Has my file been hacked? What is this

Factual Questions
1

A week or so ago I asked (and recieved, thank you) for some help regarding some beginning php I was working on.

I’m building this on a host I pay for, but that has nothing particularly important on it. I haven’t worried too much about security because I don’t care that much.

However.

It does irk me immensely when I feel like I’ve been tresspassed upon, and I think that might be the case.

Basically, today I wanted to work some more on a page I’ve been creating that uses php to upload a file. I went to the page itself and decided to view source. I saw this:

<iframe style=“visibility: hidden; width:0px; height:0px; border:0px” src="/gewdawbewc/fuck.html"></iframe>

… as the very first item in the body.

I sure as heck didn’t code it, but when I look at the actual source in an editor, there’s nothing in the php that looks like it would generate that either.

My php is:



<?php

ini_set ('display_errors', 1);
error_reporting (E_ALL & ~E_NOTICE);

if (isset ($_POST['submit'])) { //Handle form.

// Try to move the uploaded file.
if (move_uploaded_file ($_FILES['thefile']['tmp_name'], "../uploads/{$_FILES['thefile']['name']}")) {
	print '<p>Your file has been uploaded.</p>';
	
} else { // Problem!

	print '<p>Your file could nto be uploaded because <b>';
	
	// Print a message based on the error.
	switch ($_FILES['thefile']['error']) {
		case 1:
			print 'The file exceeds the upload_max_filesize setting in php.ini';
			break;
		case 2:
			print 'The file exceeds the MAX_FILE_SIZE setting in the HTML form';
			break;
		case 3:
			print 'The file was only partially uploaded';
			break;
		case 4:
			print 'No file was uploaded';
			break;
	}
	print '</b>.</p>';
	}
}  //  End of SUBMIT IF
?>

… followed by a simple html form. Yet when I open the page in my browser and ‘view source,’ I see that <iframe> tag.

Does anyone have any idea what gives here?

2

You didn’t borrow code from any other websites? If not, have you checked to see if a file exists on yourserver/gewdawbewc/fuck.htm

If theres no file there, then theres nothing much to worry about. Of course you should also be able to check the access logs from your host to verify that only you have been logging in.

3

Nope, I did the code by hand, and the path indicated doesn’t exist.

I’m also wondering where the heck that iframe comes from, if I can’t see it when I look at the source file. It seems like there’s no way for it to be there, as the page looks just like I coded it.

Good idea re: the log. I’ll do that.