Anonymous Proxy with PHP

<?php
$user = "xxxxxx";
$pass = "xxxxxxx";


// Tango with the user input
$luser = $_COOKIE['user'];
$lpass = $_COOKIE['pass'];

if(!$luser|!$lpass) {
    $luser = $_POST['user'];
    $lpass = $_POST['pass'];
    setcookie('user', $luser);
    setcookie('pass', $lpass);
    if(!$luser|!$pass) {
        echo "<form method='post'><input type='text' name='user'><br><input type='password' name='pass'><br><input type='submit' value='auth!'></form>";
        exit;
        }
    }

// Authenticate
if(($user != $luser)|($pass != $lpass)) {
    setcookie('user');
    setcookie('pass');
    die('wrong pass and shit');
    }

// Do we have an url?
if(!$_GET['url']) {
    echo "<form><input type='text' name='url' value='http://'><input type='submit' value='Gogo!'></form>";
    exit;
    }

// Do some initialization, fetching
$url = urldecode($_GET['url']);
$url_bits = parse_url($url);
// For rewriting
$host = $url_bits['host'];
$path = $url_bits['path'];
// Since some web browsers actually support spaces in urls, there are some
// websites that have them as well (edge forums :). Let's be graceful about
// those. no reason to comply with the rfcs, is there?
$url = str_replace(' ', '%20', $url);

// only http requests
if($url_bits['scheme'] != 'http')
    die("HTTP only. For now at least.");

// Get the web resource
if(($connection = @fopen($url, 'r')) === FALSE) {
    die("404 or similar. page can't be opened");
    }
$content = '';
while (!feof($connection))
    $content .= fread($connection, 8192);

// Get content-type from headers
foreach($http_response_header as $header)
    ereg('content-type: ([^;]*)', strtolower($header), $regs);
$ctype = $regs[1];

// If it should prove to be neccessary, do some content-type guessing with mime
// magic shit or file name.. doesnt look to important since most servers always
// specify content-type.

fclose($connection);

// Rewrite 'href=', 'src=', 'action='
if($ctype == 'text/html') {
    // This obviously isn't very elegant.. will be cutting the conent
    // and doing rewriting piece by piece
    $pose = 0;
    $pos = 0;
    $content_rewritten = '';
    // Find a new tag
    while(($pos = strpos($content, '<', $pose)) !== FALSE) {
        // Add everything between this and the last tag
        $content_rewritten .= substr($content, $pose, $pos - $pose);
        // Get content of this tag
        $pose = strpos($content, '>', $pos);
        $cont = substr($content, $pos, $pose - $pos);
        
        // Find possible urls and rewrite them
        $link = '';
        eregi('(((href)|(src)|(action)) ?= ?[\'"]?)([^\'" >]*)', $cont, $link);
        if($link[1])
            $cont = ereg_replace($link[1] . slashreg($link[6]), $link[1] . rewrite($link[6]), $cont);
            
        // Write the tag to the content
        $content_rewritten .= $cont;
        $pos = $pose;
        }
    // Write the end of content and make it actual
    $content_rewritten .= substr($content, $pose);
    $content = $content_rewritten;
    }

// Cough it out
echo $content;

// This rewrites the different urls
function rewrite($url) {
    global $host, $path;
    if(strtolower(substr($url, 0, 7)) == 'http://') {
        $url = urlencode($url);
        }
    else if(strtolower(substr($url, 0, 11)) == 'javascript:') {
        return $url;
        }
    else if(substr($url, 0, 1) == '/') {
        $url = urlencode('http://' . $host . $url);
        }
    else {
        $url = urlencode('http://' . $host . '/' . ereg_replace('/?(.*)/.*', '\\1/', $path) . $url);
        }
    
    return 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['SCRIPT_NAME'] . '?url=' . $url;
    }

// Slashes some things that **** with ereg_replace
function slashreg($str) {
    return str_replace(array("\\","(",")","?"),array("\\\\","\\(","\\)","\\?"), $str);
    }

?>