Welcome to CineShield

Enter a TMDB ID below to start streaming securely with ad protection.

Click Shield Active

Stream Configuration

Enter standard TMDB IDs OR paste any direct streaming link (.mp4, .webm) to boost its audio up to 400% natively!
Pre-Amp Gain Boost 100% (1.0x)

Waiting for Input...

No Stream Active
🛡️

Shield Active

🎬

Ready to Stream

Enter a TMDB ID on the left and click "Play Now" to initiate your secure movie player.

Quick Test IDs:

Recently Streamed

⏳

No watch history yet. Your recently played items will appear here.

My Favorites

⭐

No favorites saved yet. Mark movies as favorites to save them here for quick access.

Configuration & Customization

🔗 Embed Links (Change Directly Here)

Below are the embed URL patterns. You can change these templates directly here in the UI (it will save automatically) or paste them directly in the JS code variable. Use {id} for movie IDs, and {id}, {season}, {episode} for TV shows.

🔑 Optional TMDB Integration

To load real movie titles, descriptions, and posters directly inside CineShield, you can paste a TMDB Read Access Token (v4 API key) or a standard API Key (v3 API key) below. This is completely optional and runs entirely in your browser!

This determines the starting security restriction level of the video player. You can also toggle this instantly on the control deck directly under the player.

🛡️ Ad Shield Mechanism Explanation

How the Click Shield protects you:

  1. Iframe Sandbox Filtering: The video player iframe uses the HTML5 sandbox attribute. By omitting the allow-popups and allow-popups-to-escape-sandbox directives by default in Balanced mode, the browser strictly blocks the player from launching background tabs or popups.
  2. Transparent Collision Shield: CineShield places an invisible overlay right above the player. When active, mouse clicks are absorbed by our page, so they never hit the iframe. This blocks ad scripts from sensing your mouse movement or launching "first-click" full-screen ads.
  3. Smart Auto-Lock & Instant Re-lock: When you click Unlock, the shield temporarily dissolves. The moment you click once inside the player (e.g., to play/pause), CineShield's smart focus-monitoring immediately senses the interaction and re-locks the shield within 150ms. This permits your single click but blocks any subsequent ad pops or double-clicks instantly!

🛡️ CineShield Core Security & WAF Suite

WAF Core 1.2 Active
🔒

Advanced Input Protection & SQLi Defenses

SQL Injection (SQLi) is blocked dynamically in CineShield by combining strict type enforcement, regex validation signatures, and input parameterization concepts. Explore how user inputs are completely neutralized below.

🔍 Dynamic Web Application Firewall (WAF) Sandbox

Type any standard string or a malicious SQL injection payload below (e.g., ' OR '1'='1, UNION SELECT, DROP TABLE users) to see how the WAF scans, analyzes, and automatically neutralizes it in real time!

WAF Threat Status Safe
No malicious SQL or script signatures detected. Input complies with normal alphanumeric query standards.
JSHash Conversion (Password Hashing) 1315423911
Hashing converts any arbitrary SQL payload into a safe numeric integer. Since the query only receives a number, **SQL Injection is mathematically impossible** on password queries!
Escaped & Sanitized Output Clean
Special characters like quotes (', "), backslashes (\), and comment blocks (--, /*) are programmatically escaped or stripped to render them harmless.

🖥 disruption SQL Compilation Visualizer (Prepared Statements)

Compare how standard SQL queries get hijacked by SQL injection payloads versus how modern **Parameterized Queries (Prepared Statements)** completely segregate data from code logic, making queries unbreakable.

🚨 Vulnerable Dynamic SQL Compilation

Raw input is concatenated directly into the query string, changing the SQL execution tree:

SELECT * FROM users WHERE user = 'admin' AND password = '';
✅ Status: Secure placeholder template
🛡️ Secure Parameterized SQL Compilation

The query structure is pre-compiled. User input is bound strictly as raw data parameters, rendering payloads inert:

PREPARE stmt FROM 'SELECT * FROM users WHERE user = ? AND password = ?';
EXECUTE stmt USING @user, @password;
🔒 Status: Prepared statement compiled safely. Data parameter isolated.

💻 Clean Production-Ready Defenses (Implementation Snippet)

Below is the complete Node.js/Express protection model implemented here. Copy this code into your production servers to enforce robust type validation, regex sanitization, and SQL parameterization:

// 1. Strict Parameter Validation Middleware
function enforceTypeSecurity(req, res, next) {
    const tmdbId = req.query.id;
    if (tmdbId && !/^\d+$/.test(tmdbId)) {
        return res.status(400).json({ error: "SQL Injection Blocked: ID must be numeric." });
    }
    next();
}

// 2. Safe Parameterized DB Query (e.g. mysql2/pg)
async function secureUserLogin(dbConnection, username, password) {
    const query = "SELECT * FROM users WHERE username = ? AND password_hash = ?";
    const [rows] = await dbConnection.execute(query, [username, password]);
    return rows;
}