Jump to content

lemmin

Members
  • Posts

    1,904
  • Joined

  • Last visited

  • Days Won

    2

Posts posted by lemmin

  1. You could include a difference in your query that would represent a true or false value:

    SELECT expenses, payments, expenses-payments diff [...]
    

    Then, while looping through them:

    $style = ($row['diff']) ? 'greenstyle' : 'redstyle';
    

    Or do it all in PHP or all in SQL. You probably won't see much of a performance difference either way.

  2. You will need a simple HTML form:

    <form method="POST" action="handler.php">
        <input type="text" name="key"/>
        <input type="submit"/>
    </form>
    

    Then, in the PHP file (handler.php in this case):

    <?php
    //mysql_connect()
    //mysql_select_db()
    $r = mysql_query('SELECT * FROM tbl_code WHERE key = "'.$_POST['key'].'"');
    if (mysql_num_rows($r))
        header('Location: success.html');
    else
        header('Location: denied.html');
    ?>
    

    This is very basic, it should work in perfect  circumstances. Don't forget to add error handling and input cleaning.

  3. Your code is hard to read in blocks like that. You have derived variable variables without showing their instantiation. Anyway, your form submits the StockID as a value of the "select" select (select named select). After submitting your form, $_POST['select'] will contain the StockID that was selected. You should then be able to use that variable in your query.

  4. If I'm understanding correctly, you need to send the random number back to the server when the user clicks the link? Something like this?

    <?php
    
    if (isset($_GET['rn']))
    {
        mysql_query('SELECT * FROM table WHERE rn = '.$_GET['rn']);
    }
    
    
    $rn = rand();
    
    echo '<a href="?rn='.$rn.'">random number link</a>';
    
    ?>
    
  5. So, it validated after adding that line? If so, the next thing to check is whether or not it is the formatting of the output that is the culprit. Try removing the json_encode function and just output the validation variable:

    echo $valid;
    

    And don't forget to remove the die("true") line from the top first.

  6. Are you actually looking at the files' source directly or through the web browser? It looks suspiciously like Cross Site Scripting (XSS - http://hwang.cisdept.csupomona.edu/swa/content/xss.htm). If those files have been edited on the disk, my first guess would be SQL injection, but there are numerous other possibilities.

     

    I would check EVERY log that you have. Access logs are a good place to start, but if you can find MySQL errors in your PHP logs, that is a red flag for injection.

  7. Why not use the id as the index of your dropdown array instead of the numeric value $c?

    <select name="<?php echo "dropdown[".$data[$c]."]" ?>" id="<?php echo $data[$c] ?>"  ><?php
    

    Then you can loop through each drop down like so:

    foreach ($_POST['dropdown'] as $dbcolumn => $value)
    

    Something you should note, though: Accepting the name of a column from user input will leave your application open for SQL injection.

  8. To get the Javascript variables, you would have to pass them to the PHP file either directly through the URL or using a form:

    http://localhost/index.php?page_name=home
    

    OR

    <form action="index.php">
    <input type="text" name="page_name"/>
    <input type="submit"/>
    </form>
    

    In your case, where you want the page from a prompt, this should work:

    function addPage() {
    
    var page_name=prompt("Enter name");
    
    if (page_name!=null)
    top.location = '?page_name=' + page_name;
    }
    
  9. More code would be helpful in solving this.

     

    I'm guessing you ARE getting errors, but aren't seeing them. Can you check your error_logs?

     

    If you actually aren't getting any errors and nothing is being inserted into that table, then the add() function isn't executing, meaning the $error variable is probably set.

     

    Remember, a variable can be empty, but still "set."

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.