Help, someone hacked into our guestbook

Ricky Fan Are you uploading the whole folder? Or just the files themselves. If you are uploading the whole folder then that is wrong. Just upload the files in the folder.

Yes I was uploading the whole folder. What's the difference between uploading the whole folder and only uploading the files contained within?

Are there only certain files that I should be uploading?

Thanks for taking the time.

Have now re-instated my old 2.2 guestbook, while I try to solve this problem.

Will upload a second copy of it uing WSFTPro. Call it conversation1

Then the gbookphp.zip that I downloaded, I open in WS... and select each individual file including those in the subfolders and overwrite the original 2.2 contents with them. Right?

Then I make sure that tmp and public fiolders are 777. Right?

Then I open admin folder and edit the admin/config.inc.php file as shown in the page: http://proxy2.de/forum/viewtopic.php?t=3654

So:
$GB_DB["dbName"] = "databasename";
$GB_DB["host"] = "localhost";
$GB_DB["user"] = "databaseusername";
$GB_DB["pass"] = "databasepassword";

Should be changed to:
$GB_DB["dbName"] = "conversation1";
$GB_DB["host"] = "localhost"; *Does this stays as localhost or do I type something here?*
$GB_DB["user"] = "my admin username goes here";
$GB_DB["pass"] = "my admin password goes here";

Then further down where it says:
$GB_PG["base_url"] = "http://www.yoursite.com/guestbook";
$DB_CLASS = "mysql.class.php";
$TEC_MAIL = "email@yoursite.com";
$GB_UPLOAD = "public";
$GB_TMP = "tmp";

This changes to:

$GB_PG["base_url"] = "http://www.rickynelson.co.uk/conversation1";
$DB_CLASS = "mysql.class.php";
$TEC_MAIL = "email@yoursite.com"; *Change this to my e-mail*
$GB_UPLOAD = "public";
$GB_TMP = "tmp";

Is that right or should I be entering the same details as on my previous 2.2 admin/config.inc.php file

I have tried both.

Then I either download upgrade.zip or install.zip (which one should I be using?) Then which ever one it is I overwrite that into the folder conversation1

Then I go to either
www.rickynelson.co.uk/conversation1/install.php

or

www.rickynelson.co.uk/conversation1/upgrade.php (which one)

And then follow instructions

I can get to an area in install.php where it askes me for the info needed and then there are two choices
Create Table

Create New DB Table

Is this right and if so which should I be clicking
(Neither work mind!)

I know I'm doing something wrong (possibly several)
It shouldn't be this difficult.
Have searched the forum but still stuck.
Thanks for your help

Why not stick with 2.2? would be a lot less hassle I think lol.

I am happy to do that, but my concern is the risk of getting hacked again.
I have disabled HTMl code, is that going to be enough do you think?

so long as you have applied my patch as well you will be fine.

I hate to say this, but...

No I haven't applied your patch, how do I do that and where can I get it.
A link to an answer would be fine as I hate to put you to even more trouble.

http://www.carbonize.co.uk/Board/viewtopic.php?t=20

It is also in this forum but I am trying to steer people away from here.

Hi I have done this,
Thanks so much for your help, both of you. Really did appreciate you holding my hand like this.

Fingers crossed all will be well now.

Sorry to write again, but I am now in an admin loop that I can't get out of. I seem to have a mixture of 2.2 and 2.3.1 files in my guestbook.
I have spent a couple of hours checking out the other posts, but no real joy. Any suggestions?
Besides shooting myself in the head?

I have tried my password and user name to log onto admin section on my guest book and can not logon

I check the =
if (!get_magic_quotes_gpc()) {
$username = addslashes($username);
$password = addslashes($password);
and that is in there,
some help would be nice if someone could point me in right direction to get this problem solves

http://www.countrymods.com/gb/index.php

webmaster at countrymods.com

http://proxy2.de/forum/viewtopic.php?t=3563

I still can't get in

I did install the password lock and added the line in the admin.php

got it

got it