Jump to content

baltar

Members
  • Posts

    11
  • Joined

  • Last visited

baltar's Achievements

Newbie

Newbie (1/5)

0

Reputation

  1. It's relatively simple with wamp. I am very much a noob myself and I haven't had a problem with wamp and phpmyadmin. You will go into phpmyadmin through wamp. Make sure wamp is online; aka wamp's W logo is green (not orange or red). Right click the logo, click on phpmyadmin ( right below localhost option). Important: phpmyadmin prompts you for username and password. -u root -p The notation means username is root and password is left blank. Hit go.
  2. baltar

    sql injection

    Ps as far as pointing me to tutorials go, I mean that in respect to the 2nd script I have. I found plenty of tutorials that use DPOs to create the db. but SEARCHING is the more important component. Sorry for any confusion.
  3. baltar

    sql injection

    Thanks. Could you point me to some tutorials? Php.net and wiki.hashphp.org do the job conceptually i guess, but do you know of others? I mean I buy books on php, but they contradict each other. Stackoverflow gives me dissertations that are way above my head. It's just frustrating. I have a simple 3 to 4 variable database and an nl2br() function. It shouldn't be this difficult.
  4. baltar

    sql injection

    Thanks for helping. Apologies for being a complete dumbas* here. I'm pretty much jumping like 10 steps in my development...so I am about to ask at least one more stupid question...please bear with me lol! Where does the PDO go, exactly? I think in the user's query (basically my 2nd set of code)? Just to be sure, I essentially have two scripts (one that connects, creates, and populates a tiny db): <?php /*Joy of PHP sample code*/ if (mysqli_connect_error()) { die('Could not connect: ' . mysqli_connect_error()); } echo 'Connected successfully to mySQL. '; /* Create table doesn't return a resultset */ if ($mysqli->query("CREATE DATABASE Cars") === TRUE) { echo "Database Cars created"; } else { echo "Error creating Cars database: " . $mysqli->error."<br>"; } $mysqli->select_db("Cars"); Echo ("Selected the Cars database"); $query= " CREATE TABLE INVENTORY (VIN varchar(17) PRIMARY KEY, Comments varchar(150), a varchar(50), Model varchar(100))"; //echo "<p>*****</p>"; //echo $query; //echo "<p>*****</p>"; if ($mysqli->query ($query) === TRUE) { echo "<p>Database table 'INVENTORY' CREATED</p>"; } else { echo "<p> ERROR: </p>" . mysqli_error($mysqli); } $query = "INSERT INTO `cars` . `inventory` (`VIN`, `Comments`, `a`, `Model`) VALUES ('5FNYF4H91CB054036', 'Really \n good', 'Honda', 'Pilot')"; //a stands for the manufacturer of the car, in the book this variable is Make if ($mysqli->query($query) === TRUE) { echo "<p>Honda Pilot inserted into inventory table. </p>"; } else { echo "<p>Error inserting Honda Pilot:</p>" . mysqli_error($mysqli); echo "<p>*****</p>"; echo $query; echo "<p>*****</p>"; } //Insert a Dodge Durango $query= "INSERT INTO `cars` . `inventory` (`VIN`, `Comment`, `a`, `Model`) VALUES ('LAKSDFJ234LASKRF2', 'Also \n very \r\n good', 'Dodge', 'Durango')"; if ($mysqli->query($query) === TRUE) { echo "<p>Dodge Durango inserted into inventory table </p>"; } else { echo "<p>Error inserting Dodge: </p>" . mysqli_error($mysqli); echo "<p>*****</p>"; echo $query; echo "<p>*****</p>"; } $mysqli->close(); ?> Then I have my own php setup that allows visitors to search the the inventory table within the car database. This is where the PDO would go into I assume (but the $sql portion of the PDO throws me off): <?php error_reporting(E_ALL); ini_set('display_errors', '1'); $search_output = ""; if(isset($_POST['searchquery']) && $_POST['searchquery'] != "") { $searchquery = preg_replace('#[^a-z 0-9?!]#i', '', $_POST['searchquery']); $sqlCommand = "SELECT VIN, Comments, a, Model FROM Inventory WHERE a LIKE '%$searchquery%'"; include_once("db_folder/db.php"); $query = mysql_query($sqlCommand) or die($mysqli->error); $count = mysql_num_rows($query); if($count > 0) { $search_output .= "$count result(s) for <strong>$searchquery</strong><br />"; while($row = mysql_fetch_array($query)) { $VIN = $row["id"]; $a = $row["a"]; //a really stands for the manufacturer of the car $a= mysql_real_escape_string($a); //still a novice $Model = $row["Model"]; $search_output .= "*<br><b>$a</b>- <br/><b>The Model is: </b>$Model<br /> <br /> <b><i>Its VIN is: </i></b><i>$VIN</i><br /><b><i>The impression is: </i></b>$Comments<br/>"; echo nl2br($Comments); //output $means with line breaks } // close while } else { $search_output = "<hr />0 results for <strong>$searchquery</strong><hr />$sqlCommand"; } mysql_close(); } ?> I've clearly cut all the additional code not pertaining to the database. This 2nd php code is actually about 130 lines, but mostly page content, etc. I'm usually not as slow as the current evidence is bearing (I have a pretty decent GPA in school).
  5. baltar

    sql injection

    I am using The Joy of PHP. The author does use mysqli on occasion. How would you re write it? I hate to ask but there is always a different way of doing this....on stackoverflow everyone seems hellbent on showing me some hideously complicated way to do mysqli. It is pretty frustrating. I apologize, but needed to get it out. Why shouldn't stripslashes() be there though?
  6. I am having a wamp issue so I can't try these out right now. According to the book I'm learning php with, I can easily avoid injection attacks this way: $a= stripslashes($a); $a= mysql_real_escape_string($a); What concerns me is the repetition of the variable, $a. Does it matter? Intuitively, it should. $a changes. By the time $a hits mysql_real_escape_string it is slash-free. So it is a totally different "value" but still contained in the original variable which may have had slashes...just has me concerned a bit. I know PDOs are the best way. I'm not there yet, unfortunately.
  7. I should have mentioned but there is a preceding form through which the data is entered. The data get entered properly and I can see it in phpmyadmin. But I get a undefined variable error for line 21 '$Model'; I can't figure this out... please help.
  8. Hey all - I can't edit the original OM, but I managed to fix that error. I was missing a " and a ; in line 44. But now I get more error messages that are clearly above my pay grade. So I am making the entire code I have available. Please help me. <html> <head> <title>Car Saved</title> </head> <body bgcolor="#FFFFFF" text="#000000"> <?php //capture values posted to this php program from the text fields in teh form $VIN=mysql_real_escape_string($_POST['VIN']); $Make=mysql_real_escape_string($_POST['Make']); $Model=mysql_real_escape_string($_POST['Model']); //Build a SQL Query using the values from above $query ="INSERT INTO Inventory (VIN, Make, Model) VALUES( '$VIN', '$Make', '$Model' )"; //Print the queryto the browser so you can see it echo ($query. "<br>"); $mysqli = new mysqli('localhost', 'root', NULL, 'db_name'); /*check connection*/ if (mysqli_connect_error()) { printf("Connect falied: %s\n", mysqli_connect_error()); exit(); } echo 'Connected successfully to mySQL <BR>'; //select db to work with $mysqli->select_db("cars"); echo ("Selected the cars database. <br>"); /*try to insert the new car into the db */ if ($result=$mysqli->query($query)) { echo "<p> you have successfully entered $Make $model into the db.</P>"; } else { echo "Error entering $VIN into db:" . mysql_error()."<br>"; } $mysqli->close(); ?> </body> </html> I follow the code. I still can't get it to run. Very frustrating...!!!
  9. Ok I am using a book called The Joy of Php, but it the sample code is missing from its website, so I am rewriting it. Anyway I have run into a parsing error, but my code is a spot match for the book code. Can someone help me? the error is : Parse error: syntax error, unexpected 'Error' (T_STRING), expecting ',' or ';' in C:\wamp\www\submitcar.php on line 46 The code snippet is: /*try to insert the new car into the db */ if ($result=$mysqli->query($query)) { echo "<p> you have successfully entered $Make $model into the db.</P> } else { echo "Error entering $VIN into db:" . mysql_error()."<br>"; } $mysqli->close(); Please help...I have no idea where my error is. I have the gosh darn semicolon after <br>!
  10. the board won't let me re-edit. It appears the main problems (among others?) were a ( was missing and also I had used ' instead of `. Anyone know if there is a reason why db_names and tables can't handle an apostrophe but must have `. I mean apostrophes work fine for encapsulating values...
  11. I'm just starting out with mysqli and php. Actually I more or less know how to create/connect/populate mysqli databases through php. But I can only do so by using a separate php page for each objective. Anyway, I learning with the kindle version of Joy of Php. The code though isn't very good...I had to edit it just to make it conform to php/mysqli syntax. Programmer's Notebook was a big help actually. Anyway, I just wanted to point out my experience level. Below is the code, I haven't run it through wamp (Phpmyadmi) yet, only because it probably won't run and I'll be crushed...side note: it took me a while to figure out that tables and databases require the use ` and not '. The book doesn't even mention the difference!!!! Anyway, can someone tell me if this edited code is viable? I'm concerned about line 4: $mysqli.... since this is wamp, and I log into phpmyadmin via -u root -p , -p NULL in the code is correct yes? <?php /*Joy of PHP sample code*/ $mysqli = new mysqli('localhost', 'root', NULL ); if (mysqli_connect_error()) { die('Could not connect: ' . mysqli_connect_error()); } echo 'Connected successfully to mySQL.'; /* Create table doesn't return a resultset */ if ($mysqli->query("CREATE DATABASE Cars") === TRUE) { echo "Database Cars created"; } else { echo "Error creating Cars database: " . $mysqli->error."<br>"; } $mysqli->select_db("Cars"); Echo ("Selected the Cars database"); $query= " CREATE TABLE INVENTORY (VIN varchar(17) PRIMARY KEY, YEAR INT, Make varch(50), Model varchar(100))"; //echo "<p>*****</p>"; //echo $query; //echo "<p>*****</p>"; if ($mysqli->query ($query) === TRUE) { echo "<p>Database table 'INVENTORY' CREATED</p>"; } else { echo "<p> ERROR: </p>" . mysqli_error($mysqli); } $query = "INSERT INTO `cars` . `inventory` (`VIN`, `YEAR`, `Make`, `Model`) VALUES '5FNYF4H91CB054036', '2012', 'Honda', Pilot')"; if ($mysqli->query($query) === TRUE) { echo "<p>Honda Pilot inserted into inventory table. </p>"; } else { echo "<p>Error inserting Honda Pilot:</p>" . mysqli_error($mysqli); echo "<p>*****</p>"; echo $query; echo "<p>*****</p>"; } //Insert a Dodge Durango $query= "INSERT INTO `cars` . `inventory` ('VIN', 'YEAR', 'Make', 'Model') VALUES ('LAKSDFJ234LASKRF2', '2009', 'Dodge', 'Durango')"; if ($mysqli->query($query) ===TRUE) { echo "<p>Dodge Durango inserted into inventory table </p>"; } else { echo "<p>Error inserting Dodge: </p>" . mysqli_error($mysqli); echo "<p>*****</p>"; echo $query; echo "<p>*****</p>"; } $mysqli->close(); ?> Thank you, I apologize if I seem critical of the book but it really skips over A LOT of stuff that newbies don't necessarily know (example: -u something -p = username something and password is blank)
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.