Jump to content

Stephen

Members
  • Posts

    200
  • Joined

  • Last visited

    Never

Posts posted by Stephen

  1. As I am not skilled in Regex, I am having trouble with this line of code. I use this:

    preg_match_all('/f_[a-zA-Z0-9]*_/', $string, $match);
    

    to locate the string (including f_ and _). For example, I have a function named f_get_value_ and f_set_value_ and I would like to locate these function names. However, when I do print_r($match[0]), it returns with:

    Array
    (
        [0] => f_set_
        [1] => f_get_
    )
    

    Obviously it is cutting it off at the first underscore it comes across (after f_) rather than what I want it to do (cut it off at the final underscore). I cannot guarantee that there will be only 1 underscore between the words (get/set_value). There could be 2, 3, 4, or more. I am looking for a regular expression that will accomplish this goal and I thank anyone who attempts to help. :)

  2. You didn't use $ before the variable names... and I recommend using brackets when directly using variables within double quotes:

    for ($i=1; $i<11; $i++)
      {
         echo "<tr>";
        echo"<td><p><strong>[{$i}]</strong></p></td> ";
        echo"<td><textarea name='causes[{$i}]' cols='30' id='causes' value='{$causes[$i]}'></textarea></td>";
        echo"<td><textarea name='corrective_action[{$i}]' cols='50' id='corrective_action' value='{$corrective_action[$i]}'></textarea></td>";
        echo"<td><input name='name[{$i}]' type='text' id='name' value='{$name[$i]}' /></td>";
        echo "<td><input name='date[{$i}]' type='text' id='date' value='{$date[$i]}' /></td>";
        echo "<td><textarea name='remarks[{$i}]' cols='50' id='remarks' value='{$remarks[$i]}'></textarea></td>";
       echo"</tr>";
       
       }
    

     

    I guess you already solved this though? o.O

  3. You could try something like:

    Sorting Order</span><br>
                    <select name="sort" class="textBox_center" id="sort" style="width:150px;">
                    <option value="1" onclick="newestentries.display='block';youngesttrees.display='none'">Newest Entries</option>
                    <option value="2" onclick="newestentries.display='none';youngesttrees.display='block'">Youngest Trees</option>
                  </select>
    

     

    And have two sections that would correspond to this:

    <div id="newestentries" style="display: none">
    <?php
          $result = mysql_query("SELECT * FROM album ORDER BY dtime DESC",$connect);
          while ($row = mysql_fetch_assoc($result))
          {
                echo(" <a href=\"image_script.php?albumid=" . $row["albumid"] . "\">" . $row["title"] . "</a><br />");
          }
    ?>
    </div>
    <div id="youngesttrees" style="display: none">
    <?php
          $result = mysql_query("SELECT * FROM album ORDER BY age DESC",$connect);
          while ($row = mysql_fetch_assoc($result))
          {
                echo(" <a href=\"image_script.php?albumid=" . $row["albumid"] . "\">" . $row["title"] . "</a><br />");
          }
    ?>
    </div>
    

     

    Not sure if that's what you're looking for though.

  4. Ah, I meant the actual data itself (like the base64_encrypted data). Right now you could try using this code instead of the old one:

    (below)
    

     

    Try creating another album and see if you get the same little icon (and check if the information is different in the table for the two different images).

     

    EDIT:

    Actually, after looking at it, this ($result = mysql_query("select * from album where albumid='".addslashes($image).".jpg'");) would not work if your "albumid" is an auto_incrementing integer. Try using these:

    <?php
    include("config.php");
    
    $image = stripslashes($_GET['image']);
    $result = mysql_query("select * from album where albumid='".
    addslashes($image)."'");
    $myrow = mysql_fetch_assoc($result);
    $imagebytes = $myrow['imgdata'];
    header("Content-type: image/jpeg");
    print base64_decode($imagebytes);
    ?>
    

    (the display script):

    <?php
    
    include("config.php");
    
            $albumid = $_GET['albumid'];
            
            $result = mysql_query("SELECT * FROM album WHERE albumid='$albumid' ",$connect);
            while($myrow = mysql_fetch_assoc($result))
                 {
                   echo "<b>Title: </b>";
                   echo $myrow['title'];
                   echo "<b><br>Posted: </b><i>";
                   echo $myrow['dtime'];
                echo "</i><b><br>Age (Years):</b>: ";
                   echo $myrow['age'];
                   echo "<br><br><a href=\"javascript:self.history.back();\"><-- Go Back</a>";
                echo "<b><br><br><br><br>Image: <br><br></b>";
                echo "<img src=\"get_image.php?image={$myrow['albumid']}\">";
                 }
              
    ?>
    

  5. You could replace:

    $username=$_POST['username'];
    $password=$_POST['password'];
    

     

    With:

    $username=get_magic_quotes_gpc() ? stripslashes($_POST['username']) : $_POST['username'];
    $password=get_magic_quotes_gpc() ? stripslashes($_POST['password']) : $_POST['password'];
    

    To make sure slashes have not already been added. Also, you forgot to put $ before your variable name for the "query" variable.

  6. What do variables $myrow and $field1_name contain?

     

    <?php
        if( file_exists( "thumbs/" . $myrow[$field1_name] ) )
            {
                    echo( "<img src=\"./thumbs/" . $myrow[$field1_name] . "\" />" );
            }
        else
            {
                    echo( "<img src=\"./thumbs/nophoto.jpg\" />" );
            }
    ?>
    

     

    This should work if the file doesn't exist and the "./thumbs/nophoto.jpg" exists, although this code is basically the same as what mrMarcus suggested (except I use ./ before the location).

  7. Without direct access (like, if the script was on their server), then you would have to first access the page (via file_get_contents, fopen/fread, cURL, etc.) and then parse the page to get all of the links to the threads; afterwards, you would have to access all of those links (through a loop with your preferred method) and parse the information from that.

  8. Well you could use LIMIT. For example, if you started on page one, a previous button would be disabled and the next button would go to page two (assuming there is more than one "page"). On page two, the previous button would be enabled. Obviously, next would add one to the page number and previous would subtract one. Lets say you want to show 3 results per page:

     

    <?php
    //mysql connect, select db, queries done, basically the script you had before excluding outputting the information
    
    $page = intval($_GET["page"]);
    $total = mysql_num_rows($query);
    $increment = 3;
    $current = ($page-1)*$increment;
    $previous = false;
    $next = false;
    
    if ($current > 0)
    {
    	$previous = true;
    }
    
    if ($current < $total)
    {
    	$next = true;
    }
    
    if ($previous)
    {
    	//display previous, $page -1
    }
    
    if ($next)
    {
    	//display next, $page +1
    }
    
    $sql = "SELECT * FROM table LIMIT {$current},{$increment}";
    $query = mysql_query($sql);
    $numrows = mysql_num_rows($query);
    if ($numrows > 0)
    {
    	while ($rows = mysql_fetch_array($query))
    	{
    		//output the information or something
    	}
    }
    else
    {
    	die("Page information not located");
    }
    ?>
    

     

    I did that pretty fast, so replace the comments with whatever is needed. The main thing you need to look at is SQL and the variables at the top. If, after the comments are replaced, the script doesn't work (through an error of my own), please note that I did not test it, but I'm pretty sure there shouldn't be any errors.

  9. I the injection would have not been "1' OR '1=1", but rather:

    1' OR '1'='1

    Resulting in an unescaped result of:

    SELECT * FROM login WHERE username = '1' AND password = '1' OR '1'='1'
    

     

    Escaped:

    SELECT * FROM login WHERE username = '1' AND password = '1\' OR \'1\'=\'1'
    

     

    Try your example again with:

    username: a username that works (I guess you used "1" before)

    password: 1' OR '1'='1

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.