHttpRequest();
else if(window.ActiveXObject)
oRequest = new ActiveXObject(“Microsoft.XMLHTTP”);
function sendAReq(sendStr)
// a generic function to send away any data to the server
// specifically ‘logtimefile.php’ in this case
{
oRequest.open(“POST”, “logtimefile.php”, true); //this is where the stuff is going
oRequest.setRequestHeader(“Content-Type”, “application/x-www-form-urlencoded”);
oRequest.send(sendStr);
}
function calcTime()
{
var tend = new Date();
var totTime = (tend.getTime() – tstart.getTime())/1000;
msg = “[URL:" location.href "] Time Spent: ” totTime ” seconds”;
sendAReq(‘tmsg=’ msg);
}
</script>
</head>
<body onbeforeunload=”javascript:calcTime();”>
Hi, navigate away from this page or Refresh this page to find the time you spent seeing
this page in a log file in the server.
</body>
</html>
logtimefile.php
<?php
function logtimemsg($timemsg)
{
//write your own handling code here, store it in a file or store it in a DB, whatever
$logfilename = ‘timelog.txt’;
if (is_writable($logfilename))
{
if (!$handle = fopen($logfilename, ‘a’))
{
exit;
}
if (fwrite($handle, $timemsg.”\r\n”) === FALSE)
{
exit;
}
fclose($handle);
}
}
logtimemsg($_REQUEST['tmsg']);
?>
UPDATE: People, I love if anyone of you writes back, even if to tell that this doesn’t work. Thanks to JayVee who pointed that <body onunload=”> sucks compared to <body onbeforeunload=”> for this post. Change accomodated.
Automatic Javascript Bug Reporting Using AJAX
Mon, 24th Dec, '07
I spend a considerable time debugging errors, and being a Web developer spans debugging CSS, JS and server end files as well. Often I find myself rolling up and down scrollbars on MySQL manual pages.
It annoys me no end to find that a user is seeing Javascript errors. And since Javascript being something that browsers have been trusted with, they had a field day unsupporting it. So it is very common to find that what you think is OK on browser1 is NOT_OK on browser2. And worse still, this incompatibility is reported by someone who is seeing a webpage on a live setup, a user or someone who least expects a nasty bug or something.
Now try this, save this as something.html on your server:
<html>
<head>
<title>Auto JS Bug Reporting Demo</title>
<script type=”text/javascript”>
var msg = null;
var opdiv;
var oRequest;
// ooooo, ajax. ooooooo …
if(window.XMLHttpRequest)
oRequest = new XMLHttpRequest();
else if(window.ActiveXObject)
oRequest = new ActiveXObject(“Microsoft.XMLHTTP”);
onerror = handleErrors;
function handleErrors(errorMessage, url, line)
{
msg = “[URL:" url ", line no.: " line "] ERROR: ” errorMessage;
sendAReq(“err=” msg, ‘errdiv’);
return true;
}
function sendAReq(sendStr, odiv)
// a generic function to send away any data to the server
// specifically ‘handleerror.php’ in this case
// what the server replies is handled by showcontent()
{
opdiv = odiv;
oRequest.open(“POST”, “handleerror.php”, true); //this is where the stuff is going
oRequest.onreadystatechange = showcontent;
oRequest.setRequestHeader(“Content-Type”, “application/x-www-form-urlencoded”);
oRequest.send(sendStr);
}
function showcontent()
{
if(oRequest.readyState == 4)
{
// if the output is ready, print it to the div as set by the caller function
// in this case, the opdiv, the output div, was set to ‘errdiv’ in handleErrors(…)
if(oRequest.status == 200)
document.getElementById(opdiv).innerHTML = oRequest.responseText;
else
document.getElementById(opdiv).innerHTML = “<font color=#FF3300 > Try Again Later </font>”;
}
}
</script>
</head>
<body onload=”javascript:wow();”>
<div id=”testdiv”>
I am a div. Press this button to cause an error.<br>
<input type=”button” onclick=”javascript:sendAReq(‘err=hello, ‘errdiv’);” value=”GET some FUN”>
</div>
<div id=”errdiv”>
</div>
</body>
</html>
So this file has two Javascript errors. One is in the body onload function, which calls a nonexistent function, wow() . And the other is caused in the onclick event of the only input button on this page.
So this page is easy in the way that …
[1] It assigns handleErrors as the default error handler in the line onerror=handleErrors ;
[2] It puts together a error report in handleErrors and then calls sendAReq with the report string and the name of the output div, in this case being ‘errdiv’.
[3] sendAReq sends the error report to handleerror.php and sets the output div dutifully to ‘errdiv’ in the first line itself. The output div we keep referring to here is the div to which the server will send the output. Oh … so you looking for handleerror.php??
<?php
function logerr($errmsg)
{
//write your own handling code here, store it in a file or store it in a DB, whatever
$errfilename = ‘jsbugs.txt’;
if (is_writable($errfilename))
{
if (!$handle = fopen($errfilename, ‘a’))
{
exit;
}
if (fwrite($handle, $errmsg.’\r\n’) === FALSE)
{
exit;
}
fclose($handle);
}
}
logerr($_REQUEST['err']);
echo “I got this: “.$_REQUEST['err'];
?>
[4] So handleerror.php gets the error report Javascript compiled and stores it in a file named jsbugs.txt. make sure you have a file created already named jsbugs.txt with write permissions before you run this script. Should you want to do more fancy things, you can store the User-Agent string, timestamp and a lot more things in a database maybe. I leave that to you.
So now, you are ready with something.html about to be fetched in your browser, and handleerror.php copied in the web root directory and jsbugs.txt in the same directory as well, with write permissions.
Now get something.html and you should see your jsbugs.txt file piling up with cute strings, which may later turn up to be sleep-stealing, girlfriend-eating monsters.




