<!DOCTYPE html>
<!-- ^ Always define a DOCTYPE - Read more about DOCTYPEs on w3c -->
<html>
<head>
    <title>Vulnerability Scanner</title>
    <style type="text/css">
        body {
            color: #ffffff;
            text-shadow: 2px 2px #000000;
            background-color: #282828;
            font-family: Arial, Helvetica, sans-serif;
        }

        pre {
            background-color: #353535;
            border: solid 1px #505050;
        }

        input {
            font-family: Arial, Helvetica, sans-serif;
        }

        .Button {
            padding: 5px 10px;
            background: #303030;
            border: solid #101010 1px;
            color: #fff;
            cursor: pointer;
            font-weight: bold;
            border-radius: 5px;
            -moz-border-radius: 5px;
            -webkit-border-radius: 5px;
            text-shadow: 1px 1px #000;
        }

        .Input {
            border: solid #101010 1px;
            color: white;
            font-weight: bold;
            padding: 3px;
            background-color: #252525;
        }
    </style>
</head>
<body>
    <div align="center">
        <pre>
             _____   _                  _      _          _                          _         _
            |_   _| | |__     ___      / \    | |   ___  | |__     ___   _ __ ___   (_)  ___  | |_
              | |   | |_ \   / _ \    / _ \   | |  / __| | |_ \   / _ \ | |_ ` _ \  | | / __| | __|
              | |   | | | | |  __/   / ___ \  | | | (__  | | | | |  __/ | | | | | | | | \__ \ | |_
              |_|   |_| |_|  \___|  /_/   \_\ |_|  \___| |_| |_|  \___| |_| |_| |_| |_| |___/  \__|
              Vulnerability Scanner                                              www.hackforums.net
        </pre>

        <form method="POST" action="">
            Enter URL : <input type="text" name="url" value="<?php if(isset($_POST['url'])){echo(htmlentities($_POST['url']));}
            else{echo('http://example.com/index.php?id=1');} ?>" size="75" class="Input" />
            <input type="submit" name="submit" value="Scan" class="Button" />
        </form>

        <br />
<?php

//Coded by The Alchemist
//Styled and modified by ande
//Thanks again ande

class VulnScanner {
   // ^   ^    CamelCase.

    // This is a good example, you should NEVER store data in the class that the user is going to want to change. Make a config file, use an XML file etc are all great alternatives.
    protected $types = array(
        'sql' => array('errors' => array("mysql_", "You have an error in your SQL syntax", "SQL Error", "Database Error", "supplied argument is not a valid MySQL result resource"),'vulnerability' => array("'",'"')),
        'rfi' => array('errors' => array("Welcome to Facebook - Log In, Sign Up or Learn More", "failed to open stream: No such file or directory"), 'vulnerability' => array("http://www.facebook.com")),
        'lfi' => array('errors' => array("root:x:0:0:root:", "failed to open stream: No such file or directory"), 'vulnerability' => array("../etc/passwd",
                       "../../etc/passwd",
                       "../../../etc/passwd",
                       "../../../../etc/passwd",
                       "../../../../../etc/passwd",
                       "../../../../../../etc/passwd")),
        'xss' => array('errors' => array("<img src=\"http://owned.com\"/>"), 'vulnerability' => array("'\"/><img src=\"http://owned.com\"/>"))
    );

    public function __construct() {
        // This is good too. We want the user to know that he can't use it before it spits out 2349234982 errors.
        if(extension_loaded('curl')) {
            throw new Exception('cURL must be enabled');
        }
    }
    public function isValid($link) {
                    // ^ You should try loosely following PSR standards (I say loosely because PSR standards are far too strict, even for me.) -- This example is known as "camelCase"
        // Personally, I don't think you even need a function for this. But, this is much cleaner. Research "PHP Ternary" (I say PHP ternary because PHP ternary is different than literally every other langauage)
        return filter_var($link, FILTER_VALIDATE_URL) ? (strstr($link, "=") ? true : false) : false;
    }


    private function getContents($link, $userAgent = 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0') {
                     // Again, camelCase
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_VERBOSE, true);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_USERAGENT, $userAgent);
                                            // Beats storing an unchangeable variable. If it's something that that user may want to change without much hassle, put it in the argument list@
        curl_setopt($ch, CURLOPT_URL,$link);
        $result = curl_exec($ch);
        return $result;
    }

    private function errorCheck($url, $addtourl, $errorar) {
                                // Even if you are documenting your functions, all variable names should be clear. This doesn't mean really long names, but give it short and simple meanings.
        foreach($addtourl as $val) {
            $link = $url.$val;
            $contents = $this->getcontents($link);
            foreach($errorar as $err) {
                if(strstr($contents, $err)) {
                    return true;
                }
            }
        }
        return false;
    }

    // See? Much cleaner! Still lots more do to though...
    public function isVulnerable($url, $type = 'sql') {
        if(!isset($this->types[$type])) {
            throw new Exception('Invalid type: ' . $type);
        } else {
            if($this->errorCheck($link, $this->$type['vulnerability'], $this->$type['errors']) ) {
                echo htmlentities($link) . " <span style=\"color: red;\">might</span> be vulnerable to SQL Injection.<br />";
            } else {
                echo htmlentities($link) . " is probably <span style=\"color: red;\">NOT</span> vulnerable to SQL Injection.<br />";
            }
        }
    }

    public function isSQLVulnerable($link) {
        $orig = $link; // Why'd you do that? VulnScanner::errorcheck did not reference the variable, so making an "original value" variable is redundant.
        if($this->errorcheck($orig,$this->sql,$this->sqlerrors))
            echo htmlentities($orig) ." <span style=\"color: red;\">might</span> be vulnerable to SQL Injection.<br />";
        else
            echo htmlentities($orig) ." is probably <span style=\"color: red;\">NOT</span> vulnerable to SQL Injection.<br />";
    }
}



if(isset($_POST['url']) && isset($_POST['submit'])) {
    $obj = new VulnScanner();
    $link = $_POST['url'];
    if($obj->isValid($link)) {
        $obj->isVulnerable($link, 'sql'); // ta-da!
    } else {
        echo "<span style=\"color: red;\">". htmlentities($link) ." is not a valid link.</span>";
    }
}
?>
</body>
</html>