SMS Relay for LetsLunch in Only 99 Lines of Code
You are on your way to a lunch with another hacker that you arranged through LetsLunch.com. You receive a SMS message from the person you are meeting: “Hi, I’m early, so I already grabbed a table. Look for me in the back.”
SMS are just plain convenient for sharing those kinds of notifications. And now, after writing 99 lines of code, LetsLunch lets you exchange SMS with the person you are scheduled to meet, without having to know their phone number. It’s magic!
How does it work? You text the LetsLunch number. Caller ID tells us who you are. We look up who you are having lunch with, and simply forward them your message. The best part is that if they text back, it works seamlessly: their answer gets forwarded to you exactly the same way.
This “gateway” is live on the day of your lunch. Another week, for another lunch, you just text the same number, and it is correctly forwarded to the person you are meeting that day.
How much simpler could it get?
It’s great for privacy — you don’t share your cell phone with anyone. It’s convenient.
PS: Thank you Twilio, they have a great platform, it was a breeze to implement: 99 lines of code, 3333 Bytes. I’m not making those numbers up.
PPS: we’re looking for a php developer. Contact us if you want to join a fun startup right when it starts!
Check out those snippets of code:
$name = $_REQUEST['From'];
$sql = "SELECT ..."; // Find the lunch pair base on who sent the sms
$client = new TwilioRestClient($AccountSid, $AuthToken);
$response = $client->request("/$ApiVersion/Accounts/$AccountSid/SMS/Messages",
"POST", array(
"To" => $cell,
"From" => $LETSLUNCHMAGICNUMBER,
"Body" => "From $fromName: " . $_REQUEST['Body']
));
if(!$response->IsError)
{
header("content-type: text/xml");
echo "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n";
echo "<Response><Sms>Your message was forwarded to {$name}.</Sms></Response>";
}
SQL injection, anyone? Unless these are just “examples” and not actual snippets…n
Where do you see a SQL injection possibility? Especially given that I don’t show the exact code in the SQL statement (of course we use BindParam, not dumb string concat).
By the way, not meant as an attack, just something I always notice when I see it – inline use of a Array variable without having it sanitized…
Fair enough. That particular code is safe (we don’t show it all), but it’s still a bad habit. Sometimes I wish php had more built-in features that would help beginners avoid obvious mistakes.
Agreed!n
Agreed. Not!nnLanguage, like a knife, can be used in various contexts. Just because PHP is popular and easy to start with doesn’t require it to be idiot proof. And even if it would have more security “features” it wouldn’t suffice for correct coding discipline.
Having more features and using good coding discipline are not mutually exclusive. You fail.