alekseyev/xssable.php

## xssable.php
<!DOCTYPE html>
<html>

<head>
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" integrity="sha384-1q8mTJOASx8j1Au+a5WDVnPi2lkFfwwEAa8hDDdjZlpLegxhjVME1fgjWPGmkzs7" crossorigin="anonymous">
</head>

<body>

<div class="container">
    <h1>Welcome to Lyosha's super duper message board!!!</h1>

    <?php
    $name = $_COOKIE['name'];

    if (!$name) {
        $name = $_REQUEST['name'];
        if (!$name) {
            ?>
            <form action="/" method="post">
            <div>
            Your name: <input type="text" name="name">
            </div>
            <input type="submit" name="submit" value="Hello!" />
            </form>
            <?php
        } else {
            setcookie("name", $name, time() + 3600);
        }
    }

    if ($name) {
    ?>

        <form action="/" method="post">
            <div>
            <textarea name="message" cols=80 rows=10></textarea>
            </div>
            <input type="submit" name="submit" value="Post your post!" />
        </form>

    <?php
    }

    $message = $_REQUEST['message'];

    if ($message) {
        $f = fopen('messages.txt', 'a');
        fwrite($f, "<hr>\n");
        fwrite($f, "<b>$name</b> writes: <br>\n");
        fwrite($f, $message . "\n");
        fclose($f);
    }
    ?>

    <?php include 'messages.txt'; ?>
</div>

</body>
</html>
	<!DOCTYPE html>
	<html>

	<head>
	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" integrity="sha384-1q8mTJOASx8j1Au+a5WDVnPi2lkFfwwEAa8hDDdjZlpLegxhjVME1fgjWPGmkzs7" crossorigin="anonymous">
	</head>

	<body>

	<div class="container">
	<h1>Welcome to Lyosha's super duper message board!!!</h1>

	<?php
	$name = $_COOKIE['name'];

	if (!$name) {
	$name = $_REQUEST['name'];
	if (!$name) {
	?>
	<form action="/" method="post">
	<div>
	Your name: <input type="text" name="name">
	</div>
	<input type="submit" name="submit" value="Hello!" />
	</form>
	<?php
	} else {
	setcookie("name", $name, time() + 3600);
	}
	}

	if ($name) {
	?>

	<form action="/" method="post">
	<div>
	<textarea name="message" cols=80 rows=10></textarea>
	</div>
	<input type="submit" name="submit" value="Post your post!" />
	</form>

	<?php
	}

	$message = $_REQUEST['message'];

	if ($message) {
	$f = fopen('messages.txt', 'a');
	fwrite($f, "<hr>\n");
	fwrite($f, "<b>$name</b> writes: <br>\n");
	fwrite($f, $message . "\n");
	fclose($f);
	}
	?>

	<?php include 'messages.txt'; ?>
	</div>

	</body>
	</html>