php-general Digest 28 Apr 2006 09:34:56 -0000 Issue 4097
Topics (messages 234961 through 234980):
credit card purchase and downloads
234961 by: siavash1979.telus.net
234962 by: Stut
234963 by: siavash1979.telus.net
234964 by: Stut
234965 by: Stut
234967 by: siavash1979.telus.net
Re: php <-> js (was Javascript Navigation)
234966 by: Paul Novitski
234968 by: tedd
234969 by: Robert Cummings
234970 by: Paul Novitski
234976 by: Barry
234977 by: Barry
Re: Recommended PHP frameworks
234971 by: Jochem Maas
we are looking for experienced php programmers full time freelance...
234972 by: Sumeet
234973 by: Robert Cummings
234974 by: Sumeet
Re: Need help in identifying a PHP application.
234975 by: Ananth Kesari
converting nested hash to xml
234978 by: Anthony Ettinger
Includes and paths confusion
234979 by: Nick Wilson
234980 by: Jochem Maas
Administrivia:
To subscribe to the digest, e-mail:
[EMAIL PROTECTED]
To unsubscribe from the digest, e-mail:
[EMAIL PROTECTED]
To post to the list, e-mail:
[email protected]
----------------------------------------------------------------------
--- Begin Message ---
hi guys,
I'm planning to add paid downloads of some speech files on one of my customers
website. Basically I want people to be able to pay for a speech and then be able
to download it.
it's the first time I wanna do anything like this, so I was thinking to myself
to do it this way:
when they pay for a file, I generate a session, that includes file name and
username and is in md5 format. then I store this session to a mysql database.
anytime the customer wants to click on a file to download it, I'll make the same
session again and check the mysql table to see if it exists. if it does, then he
can download it.
the problem that I can think might happen is that the file names are not
changable. you can't rename a file, and if you delete it, and add another file
with the same name later, it'll give access to everyone.
Any idea if this is a good way to do this or not? any better suggestions? is
this secured?
thanks a lot,
Siavash Miri
--- End Message ---
--- Begin Message ---
[EMAIL PROTECTED] wrote:
<snipped a confusing idea>
Any idea if this is a good way to do this or not? any better suggestions? is
this secured?
I'm confused. What's wrong with having a table containing a row per
file, then having another table containing the users. Add a third table
containing two fields, username and fileid, which contains one row per
user per file they've purchased. When they try to download a file you
check against that table.
Maybe I'm missing the point of all the md5 crap. If so, please enlighten me.
-Stut
--- End Message ---
--- Begin Message ---
is that really secure?
I just thought if for any reason, someone can get into my database, they can't
just add usernames and file ids to my table and have access.
I thought if I md5 it, then it'll be more secured.
would 1 table for username-fileid really be fine?
thanks,
Sia
Quoting Stut <[EMAIL PROTECTED]>:
> [EMAIL PROTECTED] wrote:
> <snipped a confusing idea>
> > Any idea if this is a good way to do this or not? any better suggestions?
> is
> > this secured?
>
> I'm confused. What's wrong with having a table containing a row per
> file, then having another table containing the users. Add a third table
> containing two fields, username and fileid, which contains one row per
> user per file they've purchased. When they try to download a file you
> check against that table.
>
> Maybe I'm missing the point of all the md5 crap. If so, please enlighten me.
>
> -Stut
>
--- End Message ---
--- Begin Message ---
[EMAIL PROTECTED] wrote:
well is that a secure way? I thought if I use md5 and so on it'll make it more
secure and harder to hack.
would a table for user-fileid be good enough?
I don't really know why I thought it had to be secured, I just don't want it to
be eaily hacked.
Unless I'm not understanding your intended flow of data, it's no more or
less secure than your way, just a hell of a lot simpler. Everything
you're doing is happening on the server-side, as is everything I'm
doing. All that comes from the client-side is the username and the file
ID. Both methods have the same uncontrollable inputs and are therefore
basically the same from a security point of view.
-Stut
Quoting Stut <[EMAIL PROTECTED]>:
[EMAIL PROTECTED] wrote:
<snipped a confusing idea>
Any idea if this is a good way to do this or not? any better suggestions?
is
this secured?
I'm confused. What's wrong with having a table containing a row per
file, then having another table containing the users. Add a third table
containing two fields, username and fileid, which contains one row per
user per file they've purchased. When they try to download a file you
check against that table.
Maybe I'm missing the point of all the md5 crap. If so, please enlighten me.
-Stut
--- End Message ---
--- Begin Message ---
[EMAIL PROTECTED] wrote:
is that really secure?
I just thought if for any reason, someone can get into my database,
they can't just add usernames and file ids to my table and have
access.
I thought if I md5 it, then it'll be more secured.
would 1 table for username-fileid really be fine?
If they get that level of access to you database then most bets are off.
However, you are correct to a certain extent. If you one-way encrypt (if
MD5 can be called encryption) all your data then yes it will be more
secure, but to me that security comes at too high a cost from a
functionality point of view. You can't, for example, get a list of the
files a particular user has purchased.
But, as always, it's up to you and what you need for the particular
project. If you feel you need that extra security then go for it, but be
aware of the side-effects.
-Stut
--- End Message ---
--- Begin Message ---
Thank you very much Stut,
great points.
I didn't even think about wanting to display a list of files they have access
to. I guess I'll go with the simpler way and save myself a lot of overhead.
As I said, I've never made a site that had anything to do with money before,
this is the first time. I just wasn't sure what kinda security I need. I guess
as long as the credit card transactions are secured, I should be fine.
thanks again,
Siavash
thinkQuoting Stut <[EMAIL PROTECTED]>:
> [EMAIL PROTECTED] wrote:
> > is that really secure?
> >
> > I just thought if for any reason, someone can get into my database,
> > they can't just add usernames and file ids to my table and have
> > access.
> >
> > I thought if I md5 it, then it'll be more secured.
> >
> > would 1 table for username-fileid really be fine?
>
> If they get that level of access to you database then most bets are off.
> However, you are correct to a certain extent. If you one-way encrypt (if
> MD5 can be called encryption) all your data then yes it will be more
> secure, but to me that security comes at too high a cost from a
> functionality point of view. You can't, for example, get a list of the
> files a particular user has purchased.
>
> But, as always, it's up to you and what you need for the particular
> project. If you feel you need that extra security then go for it, but be
> aware of the side-effects.
>
> -Stut
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
--- End Message ---
--- Begin Message ---
At 10:33 AM 4/27/2006, tedd wrote:
Can js cycle reading cookies waiting for something to do while php
crons writing them as needed -- and vise-versa? Is that a viable
method of communication and activation between the two?
At 01:57 PM 4/27/2006, Paul Novitski wrote:
No, because cookie values are changed only on page submit & load.
Let me re-answer that. Yes, cookies are an acceptable method of
PHP-JavaScript communication -- when they're turned on in the client
-- but require a new page load to synchronize changed values between
client & server.
When I said "no" all I meant was that cookies don't work for
communicating PHP-to-JavaScript within a single page-view.
Paul
--- End Message ---
--- Begin Message ---
At 1:57 PM -0700 4/27/06, Paul Novitski wrote:
Okay, I understand how js and html can communicate with php -- but,
that's not the problem. My statement above was part of a
symmetrical requirement regarding communication.
Sorry -- "symmetrical"? Please elucidate, I'm not familiar with
this term in this context. Which factors need to be the same on
both sides of the Turing box lid for your criteria to be satisfied?
And
At 3:16 PM -0400 4/27/06, Robert Cummings wrote:
Communication need not be symmetrical. All that is required is that each
end understand one another.
Arrrgggg... my head hurts :-)
Okay, a little misunderstanding here.
In my statement of symmetrical requirements regarding communication I
basically said:
1. js -> php
2. php -> js
I was simply using symmetrical *statements* to illustrate my point. I
was not implying a requirement that all communications must be
symmetrical, understand?
Now, I know [1] that js can pass variables to php and cause it to run
-- I do that using ajax -- that's not a problem.
What I don't get is how php can pass variables to js and cause it to
run "at will". I can see how php can, and have used php to, generate
a web page which has <body onload="js()"> tag, which can pass a
variable to js and will cause js to execute. But, isn't there
anything else? Is that all there is?
Paul you said:
All this seems very obvious to me, but knowing your level of
sophistication with programming I'm led to suspect that perhaps I'm
not understanding your question properly.
Thanks for the compliment, but I can be as dumb as a post about
things until I fully understand them. However, everything you said I
understand.
I understand that XMLHttpRequest works -- I'm a little fuzzy about
how -- but, I have used it to both send data to php and to cause php
to execute. That's not a problem.
I also understand that php can generate html (have done it) and echo
out javascript that may, or may not, run if js is present -- like
Robert suggested in his WAHOOEY (LOL) example. But, that appears
messy to me. If php wants to say something to js, then a page must be
created -- it seems like a lot foreplay to get at the goodies.
I guess what I'm looking for is something simpler -- is there?
tedd
PS: WAHOOEY indeed -- LOL, I'm still chuckling about that.
--
--------------------------------------------------------------------------------
http://sperling.com
--- End Message ---
--- Begin Message ---
On Thu, 2006-04-27 at 19:39, tedd wrote:
> At 1:57 PM -0700 4/27/06, Paul Novitski wrote:
>
> >>Okay, I understand how js and html can communicate with php -- but,
> >>that's not the problem. My statement above was part of a
> >>symmetrical requirement regarding communication.
> >
> >Sorry -- "symmetrical"? Please elucidate, I'm not familiar with
> >this term in this context. Which factors need to be the same on
> >both sides of the Turing box lid for your criteria to be satisfied?
>
> And
>
> At 3:16 PM -0400 4/27/06, Robert Cummings wrote:
>
> >Communication need not be symmetrical. All that is required is that each
> >end understand one another.
>
> Arrrgggg... my head hurts :-)
>
> Okay, a little misunderstanding here.
>
> In my statement of symmetrical requirements regarding communication I
> basically said:
>
> 1. js -> php
> 2. php -> js
>
> I was simply using symmetrical *statements* to illustrate my point. I
> was not implying a requirement that all communications must be
> symmetrical, understand?
>
> Now, I know [1] that js can pass variables to php and cause it to run
> -- I do that using ajax -- that's not a problem.
>
> What I don't get is how php can pass variables to js and cause it to
> run "at will". I can see how php can, and have used php to, generate
> a web page which has <body onload="js()"> tag, which can pass a
> variable to js and will cause js to execute. But, isn't there
> anything else? Is that all there is?
>
> Paul you said:
>
> >All this seems very obvious to me, but knowing your level of
> >sophistication with programming I'm led to suspect that perhaps I'm
> >not understanding your question properly.
>
> Thanks for the compliment, but I can be as dumb as a post about
> things until I fully understand them. However, everything you said I
> understand.
>
> I understand that XMLHttpRequest works -- I'm a little fuzzy about
> how -- but, I have used it to both send data to php and to cause php
> to execute. That's not a problem.
>
> I also understand that php can generate html (have done it) and echo
> out javascript that may, or may not, run if js is present -- like
> Robert suggested in his WAHOOEY (LOL) example. But, that appears
> messy to me. If php wants to say something to js, then a page must be
> created -- it seems like a lot foreplay to get at the goodies.
>
> I guess what I'm looking for is something simpler -- is there?
There isn't something simpler, but that is necessitated by the stateless
nature of the web, and the security requirements of the client (the poor
sucker browsing the net :) I understand your desire for the simplicity
of a desktop application, but anonymous data sources and trust aren't
usually compatible. In the web paradigm the both the user and the server
need to distrust one another by default which isn't the case for bought
from a reputable, honest to goodness real live person, manually
installed desktop application *grin*. Although, can't say I trust MS
much.
> PS: WAHOOEY indeed -- LOL, I'm still chuckling about that.
It was nice of PHP to let us name our heredoc delimiters. I guess the
standard is EOF, but why write boring code ;)
Cheers,
Rob.
--
.------------------------------------------------------------.
| InterJinn Application Framework - http://www.interjinn.com |
:------------------------------------------------------------:
| An application and templating framework for PHP. Boasting |
| a powerful, scalable system for accessing system services |
| such as forms, properties, sessions, and caches. InterJinn |
| also provides an extremely flexible architecture for |
| creating re-usable components quickly and easily. |
`------------------------------------------------------------'
--- End Message ---
--- Begin Message ---
At 04:39 PM 4/27/2006, tedd wrote:
What I don't get is how php can pass variables to js and cause it to
run "at will".
Do you mean the way one function can call another function within the
same program?
It sounds like you're picturing PHP & JavaScript executing
continuously & simultaneously. You aren't, are you?
JavaScript can execute a PHP program "at will" simply by requesting a
PHP page from the server. PHP can execute a JavaScript function "at
will" simply by downloading it (with at least minimal HTML markup) to
a browser.
That seems pretty simple & direct to me, considering that they're
running in different computers.
I can see how php can, and have used php to, generate a web page
which has <body onload="js()"> tag, which can pass a variable to js
and will cause js to execute. But, isn't there anything else? Is
that all there is?
...
I also understand that php can generate html (have done it) and echo
out javascript that may, or may not, run if js is present -- like
Robert suggested in his WAHOOEY (LOL) example. But, that appears
messy to me. If php wants to say something to js, then a page must
be created -- it seems like a lot foreplay to get at the goodies.
Without a downloaded page, what goodies are there?
You know, you can download pure JavaScript, dressed only in a script
tag, to a browser and have it execute without carrying with it a
whole HTML page. Is that what you're looking for? What would such a
script accomplish that a PHP program couldn't? I suppose it could
interact with the human user with prompts, alerts, and confirms;
gather information about the client such as monitor & window size;
grab local time to compare to server time. What else? If it has to
create DOM nodes to interact with the user, haven't you come full
circle and shouldn't you just download an HTML page to be
JavaScript's environment?
I guess what I'm looking for is something simpler -- is there?
Paint me a picture of a hypothetical simpler situation; I'm intrigued.
Paul
--- End Message ---
--- Begin Message ---
Robert Cummings schrieb:
On Thu, 2006-04-27 at 11:09, Barry wrote:
tedd schrieb:
Hi gang:
Gang?
You know... Scooby, Shaggy, and Mary-Jane.
ah, ic.
1. A way to send information from js to php and have php act upon it.
Java
... Sucks.
Because?
2. A way to send information from php to js and have js act upon it.
Java
... Sucks :)
Because?
--
Smileys rule (cX.x)C --o(^_^o)
Dance for me! ^(^_^)o (o^_^)o o(^_^)^ o(^_^o)
--- End Message ---
--- Begin Message ---
tedd schrieb:
At 5:09 PM +0200 4/27/06, Barry wrote:
tedd schrieb:
Hi gang:
Gang?
Gang, group, clan, community, organization, hive, pod, assembly,
biocenosis -- what do you want to be called?
By my name normally. And if you adress everyone i prefer "everyone"
Show me.
function jstojava()
{
// sending stuff to the applet
}
<html>
Javaapplet containing Java that gives infos to PHP through an openened
PHP socket. PHP giving stuff back
</html>
Java executes a JS with the vars given by php
--
Smileys rule (cX.x)C --o(^_^o)
Dance for me! ^(^_^)o (o^_^)o o(^_^)^ o(^_^o)
--- End Message ---
--- Begin Message ---
Robert Cummings wrote:
A funny PHPClasses article...
http://www.phpclasses.org/blog/post/52-Recommended-PHP-frameworks.html
I find it telling that the guy who runs the PHP Classes site only uses
his own code *lol*. Oh btw, the article says virtually nothing useful
about frameworks, but it does go a long way to pimp Manuel's own classes
-- another oddity considering it leads with a blurb about recognizing
bias when you read it ;;) I want my 5 minutes back!!
my eyes started to bleed way before 5 minutes was up - it's the
blue-on-blue-on-blue
that does it too me everything. :-P
Cheers,
Rob.
--- End Message ---
--- Begin Message ---
we are looking for experienced php/mysql programmers full time freelance...
should be at least 1 year experienced, knowing pear libraries and having
worked on several projects.
please contact me at [EMAIL PROTECTED]
quote your charges and the time that you will be available. also mention
msn or yahoo ids. skype id is more welcome.
--
Thanking You
Sumeet Shroff
http://www.prateeksha.com
Web Designers and PHP / Mysql Ecommerce Development
--- End Message ---
--- Begin Message ---
On Thu, 2006-04-27 at 22:47, Sumeet wrote:
> we are looking for experienced php/mysql programmers full time freelance...
>
> should be at least 1 year experienced, knowing pear libraries and having
> worked on several projects.
>
> please contact me at [EMAIL PROTECTED]
>
> quote your charges and the time that you will be available. also mention
> msn or yahoo ids. skype id is more welcome.
What about a MUD? I'm usually logged into a mud. It's a great place for
my clients to come chat with me about projects. There's nothing like
talking about deploying some web project when suddenly a brawl breaks
out between the trolls and gnomes. Seriously though :)
telnet wocmud.org 4000
Life has been good, I've never had a client force a messenger on me. Who
needs constant paging when there's work to do. And yes, some of them do
log into the MUD to talk about projects :) We enjoy a nice keg of ale
while we chat. Email is the communication of choice, phone if something
is urgent.
Cheers,
Rob.
--
.------------------------------------------------------------.
| InterJinn Application Framework - http://www.interjinn.com |
:------------------------------------------------------------:
| An application and templating framework for PHP. Boasting |
| a powerful, scalable system for accessing system services |
| such as forms, properties, sessions, and caches. InterJinn |
| also provides an extremely flexible architecture for |
| creating re-usable components quickly and easily. |
`------------------------------------------------------------'
--- End Message ---
--- Begin Message ---
Robert Cummings wrote:
quote your charges and the time that you will be available. also mention
msn or yahoo ids. skype id is more welcome.
What about a MUD? I'm usually logged into a mud. It's a great place for
telnet wocmud.org 4000
hi robert,
thanks for the info... but a MUD? ...for doing business?
anyway i used the MUD....and remembered the time on the BBS...(Bulletin
Board Service)
thanks...
--
Thanking You
Sumeet Shroff
http://www.prateeksha.com
Web Designers and PHP / Mysql Ecommerce Development, Mumbai India
--- End Message ---
--- Begin Message ---
Hi,
Thanks a lot for all the inputs. I will take it further from here.
Thanks,
Ananth.
>>> "Richard Lynch" <[EMAIL PROTECTED]> 4/27/2006 4:06:03 pm >>>
On Thu, April 27, 2006 4:21 am, Ananth Kesari wrote:
> I have a need for an idea management PHP application that gives me
an
> UI with multiple fields (text boxes, radio buttons etc.) which
> correspond to different columns of a MySQL database. An user
initiates
> this by clicking on an URL, fills in certain fields and submits the
> form. This then creates the tables and should send out a mail to
> certain
> mail ids that there is a new entry. At a later point of time someone
> else can enter info into certain fields (columns of the tables)
giving
> the same id as it was created. He should not be able to meddle with
> the
> original fields that user1 had entered. Another user can come at
even
> later stage and enter info into a few more fields (columns of the
> tables). All these fields are created at the first stage itself
since
> we
> will be fixing the number of fields.
>
> Can you let me know of any application that does all these? If this
is
> a wrong forum to ask this type of question, can you tell me where I
> can
> post this query?
phpMyAdmin does a whole lot of this kind of stuff, and has a huge
install-base...
Seems to me that if you rig your database so that later users can't
use ALTER TABLE (nor DROP TABLE) then you're pretty much done.
It's not a real pretty front-end, though, in terms of clueless users,
as it was designed for people who had some idea about how databases
worked.
Other than that, I got nothing in mind that sounds like what you want,
though I suspect most of the CMSes are kind of sort of like that, to
some degree...
You can give a BUNCH of CMS thingies a trial run here:
http://opensourcecms.com/
And I suspect that their forums would be a better place to ask the
original question, as their experts on a plethora of CMSes would know
what most closely matches your needs.
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
Is there a standard way of converting a nested hash/multidimensional
array to an xml tree?
My hash looks like:
$foo = array(
bar1 => array(
baz1 => array(
title => "Some Title",
text => "Some Text",
),
bazN => array(...),
),
bar2 => array (...),
barN => array(...),
);
would want the output to be something like:
<foo>
<bar1>
<baz1>
<title>Some Title</title>
<text>Some Text</text>
</baz1>
<baz2>
<title>Some Title2</title>
<text>Some Text2</text>
</baz2>
</bar1>
<barN>...</barN>
</foo>
--
Anthony Ettinger
Signature: http://chovy.dyndns.org/hcard.html
--- End Message ---
--- Begin Message ---
Hello all,
Im having some problems understanding why some requires() are failing.
Let me see if i can describe what's going on clearly...
I have this:
[EMAIL PROTECTED] > ls
ads/ config.inc db.inc funcs.inc init.inc
where ads/ is a whole huge set of scripts from an existing setup. ads/
was originally placed on its own domain as it's a version of phpadsnew
and runs as a server all by itself.
I moved ads/ to this directory to try to troubleshoot and make things
clearer.
db.inc has these lines:
require_once("ads/admin/config.php");
require_once("lib-statistics.inc.php");
require_once("lib-zones.inc.php");
require_once("config.inc.php");
require_once("lib-db.inc.php");
require_once("lib-dbconfig.inc.php");
warning: main(../config.inc.php): failed to open stream: No such file or
directory in
/var/www/localhost/vhosts/payment.communicontent.com/modules/partners/inc/ads/admin/config.php
on line 33.
Fatal error: main(): Failed opening required '../config.inc.php'
(include_path='.:/usr/lib/php') in
/var/www/localhost/vhosts/payment.communicontent.com/modules/partners/inc/ads/admin/config.php
on line 33
So, why does this not happen when ads/ is on its own domain? I can see
it has something to do with relative paths, but even when i try to work
with chdir() i still get no joy.
I just can't figure out what the issue may be, so any pointers in the
right direction would be hugely appreciated.
thankyou!
--
Nick Wilson
Tel: +45 3311 2250
--- End Message ---
--- Begin Message ---
Nick Wilson wrote:
Hello all,
Im having some problems understanding why some requires() are failing.
Let me see if i can describe what's going on clearly...
I have this:
[EMAIL PROTECTED] > ls
ads/ config.inc db.inc funcs.inc init.inc
where ads/ is a whole huge set of scripts from an existing setup. ads/
was originally placed on its own domain as it's a version of phpadsnew
and runs as a server all by itself.
I moved ads/ to this directory to try to troubleshoot and make things
clearer.
db.inc has these lines:
use something *like* the following:
$oldincpath = ini_get('include_path');
ini_set('include_path', 'path/to/ads/stuff:etc');
// do your 'ads' requires
ini_set('include_path', $oldincpath);
also look into the magic constant __FILE__ and the functions dirname()
and realpath(). read the manual regard how to use 'include_path'
have fun.
require_once("ads/admin/config.php");
require_once("lib-statistics.inc.php");
require_once("lib-zones.inc.php");
require_once("config.inc.php");
require_once("lib-db.inc.php");
require_once("lib-dbconfig.inc.php");
warning: main(../config.inc.php): failed to open stream: No such file or
directory in
/var/www/localhost/vhosts/payment.communicontent.com/modules/partners/inc/ads/admin/config.php
on line 33.
Fatal error: main(): Failed opening required '../config.inc.php'
(include_path='.:/usr/lib/php') in
/var/www/localhost/vhosts/payment.communicontent.com/modules/partners/inc/ads/admin/config.php
on line 33
So, why does this not happen when ads/ is on its own domain? I can see
it has something to do with relative paths, but even when i try to work
with chdir() i still get no joy.
I just can't figure out what the issue may be, so any pointers in the
right direction would be hugely appreciated.
thankyou!
--- End Message ---
