dougjohnson

May 27, 2011

The best way to protect against MySQL injections in php is to use "Prepared" statements. You don't need to validate the user input since it is completely separated from the mysql statement.

Example:

$connection = new mysqli('server', 'username', 'password', 'database');
$result = $connection->prepare("SELECT products, usertype, special_pricing_user, special_pricing, pcconly FROM users WHERE username = ?");
$result->bind_param("s", $username);
$result->execute();
$result->bind_result($userproducts, $usertype, $special_pricing_user, $special_pricing, $pcconly);
while ($row = $result->fetch()) {
//
}

May 27, 2011

I found these online.....

// READ //

fh = fopen(getScriptPath(), 0);

if (fh!=-1) {

length = flength(fh);

str = fread(fh, length);

fclose(fh);

write(str);

}

// WRITE //

function WriteFile() {

var fh = fopen("c:\\MyFile.txt", 3); // Open the file for writing

if (fh!=-1) {

var str = "Some text goes here...";

fwrite(fh, str);

fclose(fh);

}

WriteFile();

Hope this helps

May 26, 2011

OR - $justmonth = substr($date,0,2);

May 25, 2011

You had lot's of syntax errors. I think I fixed most of them but there could be more...

<?php

$colname_hometext_RS = "-1";

if (isset($_GET['home'])) {

$colname_hometext_RS = $_GET['home'];

}

mysql_select_db($database_MySQLconnect, $MySQLconnect);

$query_hometext_RS = sprintf("SELECT * FROM t_textos WHERE id_texto = %s", GetSQLValueString($colname_hometext_RS, "int"));

$hometext_RS = mysql_query($query_hometext_RS, $MySQLconnect) or die(mysql_error());

$row_hometext_RS = mysql_fetch_assoc($hometext_RS);

$totalRows_hometext_RS = mysql_num_rows($hometext_RS);

function split_pos($row_hometext_RS['texto_esp']) {

/* find middle space in text */

$mid = (int) strlen($row_hometext_RS['texto_esp'])/2 – 1;

$cut = strpos($row_hometext_RS['texto_esp'] , " " , $mid);

$part1= substr($row_hometext_RS['texto_esp'] , 0 , $cut + 1);

$pos1 = strrpos($part1 , "<");

$pos2 = strrpos($part1 , ">");

if (($pos1 < $pos2) || ($pos1 === False)) {

return $cut; /* no html tag around */

}

$pos3 = strpos($row_hometext_RS['texto_esp'] , ">" , $cut1 + 1);

if ($pos3 !== False) {

return $pos3; /* end of middle html tag */

} else {

return $cut; /* unbalancing < > */

}

?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

<title>Untitled Document</title>

<!--

body {

margin-top: 0px;

}

-->

</style>

</head>

<body>

<?php

$middle_pos = split_pos($row_hometext_RS['texto_esp']);

echo "<table><tr>";

// First column

echo "<td>" . substr($row_hometext_RS['texto_esp'], 0, $middle_pos) . "</td>";

echo "<td style='width:30px'></td>";

// Second column

echo "<td>" . substr($row_hometext_RS['texto_esp'], $middle_pos + 1) . "</td>";

echo "</tr></table>";

require_once('footer.php');

mysql_free_result($hometext_RS);

?>

</body>

</html>

May 24, 2011

You want "all" images to be 690 wide? I'm not all that familiar with "GD", but could you calculate the percentage of the original image width, then apply that percentage to the height? Example: original image dimensions = 1024px BY 768px.

690 / 1024 = .6738281 <- % width

.6738281 * 768 = 517px <- height in px.

Or I may not understand your issue. Sorry.

May 23, 2011

Curl is great, however, there are instances where I've been able to use "file_get_contents()" and then parse the results to get what I'm after. This is simple and works in some cases.

May 23, 2011

Could you create a temp table containing all of the results from your first search results and then "search" the temp table for the other keywords?

May 23, 2011

Are Color: Green, Type: Painting and Size: Large Keywords also?

May 13, 2011

Access denied usually means the Mysql user doesn't exist OR the password you are using is invalid OR the user does not have rights to do what you are asking. Check user Mysql access rights.

May 13, 2011

I found this on the web:

/////////////////////////////

PHP has no idea about an iframe, it's just served as another page and interpreted by the browser...

You could do something like...

Then inside the iframe, you can access $_GET['from']. Just make sure you verify, as that would be insecure.

Here is the code I typically use to return the current page URL:

function currentPageURL() {

$pageURL = 'http';

if ($_SERVER["HTTPS"] == "on") {$pageURL .= "s";}

$pageURL .= "://";

if ($_SERVER["SERVER_PORT"] != "80") {

$pageURL .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];

} else {

$pageURL .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];

}

return $pageURL;

}

////////////

I'm not sure if this would work for you???

May 13, 2011

PHP doesn't know anything about iframes. This ones tricky. I'll do some looking around. Maybe someone else can chime in.

May 13, 2011

I was just showing you how to get the URL into a variable. Don't CHANGE these! They are environment variables. Use them just as they are:

$pageurl = "http://" . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"];

Then - $pageurl will contain the users current URL in his/her address bar.

May 13, 2011

$pageURL .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];

May 13, 2011

$pageURL .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];

May 13, 2011

Try $_SERVER['HTTP_REFERER'] or $_SERVER['REQUEST_URI']

May 13, 2011

What URL are you talking about? Are you asking about extracting the URL from the browser address area and inserting it into your table? If so, there is a way to do that. Please be more specific.

May 12, 2011

? If you use the [onChange=this.form.submit()] and add the $_POST's to receive the select values, the page will refresh and the text fields will be populated with the matching database values. This isn't what you want?

May 12, 2011

Or you could use Ajax. Which is cooler but tricker to do.

May 12, 2011

Put this in your SELECT tag:

Then receive the values with $_POST at the top of the page. Or I may not understand your question?

May 12, 2011

You might check the permissions on the directory you are uploading to and make sure your app can create files and folders at that location.

May 11, 2011

You might also put some "echos" in your if statements to find out where it's stopping. See below:

if (isset($_POST['submitted'])) {

ECHO "1ST IF<br>";

//check for an uploaded file:

if (isset($_FILES['upload'])) {

ECHO "2ND IF<br>";

//validate the type. Should be pdf, doc or rtf.

$allowed = array('application/pdf');

if (in_array($_FILES['upload']['type'], $allowed)) {

ECHO "3RD IF<br>";

//move the file over.

if (move_uploaded_file($_FILES['upload']['name'], "../hollywincote/uploads/{$_FILES['upload']['name']}")) {

ECHO "4TH IF<br>";

echo '<p><em>The file has been uploaded</em></p>';

} //end of move... IF

} else {

echo '<p>Please upload a PDF.</p>';

}

} //end of isset($_FILES['upload']) IF.

May 11, 2011

First I would check the permissions on the server for the "hollywincote/uploads/" directory. Can this directory create files and folders?

May 11, 2011

Or, better yet, you could use "Prepared" queries and not have to worry about user input at all:

<?PHP

$fname=$_POST['fname'];

$lname=$_POST['lname'];

$address=$_POST['address'];

$country=$_POST['country'];

$city=$_POST['city'];

$connection = new mysqli('localhost', 'root', '', 'testdb');

$result = $connection->prepare("INSERT INTO info (fname,lname,address,country,city) VALUES (?, ?, ?, ?, ?)");

$result->bind_param("sssss", $fname, $lname, $address, $country, $city);

$result->execute();

?>

[attachment deleted by admin]

Sign In

dougjohnson

Posts

Joined

Last visited

Content Type

Profiles

Forums

Posts posted by dougjohnson

MySQL injection protection

File handling in JS

substring question

Please help with displaying text in columns

How do I adjust the size with GD ??

PHP and Curl..............

I Need Some Help Filtering Search Results Using Dropdowns!

I Need Some Help Filtering Search Results Using Dropdowns!

check box row delete need help

inserting the current URL into the MYSQL db upon form completion

inserting the current URL into the MYSQL db upon form completion

inserting the current URL into the MYSQL db upon form completion

inserting the current URL into the MYSQL db upon form completion

inserting the current URL into the MYSQL db upon form completion

inserting the current URL into the MYSQL db upon form completion

inserting the current URL into the MYSQL db upon form completion

Having problems with selectbox entry

Having problems with selectbox entry

Having problems with selectbox entry

File Upload Script = Fail

file upload confusion

file upload confusion

PHP submit and Retrieve from database

Browse

Activity

Important Information