Jump to content

More Header fun...


Grant Holmes

Recommended Posts

See this post for related information. We fixed that one...

 

Once you pass the page listed above, I have a page where I list songs that are on my "playlist" At the end of the row, there is an "edit" link where you can go to edit the record. I take the user then to "song_edit.php" code below.

 

The problem is like the one listed above. This same type edit file is used OFTEN. I open/save as and make the db edits. So again, am mostly certain that is not the issue. I'm thinking this host is the issue. Nonetheless, I need to fix this. On this file, when I edit a field and hit "UPdate" I get this error:

 

Warning: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/grantholmes.com/httpdocs/datatube/songs_edit.php:4) in /var/www/vhosts/grantholmes.com/httpdocs/datatube/songs_edit.php on line 36

Link to comment
Share on other sites

output started at .../songs_edit.php:4 (line 4)

 

Some content is being sent to the browser at or before line 4 in songs_edit.php. You would need to post lines 1-5 to get the quickest solution.

 

I would suggest that you turn on output buffering in php.ini (assuming you have access to it), a .htaccess file (only works when php is an Apache module and the host has not prevented you from changing this setting), or a local php.ini (when php is running as a cgi wrapper and the host has not prevented you from changing this setting), but this is not a fix and the next host you use might not permit you to change the setting so it is always best to fix your code once than to keep fighting server settings.

Link to comment
Share on other sites

Sorry, I had intended to post the code, but "preview" (the post) isn't working today and forgot all about it.

 

<?php include_once("security/MYsecurity.php"); ?>
<?php $DOCROOT = $_SERVER['DOCUMENT_ROOT'] ; ?>

<?
$id = $_REQUEST["id"];
include("dbinfo.inc.php");
mysql_connect($dbhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
if (!empty($_REQUEST["submit"])) {
extract($_REQUEST);
if ($_REQUEST["submit"] == "Delete") {
     $query = "DELETE FROM SongList WHERE id=".$ud_id;
     $result=mysql_query($query);

header("Location: song_list.php?del=1");
   } else {
$query='UPDATE SongList SET 
active = "'.$ud_active.'",
SongTitle = "'.$ud_SongTitle.'",
ArtistPrimary = "'.$ud_ArtistPrimary.'",
ArtistSecondary = "'.$ud_WriterPrimary.'",
WriterSecondary = "'.$ud_WriterSecondary.'",
Contact_Info_ZipCode = "'.$ud_RelatedURL.'",
RelatedURL = "'.$ud_Comments.'",
PartOf = "'.$ud_PartOf.'",
SongStatus = "'.$ud_SongStatus.'",
SongPace = "'.$ud_SongPace.'"
Minutes = "'.$ud_Minutes.'",
YearRecorded = "'.$ud_YearRecorded.'",
YearWritten = "'.$ud_YearWritten.'",
RecordLabel = "'.$ud_RecordLabel.'",
Lyrics = "'.$ud_Lyrics.'",
active = "'.$ud_active.'"
WHERE id = "'.$ud_id.'"';
$result=mysql_query($query);
header("Location: song_list.php?id=".$ud_id); }
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML>
<HEAD>
<TITLE>Edit Request</TITLE>
    <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
   <META NAME="GOOGLEBOT" CONTENT="NOARCHIVE">
    <META NAME="ROBOTS" CONTENT="NONE">
    <LINK REL="stylesheet" TYPE="text/css" HREF="CSS/SEC.css">
</HEAD>
<?php
    
$query='SELECT * FROM SongList where id = "'.$id.'"';

$result=mysql_query($query);

$num=mysql_numrows($result); 

mysql_close();

echo "<H1>Edit Song Details</H1>";
?>
<center><div style='width:100%; background-color:silver; text-align:right'>
  <?php SECShowAdminLink(); ?>
   
  <?php SECShowLogoutLink(); ?>  
</div></center>
<table border="1" cellspacing="2" cellpadding="2" width="800" class="sortable">
<tr> 
<th width="130">Song info</th>
<TH valign="top" width="30">Comments</TH>
<TH valign="top" width="30">Lyrics</TH>
<TH valign="top" width="30">Details</TH>
<th> </th>
</tr>

<?
$i=0;
while ($i < $num) {
$active=mysql_result($result,$i,"active");
$SongTitle=mysql_result($result,$i,"SongTitle");
$ArtistPrimary=mysql_result($result,$i,"ArtistPrimary");
$ArtistSecondary=mysql_result($result,$i,"ArtistSecondary");
$WriterPrimary=mysql_result($result,$i,"WriterPrimary");
$WriterSecondary=mysql_result($result,$i,"WriterSecondary");
$RelatedURL=mysql_result($result,$i,"RelatedURL");
$Comments=mysql_result($result,$i,"Comments");
$PartOf=mysql_result($result,$i,"PartOf");
$SongStatus=mysql_result($result,$i,"SongStatus");
$SongPace=mysql_result($result,$i,"SongPace");
$Minutes=mysql_result($result,$i,"Minutes");
$YearRecorded=mysql_result($result,$i,"YearRecorded");
$YearWritten=mysql_result($result,$i,"YearWritten");
$RecordLabel=mysql_result($result,$i,"RecordLabel");
$Lyrics=mysql_result($result,$i,"Lyrics");
$id=mysql_result($result,$i,"id"); 
?>


<form method="post">
<input type="hidden" name="ud_id" value="<? echo $id; ?>">
<tr> 
<td valign="top"><STRONG>Title:    <input type="text" name="ud_SongTitle" value="<? echo $SongTitle; ?>"><BR>
Artists: </STRONG> <input type="text" name="ud_ArtistPrimary" value="<? echo $ArtistPrimary; ?>"><input type="text" name="ud_ArtistSecondary" value="<? echo $ArtistSecondary; ?>">

Writers: <input type="text" name="ud_WriterPrimary" value="<? echo $WriterPrimary; ?>"><input type="text" name="ud_WriterSecondary" value="<? echo $WriterSecondary; ?>"><BR>
Status:  <input type="text" name="ud_SongStatus" value="<? echo $SongStatus; ?>"><BR>
<SMALL>1-On Playlist<BR>2-Needs Added<BR>3-No Track</SMALL><BR><BR>
Pace:    <input type="text" name="ud_SongPace" value="<? echo $SongPace; ?>"><BR>
<SMALL>Slow Medium Faster Smokin</SMALL>
</td>
<TD valign="top" width="30">
<textarea id="Comments" name="ud_Comments" rows="20" cols="40" wrap='physical'> <?php echo $Comments; ?></textarea></TD>
<TD valign="top" width="30">
<textarea id="Lyrics" name="ud_Lyrics" rows="20" cols="40"  wrap='physical'> <?php echo $Lyrics; ?></textarea></TD>
<TD valign="top" width="30">
<SMALL>Length:</SMALL>
<input type="text" name="ud_Minutes" value="<? echo $Minutes; ?>"><BR><BR>
<SMALL>Recorded in:</SMALL>
<input type="text" name="ud_YearRecorded" value="<? echo $YearRecorded; ?>"><BR><BR>
<SMALL>Year Written:</SMALL>
<input type="text" name="ud_YearWritten" value="<? echo $YearWritten; ?>"><BR><BR>
<SMALL>Year Written:</SMALL>
<input type="text" name="ud_RecordLabel" value="<? echo $RecordLabel; ?>"><BR><BR>


</TD>
<TD valign="top"> 
<?php    
$checked = $Active ? 'checked' :''; 
echo "active ? <input type='checkbox'' name='ud_active'' value='1' $checked>";
?>
</TD>
<TD rowspan="2" valign="top">

<CENTER><input type="submit" name="submit" value="Update">
<BR><BR><input type=button value="Cancel" onClick="history.go(-1)"><BR><BR>
<input type="submit" name="submit" value="Delete" onclick="return confirm('Are you sure you want to delete this record? This cannot be undone!')"></CENTER>
</form></TD>
</TR>
<TR>
<TD valign="top" colspan="2"><SMALL>Related URL:</SMALL><BR>
<textarea id="RelatedURL" name="ud_RelatedURL" rows="1" cols="50"  wrap='physical'> <?php echo $RelatedURL; ?></textarea>
</TD>
<TD valign="top" colspan="2">
<SMALL>Part Of:</SMALL><BR>
<textarea id="PartOf" name="ud_PartOf" rows="1" cols="50"  wrap='physical'> <?php echo $PartOf; ?></textarea>
</TD>
</TR>

<?
++$i;
} 
echo "</table><BR>";
?>

Link to comment
Share on other sites

Remove the space between

<?php include_once("security/MYsecurity.php"); ?>
<?php $DOCROOT = $_SERVER['DOCUMENT_ROOT'] ; ?>

and

<?

that is sending a space to the browser.

 

Better yet, just stay in PHP

<?php include_once("security/MYsecurity.php");
$DOCROOT = $_SERVER['DOCUMENT_ROOT'] ;

$id = $_REQUEST["id"];
include("dbinfo.inc.php");
?>

 

Ken

Link to comment
Share on other sites

Yeah you're using double inverted commas (") instead of single inverted commas (') to set your text fields.

The syntax is:

UPDATE <table> SET <column> = 'BLAH BLAH';

 

You're doing (note: i've substituted some variables to make it clearer)

$query='UPDATE SongList SET 
active = "blah blah",
SongTitle = "blah blah",...etc ';

Link to comment
Share on other sites

Thanks for the response. For my clarity (btw, this was written for me by a php friend and is working on another site as is") That I don't understand... Okay.

 

My code looks like this:

active = "'.$ud_active.'",
SongTitle = "'.$ud_SongTitle.'",

 

Appears to use BOTH quote marks (") AND single quotes ('). You're saying to make them JUST single quotes?

Link to comment
Share on other sites

You like dangerous functions dont you

extract($_REQUEST);

 

My recommendation is that you echo out that query you're doing to find out what SQL you're getting.

Then put that SQL query through MySQL directly (you have access to phpMyAdmin through Plesk), and see what error is any it gives you, and what the resulting table looks like.

Link to comment
Share on other sites

In MySQL strings are delimited by single quotes not double quotes. In this section:

<?php
$query='UPDATE SongList SET 
active = "'.$ud_active.'",
SongTitle = "'.$ud_SongTitle.'",
ArtistPrimary = "'.$ud_ArtistPrimary.'",
ArtistSecondary = "'.$ud_WriterPrimary.'",
WriterSecondary = "'.$ud_WriterSecondary.'",
Contact_Info_ZipCode = "'.$ud_RelatedURL.'",
RelatedURL = "'.$ud_Comments.'",
PartOf = "'.$ud_PartOf.'",
SongStatus = "'.$ud_SongStatus.'",
SongPace = "'.$ud_SongPace.'"
Minutes = "'.$ud_Minutes.'",
YearRecorded = "'.$ud_YearRecorded.'",
YearWritten = "'.$ud_YearWritten.'",
RecordLabel = "'.$ud_RecordLabel.'",
Lyrics = "'.$ud_Lyrics.'",
active = "'.$ud_active.'"
WHERE id = "'.$ud_id.'"';
?>

change all double quotes to single quotes and all single quotes to double quotes, i.e. :

<?php
$query="UPDATE SongList SET 
active = '".$ud_active."',
SongTitle = '".$ud_SongTitle."',
ArtistPrimary = '".$ud_ArtistPrimary."',
ArtistSecondary = '".$ud_WriterPrimary."',
WriterSecondary = '".$ud_WriterSecondary."',
Contact_Info_ZipCode = '".$ud_RelatedURL."',
RelatedURL = '".$ud_Comments."',
PartOf = '".$ud_PartOf."',
SongStatus = '".$ud_SongStatus."',
SongPace = '".$ud_SongPace."',
Minutes = '".$ud_Minutes."',
YearRecorded = '".$ud_YearRecorded."',
YearWritten = '".$ud_YearWritten."',
RecordLabel = '".$ud_RecordLabel."',
Lyrics = '".$ud_Lyrics."',
active = '".$ud_active."'
WHERE id = '".$ud_id."'";
?>

also, you should always check for errors when you do a mysql_query function like this:

<?php
$result=mysql_query($query) or die("Problem with the update query: $query<br>" . mysql_error());
?>

 

If you had had the "or die" clause there originally, it would have reported the syntax error.

 

Another thing, you don't do any sort of validation on the user input, so you're opening yourself up for MySQL injection. At least pass each incoming value through mysql_real_escape_string. Here's how I would do this. I'm assuming then method in your form is being POST, not GET:

<?php
$qtmp = array();
foreach ($_POST as $fld => $val)
     if ($fld != 'ud_id' && $fld != 'submit')
         $qtmp[] = $fld . " = '" . mysql_real_escape_string($val) . "'";
$query = "UPDATE SongList SET " . implode(', ',$qtmp) . "where id = '" . mysql_real_escape_string($_POST['ud_id']) . "'";
$result=mysql_query($query) or die("Problem with the update query: $query<br>" . mysql_error());
?>

 

This is instead of the "$query =" statement.

 

Ken

Link to comment
Share on other sites

Ken, thank you for the extensive and thoughtful reply.

 

I used your "reverse the quotes" code and got this:

 

Parse error: parse error, unexpected '}' in /var/www/vhosts/MYSIte.com/httpdocs/datatube/songs_edit.php on line 140

 

[as a separate issue, can you tell my why a query like this DOES work with a different host? Is it the PHP.ini restrictions?]

 

Next: Where do I put the error check? Immediately after the query code we're trying to fix?

 

Last: Escape String: I am using POST. Does this code replace what we're working on, or where would it go.

 

Sorry I'm such a noob, gang. I REALLY appreciate the help.

Link to comment
Share on other sites

[as a separate issue, can you tell my why a query like this DOES work with a different host? Is it the PHP.ini restrictions?]

 

Output buffering may be on on your other host. But if it is, then I would suggest turning it off and replacing your code with this code when you get it all worked out. Output buffering slows down processing times and isnt recommended. People use it because they can't figure out where their problem is, but its not a very good solution to a problem and is usually just used by people who don't have the ability to figure out where there problem is.

Link to comment
Share on other sites

I think haku has a hang-up regarding output buffering (and thus ported his response from another post over here).

There are NO php.ini settings that define whether php sql strings take single (') or double (") quotes. This standard is set by SQL-92. Some settings in MySQL itself might allow double quote string encapsulation, and I know M$ products like to do this as well.

However for the sake of being correct please use the single quote (') to encapsulate strings in SQL queries. (i'm not talking about encapsulating strings in PHP so don't get these confused)

Link to comment
Share on other sites

aschk, I honestly understand little about all this!! What you wrote was pretty much Greek to me!! Please don't worry about clarifying.

 

Ken, I did some double-checking to make sure I'd put your code where it was supposed to be, etc. The error is now showing on line 141. In my editor, I don't see a line 141. Hmmmm....

 

<?php include_once("security/SECsecurity.php"); ?>
<?php $DOCROOT = $_SERVER['DOCUMENT_ROOT'] ; ?>
<?
$id = $_REQUEST["id"];
include("dbinfo.inc.php");
mysql_connect($dbhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
if (!empty($_REQUEST["submit"])) {
extract($_REQUEST);
if ($_REQUEST["submit"] == "Delete") {
     $query = "DELETE FROM SongList WHERE id=".$ud_id;
     $result=mysql_query($query);

header("Location: song_list.php?del=1");
   } else {
$query="UPDATE SongList SET 
active = '".$ud_active."',
SongTitle = '".$ud_SongTitle."',
ArtistPrimary = '".$ud_ArtistPrimary."',
ArtistSecondary = '".$ud_WriterPrimary."',
WriterSecondary = '".$ud_WriterSecondary."',
Contact_Info_ZipCode = '".$ud_RelatedURL."',
RelatedURL = '".$ud_Comments."',
PartOf = '".$ud_PartOf."',
SongStatus = '".$ud_SongStatus."',
SongPace = '".$ud_SongPace."',
Minutes = '".$ud_Minutes."',
YearRecorded = '".$ud_YearRecorded."',
YearWritten = '".$ud_YearWritten."',
RecordLabel = '".$ud_RecordLabel."',
Lyrics = '".$ud_Lyrics."',
active = '".$ud_active."'
WHERE id = '".$ud_id."'";
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML>
<HEAD>
<TITLE>Edit Request</TITLE>
    <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
   <META NAME="GOOGLEBOT" CONTENT="NOARCHIVE">
    <META NAME="ROBOTS" CONTENT="NONE">
    <LINK REL="stylesheet" TYPE="text/css" HREF="CSS/SEC.css">
</HEAD>
<?php   
$query='SELECT * FROM SongList where id = "'.$id.'"';
$result=mysql_query($query);
$num=mysql_numrows($result); 
mysql_close();
echo "<H1>Edit Song Details</H1>";
?>
<center><div style='width:100%; background-color:silver; text-align:right'>
  <?php SECShowAdminLink(); ?>
   
  <?php SECShowLogoutLink(); ?>  
</div></center>
<table border="1" cellspacing="2" cellpadding="2" width="800" class="sortable">
<tr> 
<th width="130">Song info</th>
<TH valign="top" width="30">Comments</TH>
<TH valign="top" width="30">Lyrics</TH>
<TH valign="top" width="30">Details</TH>
<th> </th>
</tr>

<?
$i=0;
while ($i < $num) {
$active=mysql_result($result,$i,"active");
$SongTitle=mysql_result($result,$i,"SongTitle");
$ArtistPrimary=mysql_result($result,$i,"ArtistPrimary");
$ArtistSecondary=mysql_result($result,$i,"ArtistSecondary");
$WriterPrimary=mysql_result($result,$i,"WriterPrimary");
$WriterSecondary=mysql_result($result,$i,"WriterSecondary");
$RelatedURL=mysql_result($result,$i,"RelatedURL");
$Comments=mysql_result($result,$i,"Comments");
$PartOf=mysql_result($result,$i,"PartOf");
$SongStatus=mysql_result($result,$i,"SongStatus");
$SongPace=mysql_result($result,$i,"SongPace");
$Minutes=mysql_result($result,$i,"Minutes");
$YearRecorded=mysql_result($result,$i,"YearRecorded");
$YearWritten=mysql_result($result,$i,"YearWritten");
$RecordLabel=mysql_result($result,$i,"RecordLabel");
$Lyrics=mysql_result($result,$i,"Lyrics");
$id=mysql_result($result,$i,"id"); 
?>


<form method="post">
<input type="hidden" name="ud_id" value="<? echo $id; ?>">
<tr> 
<td valign="top"><STRONG>Title:    <input type="text" name="ud_SongTitle" value="<? echo $SongTitle; ?>"><BR>
Artists: </STRONG><input type="text" name="ud_ArtistPrimary" value="<? echo $ArtistPrimary; ?>"><input type="text" name="ud_ArtistSecondary" value="<? echo $ArtistSecondary; ?>">
<BR>
Writers: <input type="text" name="ud_WriterPrimary" value="<? echo $WriterPrimary; ?>"><input type="text" name="ud_WriterSecondary" value="<? echo $WriterSecondary; ?>"><BR>
Status:  <input type="text" name="ud_SongStatus" value="<? echo $SongStatus; ?>"><BR>
<SMALL>1-On Playlist<BR>2-Needs Added<BR>3-No Track</SMALL><BR><BR>
Pace:    <input type="text" name="ud_SongPace" value="<? echo $SongPace; ?>"><BR>
<SMALL>Slow Medium Faster Smokin</SMALL>
</td>
<TD valign="top" width="30">
<textarea id="Comments" name="ud_Comments" rows="20" cols="40" wrap='physical'><?php echo $Comments; ?></textarea></TD>
<TD valign="top" width="30">
<textarea id="Lyrics" name="ud_Lyrics" rows="20" cols="40"  wrap='physical'><?php echo $Lyrics; ?></textarea></TD>
<TD valign="top" width="30">
<SMALL>Length:</SMALL>
<input type="text" name="ud_Minutes" value="<? echo $Minutes; ?>"><BR><BR>
<SMALL>Recorded in:</SMALL>
<input type="text" name="ud_YearRecorded" value="<? echo $YearRecorded; ?>"><BR><BR>
<SMALL>Year Written:</SMALL>
<input type="text" name="ud_YearWritten" value="<? echo $YearWritten; ?>"><BR><BR>
<SMALL>Year Written:</SMALL>
<input type="text" name="ud_RecordLabel" value="<? echo $RecordLabel; ?>"><BR><BR>
</TD>
<TD valign="top"> 
<?php    
$checked = $Active ? 'checked' :''; 
echo "active ? <input type='checkbox'' name='ud_active'' value='1' $checked>";
?>
</TD>
<TD rowspan="2" valign="top">
<CENTER><input type="submit" name="submit" value="Update">
<BR><BR><input type=button value="Cancel" onClick="history.go(-1)"><BR><BR>
<input type="submit" name="submit" value="Delete" onclick="return confirm('Are you sure you want to delete this record? This cannot be undone!')"></CENTER>
</form></TD>
</TR>
<TR>
<TD valign="top" colspan="2"><SMALL>Related URL:</SMALL><BR>
<textarea id="RelatedURL" name="ud_RelatedURL" rows="1" cols="50"  wrap='physical'><?php echo $RelatedURL; ?></textarea>
</TD>
<TD valign="top" colspan="2">
<SMALL>Part Of:</SMALL><BR>
<textarea id="PartOf" name="ud_PartOf" rows="1" cols="50"  wrap='physical'><?php echo $PartOf; ?></textarea>
</TD>
</TR>

<?
++$i;
} 
echo "</table><BR>";
?>

Link to comment
Share on other sites

I think haku has a hang-up regarding output buffering (and thus ported his response from another post over here).

 

Actually I think I made the comment here first.

 

But you are correct, I think its sloppy coding. Its just a band-aid because it doesn't fix a problem, it just kind of half-ass makes it work. Its the PHP equivalent of duct tape.

Link to comment
Share on other sites

This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.