Jump to content

oni-kun

Members
  • Posts

    1,984
  • Joined

  • Last visited

  • Days Won

    1

Everything posted by oni-kun

  1. http://linux.die.net/man/7/signal How is this a PHP question?
  2. Only the variable, In this case the $_GET['user_id'] which is gotten from the URL. Take a look at this example: //Grab user ID from url and apply escaping: $userid = mysql_real_escape_string($_GET['user_id']); //Use user ID in query: $sql = "SELECT id, first_name, last_name, teacher FROM table WHERE `id`='$userid' "; Consider this malicious url: http://www.domain.com/myfile.php?user_id=20' and DROP TABLE table It would change the query (The single quote) and thus allow malicous SQL code to be injected. mysql_real_escape_string sanitizes and nullifies the effects of the single quite thus allowing the query to be secure, that's all that's needed.
  3. Here, Note the security to sanitize (escape) the string should be needed on all user input: $sql = "SELECT id, first_name, last_name, teacher FROM table WHERE `id`='" . mysql_real_escape_string($_GET['user_id']) . "'"; Queries should generally be neat (Commands in capitals and column names in backticks) for readability/maintainability, and escaping really should be done before the query. Here is some more info on the subjects mysql_real_escape_string http://dev.mysql.com/doc/refman/5.0/en/security.html http://www.bitrepository.com/sanitize-data-to-prevent-sql-injection-attacks.html http://www.tizag.com/mysqlTutorial/mysqlquery.php
  4. I'd use this on that: padding: 0px; border-spacing: 0px;
  5. The numbers would be in the tens of thousands, I mean they pretty much banned all of Google in the whole aspect of its service, maybe China wants to hide more than data behind their "Great firewall of China" (Yes that is the real name).
  6. Meh, I was bored. I'm not sure this is the best way to go around this, but it does the job. You could also base the seed on the strlen of the keywords+title or whatever. $random = Array( 1 => '<a href="http://www.foo.com" title="foobar">Foo</a>' , 2 => '<a href="http://www.google.com" title="Google">Google</a>' , 3 => '<a href="http://www.noodle.com" title="Noodle">Noodle</a>' , 4 => '...' , 5 => 'And' , 6 => 'Some' , 7 => 'More' , 8 => 'Random' , 9 => 'Entries', 10 => 'Here' , 11 => 'And' , 12 => 'Here' ); //$_GET['id'] $postnumber = Array(332, 24, 62, 192, 52, 62, 12); foreach ($postnumber as $post) { $decide = str_split($post); $iterator = 0; foreach($decide as $add) { $iterator += $add; } print "Random: " . $random[$iterator] . '<br/>'; }
  7. I second that, I used some old ceramic segments to build the edge of a firepit I made back at my old house, It was pretty nice for gatherings. There's nothing worse than blackened hot steel. :-\
  8. You could base it off the ID of the post, Say randomly assign numbers to each multidementional entry of an array, if the sum of the numbers is xxx, then display a certain array entry. This would work on most posts, although there's a chance of repeating (Not sure if you want to use MySQL to handle it or something homebrewed.)
  9. Yeah, PHP get a +1 for including atleast one simplified function to pull data without manual socket traversing.
  10. $content = file_get_contents($url);
  11. That is much much much much better. Aaahh.
  12. EDIT: You would need to use CURL to deal with the login, if you want to keep it simple.
  13. Checking the MX record is sort of useless (and deprecated in today's uses), as it does not actually check the validity of the specific address. I could specify "doesnotexist@foobar.com" and the wildcard record for foobar.com's MXL would return results.
  14. aebstract, He is simply assigning the result of the str_replace function to itself, thus no need for a temporary variable.
  15. Does the page display anything before it is blank, or does the code just not display anything because of that line? I can't quote if the syntax is correct as you have it all on one line, but it makes more sense that something is wrong in the SQL and one of the statements than just some random code. I'd recommend placing this at the end of mysql_query just to cover all bases. ..mysql_query($sql) or die(mysql_error());
  16. You're escaping the quote, It shouldn't even run. Try: $old = "*(#01)*"; $new = "\\"; $message = str_replace($old, $new, $message);
  17. if(!isset($_POST['e-mail'])) { //$error... } But the function will obviously not pass TRUE if there is nothing to validate. EDIT: Yeah, cags.
  18. Yes, you may as well abandon that code as the logic is flawed. Why not use a predefined solution or as cags suggested PHP's built in filter_var() function?
  19. Try setting error reporting at the beginning of the script: error_reporting(2147483647); ini_set('log_errors', 1); ini_set('display_errors', 1); You note MySQL but where is the SQL syntax in there? All I see is HTML and PHP. If you have SQL syntax then make sure you check if mysql_error has anything or not.
  20. There is no "line-limit" per se and I don't see anything out of the ordinary of your task, I've personally worked with 100MB+ files, but even if you're on a shared host it should not be a problem. If there is something preventing the code from even running (IE. a fatal parse error, preventing the code to parse/debug), then PHP would not even get a chance to run error coding checks; so you must switch it error reporting on via .htaccess/php.ini/httpd.conf and it should give a better clue on why this is happening.
  21. And yes, Please consider others when placing content into your signature/PM. Unicode is generally a bad idea.
  22. You claim you echo'd $row1 yet you're now saying it does not work? Also it is a very bad idea to have SQL statements within a loop, Use JOIN.
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.