thara

@Jacques1, Thank for your post. In the above code most of thing I have coded except the password hashing part. Yes its found me somewhere on internet and he has used a different method to hash passwords other than using "hash_password()". As you have mentioned that code is not secure, Then I used hash_password() and recreated the registration script: This is how looks it now: if ($_SERVER['REQUEST_METHOD'] == "POST") { //echo '<pre>', print_r($_POST, true).'</pre>'; // Sanitize the data passed in $name = filter_input(INPUT_POST, 'name', FILTER_SANITIZE_STRING); $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING); $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL); $email = filter_var($email, FILTER_VALIDATE_EMAIL); $password = filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING); // check username and email already exist: $prep_stmt = "SELECT user_id FROM users WHERE email = ? AND username = ? LIMIT 1"; $stmt = $mysqli->prepare($prep_stmt); if ($stmt) { $stmt->bind_param('ss', $email, $username); $stmt->execute(); $stmt->store_result(); if ($stmt->num_rows == 1) { // A user with this email address already exists $error[] = 'A user with this email address or username already exists.'; } } else { $error[] = 'Database error'; } if (empty($error)) { // Create a hashed password $options = [ 'cost' => 12, ]; $hash_password = password_hash($password, PASSWORD_BCRYPT, $options); //echo $hash_password; // Insert the new user into the database $query = "INSERT INTO users ( name , username , email , password ) VALUES (?, ?, ?, ?)"; $insert_stmt = $mysqli->prepare($query); if ($insert_stmt){ // Bind variable for placeholder: $insert_stmt->bind_param('ssss', $name, $username, $email, $hash_password); // Execute the prepared query. $insert_stmt->execute(); if ($insert_stmt->affected_rows == 1) { // Success massege $success = "The account has been created successfully."; // Store success massege in SESSION: $_SESSION['success'] = $success; // Redirect page to same page $url = 'register.php'; // Define the URL. header("Location: $url"); exit(); // Quit the script. } else { // if registration fail: header("Location: error.php?err=Registration failure: INSERT"); exit(); } } else { echo $mysqli->error; } } } Now Can you kindly tell me, is there any security issues in my updated code? Thanks in Advance.

Why I start this tread is, Just I need to create a secure user registration system in php including login functionality with remember me option. In the starting point I needed to create user registration script. Here I have include my code so far, and just I need to know , is my script secure to prevent any possible attack? my password hashing method is correct? If not can any profession guys tell me what are the things that I need to do to make this script more secure? This is my PHP so far from user registration script: <?php // Error Flag $error_msg = ""; if (isset($_POST['username'], $_POST['email'], $_POST['password'])) { // Sanitize and validate the data passed in $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING); $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL); $email = filter_var($email, FILTER_VALIDATE_EMAIL); if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { $error_msg .= 'The email address you entered is not valid'; } $password = filter_input(INPUT_POST, 'ppassword', FILTER_SANITIZE_STRING); $prep_stmt = "SELECT member_id FROM members WHERE email = ? LIMIT 1"; $stmt = $mysqli->prepare($prep_stmt); if ($stmt) { $stmt->bind_param('s', $email); $stmt->execute(); $stmt->store_result(); if ($stmt->num_rows == 1) { // A user with this email address already exists $error_msg .= 'A user with this email address already exists.'; } } else { $error_msg .= 'Database error'; } if (empty($error_msg)) { // Create a random salt //$random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE)); // Did not work $random_salt = hash('sha512', uniqid(mt_rand(1, mt_getrandmax()), true)); // Create salted password $password = hash('sha512', $password . $random_salt); // Insert the new user into the database if ($insert_stmt = $mysqli->prepare("INSERT INTO members (username, email, password, salt) VALUES (?, ?, ?, ?)")) { $insert_stmt->bind_param('ssss', $username, $email, $password, $random_salt); // Execute the prepared query. if (!$insert_stmt->execute()) { header('Location: ../error.php?err=Registration failure: INSERT'); exit(); } } // Success massege $success = "The account has been created successfully."; // Store success massege in SESSION: $_SESSION['success'] = $success; // Redirect page to same page $url = BASE_URL.BASE_URI.'index.php?p=admin-dashboard'; // Define the URL. header("Location: $url"); exit(); // Quit the script. } } ?> Any comments would be greatly appreciate. Thank you.

I do have a `.dat` file that contain airports data all around the world. So now I need to insert data into `mysql` from this `.dat` file. This is how I tried it in mysql: LOAD DATA LOCAL INFILE '/tmp/airports.dat' REPLACE INTO TABLE airports FIELDS TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"' LINES TERMINATED BY '\n' (apid, name, city, country, iata, icao, y, x, elevation, timezone, dst, tz_id); But its not inserting data into mysql and I can get an error when I run above query. mysql> LOAD DATA LOCAL INFILE '/tmp/airports.dat' REPLACE INTO TABLE airportsFIELDS TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"' LINES TERMINATED BY '\n' ( apid, name, city, country, iata, icao, y, x, elevation, timezone, dst, tz_id); ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"' LINES TERMINATED BY '\n' (apid, nam' at line 1 mysql> This is the data structure of my `.dat` file: 1,"Goroka","Goroka","Papua New Guinea","GKA","AYGA",-6.081689,145.391881,5282,10,"U","Pacific/Port_Moresby" 2,"Madang","Madang","Papua New Guinea","MAG","AYMD",-5.207083,145.7887,20,10,"U","Pacific/Port_Moresby" 3,"Mount Hagen","Mount Hagen","Papua New Guinea","HGU","AYMH",-5.826789,144.295861,5388,10,"U","Pacific/Port_Moresby" 4,"Nadzab","Nadzab","Papua New Guinea","LAE","AYNZ",-6.569828,146.726242,239,10,"U","Pacific/Port_Moresby" 5,"Port Moresby Jacksons Intl","Port Moresby","Papua New Guinea","POM","AYPY",-9.443383,147.22005,146,10,"U","Pacific/Port_Moresby" 6,"Wewak Intl","Wewak","Papua New Guinea","WWK","AYWK",-3.583828,143.669186,19,10,"U","Pacific/Port_Moresby" 7,"Narsarsuaq","Narssarssuaq","Greenland","UAK","BGBW",61.160517,-45.425978,112,-3,"E","America/Godthab" 8,"Nuuk","Godthaab","Greenland","GOH","BGGH",64.190922,-51.678064,283,-3,"E","America/Godthab" 9,"Sondre Stromfjord","Sondrestrom","Greenland","SFJ","BGSF",67.016969,-50.689325,165,-3,"E","America/Godthab" 10,"Thule Air Base","Thule","Greenland","THU","BGTL",76.531203,-68.703161,251,-4,"E","America/Thule" And so on upto 8000 of lines. Hope somebody may help me out. Thank you.

@Barand, Can't we write this using "switch Statement"?

Can you show us your database table and what do you exactly want to do? I am not clear what you are asking.

Can I know from the professionals here, what is the best method to write this kind of logic? And also I would like to know is there other way to write this in a best way. Method 01: if ($emission <= 100 ) { $cssClass = "emission_a"; } elseif ($emission <= 120 ) { $cssClass = "emission_b"; } elseif ($emission <= 150 ) { $cssClass = "emission_c"; } elseif ($emission <= 165 ) { $cssClass = "emission_d"; } elseif ($emission <= 185 ) { $cssClass = "emission_e"; } else { $cssClass = "emission_g"; } Method 02: $mapping = array( 100 => 'emission_a', 120 => 'emission_b', 150 => 'emission_c', 165 => 'emission_d', 185 => 'emission_e', 225 => 'emission_f' ); $cssClass = 'emission_g'; // default class if $emission is > 225 foreach ($mapping as $limit => $class) { if ($emission <= $limit) { $cssClass = $class; break; } } Thank you.

Yes Sir, My mistake. I really miss understood it. Sorry for it. I have a another question, how I add "parent" class to "<li>" only if it has a sub-menu?

I am using this php function to display categories and sub-categories in a list. function displayMenuMobile(&$cats, $parent, $level=0) { switch ($level) { case 0: $class = "menu-phone"; $menuId = "nav"; break; case 1: $class = "sub-menu"; $menuId = ""; break; } if ($parent==0) { foreach ($cats[$parent] as $id=>$nm) { displayMenuMobile($cats, $id); } } else { echo "<ul class='$class' id='$menuId'>\n"; $classParent = ''; if ($level == 0) { $classParent = "class='parent'"; } foreach ($cats[$parent] as $id=>$nm) { echo "<li $classParent><a href='#'><span>$nm</span></a>\n"; if (isset($cats[$id])) { displayMenuMobile($cats, $id, $level+1); //increment level } } echo "</li></ul>\n"; } } Its displaying the list but it is not rendering HTML properly. This is rendering HTML: <ul class='menu-phone' id='nav'> <li class='parent'><a href='#'><span>Hot Deals</span></a> <li class='parent'><a href='#'><span>Pantry</span></a> <ul class='sub-menu' id=''> <li ><a href='#'><span>Biscuits</span></a> <li ><a href='#'><span>Canned Foods</span></a> <li ><a href='#'><span>Canned Vegetables</span></a> <li ><a href='#'><span>Chips, Snacks & Nuts</span></a> </ul> <li class='parent'><a href='#'><span>Drinks</span></a> <ul class='sub-menu' id=''> <li ><a href='#'><span>Coffee</span></a> <li ><a href='#'><span>Flavoured Milk Drinks</span></a> </ul> <li class='parent'><a href='#'><span>Confectionery</span></a> <ul class='sub-menu' id=''> <li ><a href='#'><span>Chocolate</span></a> <li ><a href='#'><span>Mints &Bathroom & Toilet Gums </span></a></li> </ul> <li class='parent'><a href='#'><span>Household</span></a> <ul class='sub-menu' id=''> <li ><a href='#'><span>Air Fresheners</span></a> <li ><a href='#'><span>Bathroom & Toilet</span></a> <li ><a href='#'><span>Cleaning</span></a> <li ><a href='#'><span>Electrical</span></a> <li ><a href='#'><span>Homeware</span></a> <li ><a href='#'><span>Laundry</span></a></li> </ul> <li class='parent'><a href='#'><span>Cosmetics</span></a> <ul class='sub-menu' id=''> <li ><a href='#'><span>Eye Makeup</span></a> <li ><a href='#'><span>Lip Gloss & Moisturisers</span></a> <li ><a href='#'><span>Nail Polish</span></a></li> </ul> </li> </ul> Problem is its not rendering closing </li> tag in the parent and nested list. Can anybody tell me whats wrong with this? Hope somebody may help me out. Thank you.

@Jacques1, Thank you for your answer and suggestion. Can you Kindly explain what is the reason to use escaped and encoded urls? And also I needed to change this line : return htmlspecialchars($value, ENT_QUOTES | ENT_HTML5 | ENT_SUBSTITUTE, $encoding); to return htmlspecialchars($value, ENT_QUOTES | 'ENT_HTML5' | 'ENT_SUBSTITUTE', $encoding); get it to work. Is it a typo? Thank you.

I have a mysql table named categories. This is how my categories looks like: mysql> select * from categories; +-------------+--------+----------------------+-------------+ | category_id | parent | name | description | +-------------+--------+----------------------+-------------+ | 1 | NULL | Products | NULL | | 2 | 1 | Computers | NULL | | 3 | 2 | Laptops | NULL | | 4 | 2 | Desktop Computers | NULL | | 5 | 2 | Tab PCs | NULL | | 6 | 2 | CRT Monitors | NULL | | 7 | 2 | LCD Monitors | NULL | | 8 | 2 | LED Monitors | NULL | | 9 | 1 | Mobile Phones | NULL | | 10 | 9 | LG Phone | NULL | | 11 | 9 | Anroid Phone | NULL | | 12 | 9 | Windows Mobile | NULL | | 13 | 9 | iPad | NULL | | 14 | 9 | Samsung Galaxy | NULL | | 15 | 1 | Digital Cameras | NULL | | 16 | 1 | Printers and Toners | NULL | | 22 | 1 | Computer Accessaries | NULL | | 23 | 22 | USB Cables | NULL | | 24 | 22 | Network Cables | NULL | +-------------+--------+----------------------+-------------+ 24 rows in set (0.00 sec) So now I need to display these category and sub categories in a HTML table. I have attached an image with the table layout which is I expect. Can anybody tell me is it possible to do in php? Thank you.

Yes. Markup should be like that. But problem is my above HTML generating dynamically.

I do have a list of categories and its sub categories, something like this. INSERT INTO categories VALUES (1,NULL, 'Products', NULL), (2,1, 'Computers', NULL), (3,2, 'Laptops', NULL), (4,2, 'Desktop Computers', NULL), (5,2, 'Tab PCs', NULL), (6,2, 'CRT Monitors', NULL), (7,2, 'LCD Monitors', NULL), (8,2, 'LED Monitors', NULL), (9,1, 'Mobile Phones', NULL), (10,9, 'LG Phone', NULL), (11,9, 'Anroid Phone', NULL), (12,9, 'Windows Mobile', NULL), (13,9, 'iPad', NULL), (14,9, 'Samsung Galaxy', NULL), (15,1, 'Digital Cameras', NULL), (16,1, 'Printers and Toners', NULL); Now I need to create a Product sub and sub-sub menu using this product list. This is my expecting Markup for the menu. --- --- --- <li class="current-menu-item menu-item-has-children"> <a href="#">Products</a> <ul class="sub-menu"> <li> <a href="#">Laptops & Desktop Monitors</a> <ul class="sub-menu"> <li"><a href="products.php&product-id=5">Category 1</a></li> <li"><a href="products.php&product-id=6">Category 2</a></li> <li"><a href="products.php&product-id=7">Category 3</a></li> </ul> </li> <li><a href="products.php&product-id=4">Mobile Phones</a></li> <li><a href="products.php&product-id=4">Phones Accessories</a></li> <li><a href="products.php&product-id=4">Computer accessories</a></li> </ul> </li> --- --- --- So I tried it using recursion as @Barand showed me in earlier post. $prep_stmt = "SELECT category_id , name , IFNULL(parent, 0) FROM categories ORDER BY name"; $stmt = $mysqli->prepare($prep_stmt); if ($stmt) { // Execute the prepared query. $stmt->execute(); $stmt->store_result(); $numrows = $stmt->num_rows; if ($numrows >= 1) { // get variables from result. $stmt->bind_result($id, $name, $parent); // Fetch all the records: while ($stmt->fetch()) { $cats[$parent][$id] = $name; } // Close the statement: $stmt->close(); unset($stmt); } } <?php // ------- Display Category List -------- function displayList(&$cats, $parent, $level=0) { switch ($level) { case 0: $class = "sub-menu"; break; case 1: $class = "sub-menu"; break; case 2: $class = "children2"; break; } if ($parent==0) { foreach ($cats[$parent] as $id=>$nm) { displayList($cats, $id); } } else { echo "<ul class='$class'>\n"; foreach ($cats[$parent] as $id=>$nm) { echo "<li><a href='products.php?product=$id'>$nm</a></li>\n"; if (isset($cats[$id])) { displayList($cats, $id, $level+1); //increment level } } echo "</ul>\n"; } } displayList($cats, 0); ?> It display my sub menu correctly but not displaying sub sub menu. This is the rendering HTML from above code. <li> <a href="">Products</a> <ul class='sub-menu'> <li><a href='products.php?product=22'>Computer Accessaries</a></li> <ul class='sub-menu'> <li><a href='products.php?product=24'>Network Cables</a></li> <li><a href='products.php?product=23'>USB Cables</a></li> </ul> <li><a href='products.php?product=2'>Computers</a></li> <ul class='sub-menu'> <li><a href='products.php?product=6'>CRT Monitors</a></li> <li><a href='products.php?product=4'>Desktop Computers</a></li> <li><a href='products.php?product=3'>Laptops</a></li> <li><a href='products.php?product=7'>LCD Monitors</a></li> <li><a href='products.php?product=8'>LED Monitors</a></li> <li><a href='products.php?product=5'>Tab PCs</a></li> </ul> <li><a href='products.php?product=15'>Digital Cameras</a></li> <ul class='sub-menu'> <li><a href='products.php?product=21'>test</a></li> </ul> <li><a href='products.php?product=18'>test2</a></li> <li><a href='products.php?product=19'>test3</a></li> </ul> </li> Can anybody tell me how to fix this problem? Thank you.

Congratulations Fastol...

@Barand, one more question. I need to display a string something like below using above pagination script. Showing 1 - 6 of 19 items I can display number of items but not sure how to display result range. This is how I tried it. Showing <?=$page - $offset?> of <?=$numrecs?> items Thanks

@Barand, Really helpful, Thank you very much. I need to change these lines <?=pageNav($page, $totalPages)?> to <?php echo pageNav($page, $totalPages); ?> Can you tell what is the problem of it? is it php version?

@Barand, Using your above pagination function, how to implement it with database result?

I have a set of items to select from mysql. And then I want to display these items on my page with different 'markup`. This is how my HTML look like for each item. <ul class='unstyled main-facilities row'> <li class='info-facility-item '> <span class='fa-stack'> <i class='fa fa-square fa-stack-2x'></i> <i class='fa fa fa-cutlery fa-stack-1x fa-inverse'></i> </span> Item-01 </li> <li class='info-facility-item '> <span class='fa-stack'> <i class='fa fa-square fa-stack-2x'></i> <i class='fa fa fa-rss fa-stack-1x fa-inverse'></i> </span> Item-02 </li> <li class='info-facility-item '> <span class='fa-stack'> <i class='fa fa-square fa-stack-2x'></i> <i class='fa fa-refresh fa-stack-1x fa-inverse'></i> </span> Item-03 </li> ... ... ... </ul> If I have same markup for each item, then I can do it like this: // Fetch all the records: while ($stmt->fetch()) { $result = "<li class='info-facility-item '>\n"; $result .= " <span class='fa-stack'>\n"; $result .= " <i class='fa fa-square fa-stack-2x'></i>\n"; $result .= " <i class='fa fa fa-rss fa-stack-1x fa-inverse'></i>\n"; $result .= " </span>{$item}\n"; $result .= "</li>\n"; $items[] = $result; } } But I am not sure how to modify my `while` loop to render different markup for each item. Can anybody tell me is there a way to do this in PHP? Thank you.

Again I tried it. After inserting I set to reload the page. Then it fixed the error. I added this code after insert query: if ($stmt->affected_rows >= 1) { // Success msg: $_SESSION['success'] = "Restaurant Operating Hours Updated successfuly."; // Redirect user $url = BASE_URL.BASE_URI."index.php?p=edit-operating-hours"; ob_end_clean(); // Delete the buffer. // Define the URL. header("Location: $url"); exit(); // Quit the script. }

@Barand, I used above modified functions to display existing business hours to a restaurant in my business hour update page. Its nicely working that mean all the dropdowns populating correctly with available values. Then I tried to update "business hours" table, deleting existing values and inserting new values. Then I can get an error message inserting is not working but delete query is working. This is how I tried it: // Check for a form submission: if ($_SERVER['REQUEST_METHOD'] == 'POST') { //echo '<pre>', print_r($_POST).'</pre>'; //echo '<pre>', print_r($_SESSION['errors']).'</pre>'; // Sanitize and validate the data passed in form: // Check for the "Operating Hour selection": if (isset($_POST['openclose'])) { $operatingHours = $_POST['openclose']; } else { $error_alert[] = "Please select opening and closing time for seven day."; } if (empty($error_alert)) { // If everything's OK... // Delete old entries: $sqlDelete = 'DELETE FROM business_hours WHERE restaurant_id = ?'; $stmtDelete = $mysqli->prepare($sqlDelete); $stmtDelete->bind_param('i', $restaurant_id); $stmtDelete->execute(); $stmtDelete->close(); unset($stmtDelete); // Insert restaurant's operating hours into database: $def_times = array(1 => '06:00:00', '11:30:00'); // default $sql = "INSERT INTO business_hours (restaurant_id, day, open_time, close_time) VALUES (?,?,?,?)"; $stmt = $mysqli->prepare($sql); $stmt->bind_param('iiss', $restaurant_id, $dayno, $open_time, $close_time); foreach ($operatingHours as $dayno => $times) { if ($times[1]==-1) { // closed $times[1] = $times[2] = '00:00:00'; } elseif (!array_filter($times)) { $times = $def_times; // set the times to the stored defaults } else { $def_times = $times; // save the times as the default times } $open_time = $times[1]; $close_time = $times[2]; $stmt->execute(); if (isset($times[3]) && $times[3]!='') { $open_time = $times[3]; $close_time = $times[4]; $stmt->execute(); } } } } // main IF condistion -- Form Submission -- This is the error I am getting when running above script: Line number 70 is. $hours = array_merge($times[$dno], array('','','','')); // ensure > 4 array elements in daysandtimes(&$times) function. What would be the problem?

@Barand, Is there a way to use DELETE and INSERT in single query? Thank you.

I do have an array something like this: [cuisines] => Array ( [0] => 17 [1] => 20 [2] => 23 [3] => 26 ) Now I need to update mysql table with these values. All values belong to one user. So I tried it like this: if (isset($_POST['cuisines'])) { $cuisines = $_POST['cuisines']; } else { $error_alert[] = "Please select at least one cuisine"; } if (empty($error_alert)) { // If everything's OK... // Make the update query: $sql = 'UPDATE restaurant_cuisines SET restaurant_id = ? , cuisine_id = ? WHERE restaurant_id = ?'; $stmt = $mysqli->prepare($sql); // Bind the variables: $stmt->bind_param('iii', $restaurant_id, $cuisine_id, $restaurant_id); foreach ($cuisines as $value) { $cuisine_id = $value; // Execute the query: $stmt->execute(); } // Print a message based upon the result: if ($stmt->affected_rows >= 1) { echo 'updated'; } // Close the statement: $stmt->close(); unset($stmt); } But this query not updating mysql correctly. This is what I get running this script. mysql> select * from restaurant_cuisines where restaurant_id = 4; +---------------+------------+ | restaurant_id | cuisine_id | +---------------+------------+ | 4 | 26 | | 4 | 26 | | 4 | 26 | +---------------+------------+ 3 rows in set (0.00 sec) What would be the problem of this script? Hope somebody may help me out. Thank you.

I have two mysql tables named facilities and other one is user_facilities. In facilities table have stored all available facilities and user_facilities table have particular facilities belong to one user. Now I need to fetch all the facilities from mysql and need to format with checkbox for each facility. While fetching every facilities I need to set checked="checked" attribute to checkboxes which are belong to current user. I can select all facility from mysql like this: $sql = "SELECT id, name FROM cuisines"; And this is how it looks my `WHILE` loop. $result = ''; // Fetch all the records: while ($stmt->fetch()) { $result = "<div class='checkbox'>\n"; $result .= " <label>\n"; $result .= " <input type='checkbox' name='facilities[]' value='{$id}'> {$name}\n"; $result .= " </label>\n"; $result .= "</div>\n"; $output[] = $result; } Can anybody tell me how add checked="checked" attribute for these checkboxes which are belong to current user? This is my user_facilities table CREATE TABLE IF NOT EXISTS user_facilities( user_id INT(4) UNSIGNED NOT NULL, facility_id INT(4) UNSIGNED NOT NULL ) ENGINE=MyISAM DEFAULT CHARSET=utf8;

@Barand, I got another problem when I try to update this "Business Operating Hours". Here I need to display these dropdowns in editing page with the existing values. If I use normal dropdown I can set the "selected" attribute for the chosen option/s. But here all 28 dropdowns populating with the use of daysandtimes() and timeOptions() functions. Thats the problem I have. Actually I am not sure how to figure this out. Any help would be greatly appreciated. Thank you.

@Barand, Can you tell me how to create select query for this. To have a output something similar to this : http://www.tiikoni.com/tis/view/?id=570f668 If there are two shifts how to display it in my page? Thank you.

I fixed it. changed def-time() array to: $def_times = array(1 => '06:00:00', '12:30:00'); // default if (isset($times[3]) && $times[3]!='') { $openTime = $times[3]; $closeTime = $times[4]; $stmt->execute(); }