requinix

The one time I know where mysql_real_escape_string() won't protect you is if you don't use quotes around the value. $query = "SELECT * FROM table WHERE id = " . mysql_real_escape_string($_GET["id"]); http://www.example.com/path/to/script.php?id=1+OR+username=0x61646D696E (that's "admin" as a hex value, which MySQL lets you do in place of strings) SELECT * FROM table WHERE id = 1 OR username=0x61646D696E [edit] As for XSS, htmlentities() or htmlspecialchars() with ENT_QUOTES (only conditionally required) will guarantee that whatever string you run them will not be interpreted as HTML markup. For better or worse.

Javascript framework? What types of elements? All the same random value or different values for each?

What's your full code? The stuff you showed in your first post looks right...

The scope issue is that variables declared outside of functions (one scope) are not automatically available inside of functions (completely different scope). I agree that you should try to make everything OOP (because right now only $mysqli is), but if you want to stick with procedural code just pass $mysqli to the function: function calls($duplicates, $mysqli) { (since you're using the same name for this variable you won't have to change your code to use it) include 'config.php'; calls(123, $mysqli);

The RewriteRule has a /? that doesn't belong (otherwise "/teams/1/Juventus/.html" would be valid). It should also have the QSA flag which I'll explain in a second, and most likely L too. RewriteRule ^([a-zA-Z0-9_-]+)/([0-9]+)/([a-zA-Z0-9.\s]+).html$ index.php?pagina=$1&id_team=$2&numele=$3 [L,QSA] I didn't look at the pagination code because it doesn't sound like you have a problem with it per se, just the links it creates. 1. That $path looks correct... mostly. 2. You should construct the URL yourself from scratch - basically, use $path. You should urlencode() the parts to protect yourself against malicious URLs and XSS. $path = "/" . urlencode($pagina) . "/" . urlencode($id_squadra) . "/" . urlencode($numele) . ".html"; $targetpage = $path; // or you could just use $path 3. Since $targetpage contains the $path (which has the $pagina, $id_squadra, and $numele) all that's left to add is the page number. "href=\"$targetpage?page=$prev\"" As for QSA: The substitution URL (the index.php one) includes a query string; when you do that then mod_rewrite will assume that's all you want and will discard anything else in the original URL. That means the ?page=$prev would be lost. The QSA ("query string append") tells mod_rewrite to actually keep what was there before, so the URL rewriting will go from /teams/1/Juventus.html?page=2 to /index.php?pagina=1&id_team=1&numele=Juventus&page=2

To "hide" them you have to have the information somewhere in the URL. Where does the p2= value go? Maybe a second directory like /projects/minecraft? How about the c= and t=?

Easiest way? After the loops, if there weren't a multiple of 9 total items then add the \EndIf. Most alternatives I can think of involve restructuring the code (a bit).

MAMP is as much a product as "desk chair" or "leather gloves". All the term says is that whatever it is contains Apache, MySQL, PHP (or Perl or Python, actually) and is for a Mac.

MAMP is primarily an acronym. MAMP 2.1.1 is the name of the product which, unfortunately, uses the acronym for its name (compare that with WAMPServer). BitNami is some company that seems to release their own version of a MAMP (the acronym) stack; that version number probably corresponds to the version of PHP included with it. So they're two different things from two different groups, though they provide more-or-less the same end result.

Is the error happening on the insert into guilt_changes? Is there a primary key on a field when there shouldn't be one?

I don't know about $gAmount but $amountIsCurrently is an array. You have to go into it to grab the "amount" you selected in the query. If you aren't sure of the structure of the array, print_r() or var_dump() it. [edit] It would be a lot easier for you to add the $gAmount in a single query. Don't have to get PHP involved in any of that. UPDATE guilt_list SET name = '$gName', amount = amount + $gAmount WHERE id = $editId

At some point you have to start moving away from the examples. They are, after all, just examples. If you don't want to include HTML tags (as it should not) then don't have them in there.

Besides posting your database credentials in a public place? You're not looking at your PHP code, that's what you're doing wrong. Look at it. <html> <body> <?php $con2=mysql_connect("...", "...", "..."); mysql_select_db("...",$con2); $result=mysql_query("SELECT message FROM chat WHERE Id=1"); $row=mysql_fetch_array($result); echo $row[0]; mysql_close($con2); ?> </body> </html>

You don't have to care about that! Putting it in the session just makes it that much harder for me, as a power user, to use your site. Bookmark a page? Nope, can't do that. Multiple tabs? Nope, can't do that. Just leave it alone. It's perfectly fine to have the ID in there. You do see that every other major website has them in there too, right? It's not a problem.

Make sure that deletePost.php doesn't delete the post unless the user is allowed to. Then they can change the ID number all they want and it won't let them do something they shouldn't.

True OAuth might be a bit much - it involves a three-step authentication process. An API key and a request signature should be fine; the key is sent in the clear but a private "password" is used with some information about the request (like the URL and date) to create a hash. It verifies the request hasn't been tampered with.

Given that single line of code it's quite possible to recover from its problems and continue on correctly... but I doubt that's the case. There's no "SELECT" and there's a missing quote. And no indication the query is actually being run. Post more code.

Optimizing for speed should be the very last thing you ever do in PHP. After the application is written, after it's tested and de-bugged, after you've run out of other improvements and features to do. In most cases you'll squeeze out a millisecond or two, and in the grand scheme of things that's wasted time. Here's a list of things you should do first: * Don't write inline SQL. Move to functions or better OOP * Don't do inline database connections. Move to functions or OOP * Don't put $_POST values, or $_GET or $_COOKIE or anything with input you haven't already validated in PHP, directly into SQL queries. It's called "SQL injection" and it is unforgivable * Don't die() * Don't die() with the MySQL error message

Ah shoot, there was a typo: I missed the []s. $conditions = array(); if (!empty($name)) { $conditions[] = "`name` = '" . /* escape($name) */ . "'"; } if (!empty($email)) { $conditions[] = "`email` = '" . /* escape($email) */ . "'"; } // ... $query = "SELECT fields FROM table"; if ($conditions) { $query .= " WHERE " . implode(" OR ", $conditions); } // execute $query In my defense it should have been really easy to spot that (I defined $conditions as an array right at the start) and fix it.

That's a MySQL error about a MySQL setting. Not related to PHP. Do a query SHOW VARIABLES LIKE 'max_allowed_packet' to see what it's set at (measured in bytes). Assuming that won't change and/or is set to something reasonable (fair assumptions) work around the limit by splitting your SQL file into smaller pieces and running them individually.

Question: how is the code supposed to know that forums/threads/some-cool-thread/2051 doesn't map to sources/forums/threads/some-cool-thread/2051.source.php?

So "I set $conditions equal to a string" was a bit less than truthful? Post your code.

You don't need folders: according to what you've posted if the requested URI matches that pattern, whether it exists or not, Apache will go through index.php.

By the way, here's a question. Given the pseudo-code use Fruit\*; use Colors\*; $o = new Orange(); Where is PHP supposed to find the Orange class?

As far as I know, there is. Perhaps "refresh" is the magic word? Unless the error message actually means that you're hitting some spam filter, there's some problem with the combination of your code and that email address. Perhaps you should not write your own emailing code and to use something reliable like PHPMailer instead.