anderson_catchme

I can't use PDO here guys, because of limitation of MYSQL. Not every query supports PDO: Info here: http://stackoverflow.com/questions/13682355/pdo-and-mysql-fulltext-searches

It's a dynamic query for one, so id need to dynamically generate the question marks somehow. I just prefer strongly to filter this one, honestly. I also find PDO harder to debug.

I have a SQL statement which is difficult to use PDO on, it might not even be possible to do. So I'm filtering it like this: $search = $_GET['search']; $search = preg_replace("/[^A-Za-z0-9]/", " ", $search); $search = $mysqli->real_escape_string($search); Will this result in an acceptable level of security?

I'm sure Jacques1 is correct, but arguing on the internet is stupid and this should be closed.

Turns out user-frosting is extremely slow, at least on my end. Can anybody recommend a secure user-management script? I don't care if it isn't free.

Well what do you know, it's not just noobs, turns out my usermanagement script is vulnearble to this attack. However, this one isn't, supposedly: http://www.userfrosting.com/

Hi, So I have a private page where I have a delete button. The delete button just links to a page something like this: mysite.com/?postid=123&confirm=1 When confirm is set, the page is deleted. The problem is, a malicious person could reverse engineer the URL and trick (logged in) users of the site into clicking the link. How can I verify that the last page visited was from my site, in the private section? Possible solutions: I was thinking HTTP_REFERER (mispelled due to html standard stupidity), but heard it's not robust. Right now I'm just setting a cookie for 1 minute, to limit the likelihood of hacking, but wonder if there is a better way.

$query = "SELECT * FROM posts WHERE `posts`.`Category` IN ('1','2','3','4','5','6') ORDER BY `posts`.`image_or_not` IN (1) DESC, `posts`.`datetime` DESC "; Above is my working solution, without any JOINS. Works with no duplicates. I wanted to get this done 100% in mysql without having to rewrite my php.

$query = "SELECT * FROM posts LEFT JOIN `images` ON `images`.`post_association`=`posts`.`id` WHERE `posts`.`category` IN ('1','2','3','4','5','6') GROUP BY `posts`.`id` ORDER BY `images`.`post_association` IS NOT NULL DESC, `posts`.`datetime` DESC "; Sort of solved the duplicate rows issue w GROUP BY clause, but now getting random bad results. Possibly related to having duplicate 'id' column names. 3 am though might sleep

One issue, I am getting some extra results. My 'images' table contains multiple images per post. (one to many relationship?) These are getting filtered back to my main table, returning extra rows. Working on the issue now, but if anybody has any ideas let me know.

Not sure why left, and not right, but no matter. Works great. Thanks.

I have a table which contains a TINY INT column. If there are images associated with the post, the TINY is 1. If not, 0. I want to order results by images first, and earliest DATETIME first. Basically, like using a boolean but not. Simply ordering by the TINY INT column ASC or DESC isn't working. Not sure how to solve this. Help appreciated. Thanks!

I have a boostrap conflict regarding box sizing. I solved it with a simple CSS rule: * { box-sizing: content-box; } Now the problem is my bootstrap form isn't working. I need to make the box sizing apply to everything except the bootstrap form: <form id="contactForm" action="<?php echo htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES); ?>" method='post'> <!-- HTML HERE --> </form> Any ideas? Thanks.

Ok so I've narrowed the problem: <script type="text/javascript"> function submitform() { document.myform.submit(); } </script> <script> $(document).ready(function() { uploadObj = $("#fileuploader").uploadFile({ url:"/jquery-upload-file-master/php/upload.php", fileName:"myfile", onSuccess:function(files,data,xhr) { $('.ajax-file-upload-statusbar').delay(2000).slideUp('slow'); //Problem lies here with submitform() submitform(); }, onError: function(files,status,errMsg) { $("#status").html("<font color='red'>Upload is Failed</font>"); } }); }); </script> <br/> <form name='myform' action="createnewpost.php?4" method="POST"> <button id='my_button' name='submit' value='submit' class='btn btn-primary' onclick="event.preventDefault(); uploadObj.startUpload();"> Create Post</button> </form> </body> </html> Narrowed the problem: The form submission was interfering with fileupload. Now I just need submit get the form with submitform();

Variables are assigned from right to left in php. So you shouldn't be putting $_POST['user_id'] in your sql but $user_id. Use paramaterized queries ideally, although they are a bit harder to debug. For debugging, try: $query = "SELECT * FROM table"; // Run query if(!$query){ echo mysqli_error($mysqli); }

More info here: https://github.com/hayageek/jquery-upload-file

$(document).ready(function() { var uploadObj = $("#fileuploader").uploadFile({ url:"upload.php", fileName:"myfile", }); }); I'm trying to call UploadObj.uploadFile(); on a click event. Removing the "var" to make the scope global works sort of but also throws errors. Not sure what to do. Help appreciated.

Turns out, it can be. And that's a much better design. Thanks for everyone's excellent ideas.

Yes, well the posting stage is actually a 3 step process, the last step being hit the submit. I'm using an ajax uploader script I found on github, and the php script is getting called every time a file gets uploaded. It is: * jQuery Upload File Plugin * version: 3.1.10 * @requires jQuery v1.5 or later & form plugin * Copyright (c) 2013 Ravishanker Kusuma * http://hayageek.com/ That's a good point though, I'll have to check to see whether I can configure the upload functionality upon submit rather than just whenever a file is selected.

You both make good points, which I will inplement. But one last question. The code is for posting on a site. Sometimes, a user will upload images but not complete the post. My thoughts are is to have all images uploaded to a temporary folder named /tempimages. Insert names of images and usernames in a table called 'temp_images' like suggested. When a user loads the posting page, delete all old rows from previous posts in 'temp_images' associated with that username. Then, once the user hits the submit button, move all rows in 'temp_images' to 'images' table, and move all files from /tempimages folder to /images. Table 'temp_images' and folder /tempimages would be deleted from manually for maintaince every now and then. Is above a good solution?

Still not working 100%. So far: function create_image($ext, $filepath, $newfilepath, $jpegquality){ $ext = strtolower($ext); switch ($ext){ case "jpg": $im = @imagecreatefromjpeg($filepath); if($im){ imagejpeg($im, $newfilepath, $jpegquality); } break; case "jpeg": $im = @imagecreatefromjpeg($filepath); if($im){ imagejpeg($im, $newfilepath, $jpegquality); break; } case "gif": $im = @imagecreatefromgif($filepath); if($im){ imagegif($im, $newfilepath); } break; case "png": $im = @imagecreatefrompng($filepath); if($im){ imagepng($im, $newfilepath, 5); } break; } if(!$im){ return FALSE; } } //By this point in the script, a directory should exist //$output_dir = "uploads/"; //$output_dir = getcwd()."/ImageUploads/imguploads/".test_directory($username, $mysqli)."/"; /* $output_dir = $thedirectory."/"; */ $var = getcwd(); $var = str_replace('\users', '\tempimages\\', $var); $output_dir = $var; //Scan directory to count uploaded images /* $count_files = array_diff(scandir($output_dir), array('..', '.')); if(count($count_files) >= 10){ die(); }; */ //echo $output_dir; if(isset($_FILES["myfile"])) { $ret = array(); // This is for custom errors; /* $custom_error= array(); $custom_error['jquery-upload-file-error']="File already exists"; echo json_encode($custom_error); die(); */ $error =$_FILES["myfile"]["error"]; //You need to handle both cases //If Any browser does not support serializing of multiple files using FormData() if(!is_array($_FILES["myfile"]["name"])) //single file { $fileName = $_FILES["myfile"]["name"]; //security // Rename files $splitName = explode(".", $fileName); //split the file name by the dot $fileExt = end($splitName); //get the file extension // if(!check_ext($fileExt)){ die();} // $newFileName = strtolower($time.'.'.$fileExt); $newFileName = strtolower(time().'_'.uniqid().'.'.$fileExt); if(create_image($fileExt, $_FILES["myfile"]["tmp_name"], $output_dir.$newFileName, 80) !== FALSE){ // mysqli_query('SET CHARACTER SET utf8'); $query = mysqli_query($mysqli, "SELECT temp_json FROM uc_users WHERE user_name ='$username'"); while ($row = mysqli_fetch_array($query)){ $json = $row['temp_json']; } if(!empty($json)){ // Already have JSON objects in db $json = json_decode($json); $json = array_values($json); array_push($json, $newFileName); $json = json_encode($json); $query = mysqli_query($mysqli, "UPDATE uc_users SET temp_json='$json' WHERE user_name='$username'"); } else { // No JSON objects in db $json = $newFileName; $json = json_encode($json); // $json = $mysqli->real_escape_string; //$json = 'first'; $query = mysqli_query($mysqli, "UPDATE uc_users SET temp_json='$json' WHERE user_name='$username'"); } } // UPDATE `csv_db`.`uc_users` SET `Temp_Directory` = '' WHERE `uc_users`.`id` = 1; // move_uploaded_file($_FILES["myfile"]["tmp_name"],$output_dir.$fileName); // rename($output_dir.$fileName, $output_dir.$newFileName); // Done Renaming files $ret[]= $fileName; }

function create_image($ext, $filepath, $newfilepath, $jpegquality){ $ext = strtolower($ext); switch ($ext){ case "jpg": $im = @imagecreatefromjpeg($filepath); if($im){ imagejpeg($im, $newfilepath, $jpegquality); } break; case "jpeg": $im = @imagecreatefromjpeg($filepath); if($im){ imagejpeg($im, $newfilepath, $jpegquality); break; } case "gif": $im = @imagecreatefromgif($filepath); if($im){ imagegif($im, $newfilepath); } break; case "png": $im = @imagecreatefrompng($filepath); if($im){ imagepng($im, $newfilepath, 5); } break; } if(!$im){ return FALSE; } } $var = getcwd(); $var = str_replace('\users', '\tempimages\\', $var); $output_dir = $var; if(!is_array($_FILES["myfile"]["name"])) //single file { $fileName = $_FILES["myfile"]["name"]; //security // Rename files $splitName = explode(".", $fileName); //split the file name by the dot $fileExt = end($splitName); //get the file extension $newFileName = strtolower(time().'_'.uniqid().'.'.$fileExt); if(create_image($fileExt, $_FILES["myfile"]["tmp_name"], $output_dir.$newFileName, 80) !== FALSE){ $query = mysqli_query($mysqli, "SELECT temp_json FROM uc_users WHERE user_name ='$username'"); while ($row = mysqli_fetch_array($query)){ $json = $row['temp_json']; } if((json_decode($json) == FALSE || NULL)){ // No JSON objects in db $json = $newFileName; $json = trim($json); $json = json_encode($json, JSON_FORCE_OBJECT); $query = mysqli_query($mysqli, "UPDATE uc_users SET temp_json='$json' WHERE user_name='$username'"); } else { // Already have JSON objects in db $json = json_decode($json,true); $json = array_values($json); array_push($json, $newFileName); $json = json_encode($json, JSON_FORCE_OBJECT); $query = mysqli_query($mysqli, "UPDATE uc_users SET temp_json='$json' WHERE user_name='$username'"); } } </code> Thanks for your wisdom Jacques1. Anyway, I rewrote it entirely. I'm now saving JSON filenames to database. Took some time & effort. Hopefully this (working?!) code looks better?

Thanks for this response. Would it be a good idea to just store all the images in one folder? I'm actually renaming the images with UNIX_TIMESTAP, which will be unique. The problem I see with storing everything in one folder it that I will have to store the names of the images in the MySQL Db corresponding to each user's post. Agreed though, all those folders are NOT good. Also, I don't know a better way than a LIKE query. And wasn't aware that a loop is a bad idea for only one row.

$username = $loggedInUser->username; // This is the logged in username $time = time(); $makedir = $username.'_'.$time; $var = getcwd(); $var = str_replace('\users', '\imageuploads', $var); $dirlocation = $var."\\".test_directory($username, $mysqli); function test_directory ($username, $mysqli) { $stmt = $mysqli->prepare("SELECT Temp_Directory FROM uc_users WHERE user_name LIKE ?"); $stmt->bind_param("s", $username); $stmt->execute(); $stmt->bind_result($Tempdir); while ($stmt->fetch()){ return $Tempdir; } } if((!empty(test_directory($username, $mysqli))) && is_dir($dirlocation)){ //echo "this is it"; $thedirectory = $dirlocation; } if(empty(test_directory($username, $mysqli))){ //echo "it's not a directory"; $newdir = $var."\\".$makedir; $query = mysqli_query($mysqli, "UPDATE uc_users SET Temp_Directory='$makedir' WHERE user_name='$username'"); if(!$query){ //echo mysqli_error($mysqli); } mkdir($newdir); //security chmod($newdir, 0644); $thedirectory = $newdir; } if(!is_dir($dirlocation) && (!empty(test_directory($username, $mysqli)))){ //echo "third one"; mkdir($dirlocation); chmod($dirlocation, 0644); $thedirectory = $dirlocation; } Ok, so what I'm doing here is testing to see whether a a record exists of the user having a folder in the MySQL database. Then, if it does, make sure that a folder exists at that location. If there is no folder, we create one for the user. If there is already a folder, we leave it alone. This is for image uploads, and $thedirectory, is where we upload images later on in the script. Hope that makes sense. The code seems to work. But how can I improve it and make it more robust? Or should I just leave it alone? Should I return FALSE from the function for better reliability over empty()?

Nevermind, solved it. Mods you may delete this.