php-general Digest 1 May 2006 12:49:16 -0000 Issue 4103
Topics (messages 235172 through 235189):
Re: trying to download birary data
235172 by: Richard Lynch
235180 by: benmoreassynt
Re: Picture for Form Security
235173 by: Richard Lynch
235175 by: Chris
235179 by: Manuel Lemos
Re: OOP Static Functions vs. Objects
235174 by: Richard Lynch
Re: problem with mktime
235176 by: Richard Lynch
Re: undefined variable
235177 by: Richard Lynch
Re: c99shell
235178 by: Richard Lynch
235188 by: Wolf
Re: we are looking for experienced php programmers full time freelance...
235181 by: Sameer N Ingole
Zend refuses to include file while parser finds it
235182 by: Nicolas Verhaeghe
235183 by: Paul Novitski
235184 by: Jochem Maas
Session - when they expirate ?
235185 by: Martin Zvarík
Filesystem or database
235186 by: Ryan A
235187 by: Wolf
235189 by: Dave Goodchild
Administrivia:
To subscribe to the digest, e-mail:
[EMAIL PROTECTED]
To unsubscribe from the digest, e-mail:
[EMAIL PROTECTED]
To post to the list, e-mail:
[email protected]
----------------------------------------------------------------------
--- Begin Message ---
If you use a text editor to look at your PDF, you will see this on the
first line:
id is 45%PDF-1.4^[34m^M%âãÏÓ^[34m^M
The debug output "id is 45" is not going to make any PDF reader/viewer
happy, in a big way.
I dunno what else might be wrong, but that's gotta get fixed first and
foremost.
On Sun, April 30, 2006 10:31 am, Ross wrote:
> On this page
> http://www.nationalservicesscotland.com/publications/a-z.php
>
> I use the following code to donwload binary data. It is jsut
> gibberish. I
> think the offending line is echo "<a class=\"pdflinks\"
> href=\"$link\"</a>$name</span>";
>
> How do I recompile the binaryy data into docs and pdfs?
>
>
> <?
> $letter="a";
> $query= "SELECT * FROM publications WHERE alphabet='$letter'";
>
> $result= mysql_query($query);
> while ($row = @mysql_fetch_array($result, MYSQL_ASSOC)){
>
> $row['pdf_size'] = $row['pdf_size']/ 1024;
> $row['pdf_size']= number_format($row['pdf_size'], 0);
> $size= $row['pdf_size'];
> $name = str_replace("_", " ", $row['pdf_name']);
> $name = str_replace(".pdf", "", $name);
> $link= $row['content'];
>
> echo "<a class=\"pdflinks\" href=\"$link\"</a>$name</span>";
> echo " ";
> echo "<span class=\"sizes\">($size kb)</span>";
> ?><a href="a-z.php?id=<?=$row['id'];?>">link</a> <br>
>
>
> <?
> }
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
Ross wrote:
> On this page
> http://www.nationalservicesscotland.com/publications/a-z.php
>
> I use the following code to donwload binary data. It is jsut gibberish. I
> think the offending line is echo "<a class=\"pdflinks\"
> href=\"$link\"</a>$name</span>";
>
Seeing as you are echoing a simple html anchor, I can see no reason why the
pdfs don't download in the correct fashion. Have you tried - just for
testing purposes - trying it in HTML to see if it downloads? If that does
not work it could be that your server is sending the wrong MIME type.
You have a few typos in the html by the way, which can't be helping ...
<a class=\"pdflinks\"> href=\"$link\"</a>$name</span>
should be
<span><a class\"pdflinks\" href=\"$link\">$name</a></span>
I doubt it will work as you have it here.
You can also use something like this to open files requested in a form, to
avoid HTML altogether. For the sake of full disclosure, a friend wrote this
PHP, not me, but it works!
if(isset($_POST["openfile"])) //filename choice passed from HTML form
{
$openfile = $_POST["openfile"];
$pdf = "/path/to/pdfs/$openfile"; // the pdf to use
$newname = basename($pdf); // remove the directories
$size = filesize($pdf); // get the size of the file
header("Content-Length: $size"); // send the size
header("Content-Type: application/pdf"); // mime type
header("Content-Disposition: attachment; filename=$newname"); // force
//download as newname
readfile($pdf); // output file
}
The file will be downloaded without the user seeing the location.
BMA
--- End Message ---
--- Begin Message ---
Google for CAPTCHA
On Sun, April 30, 2006 7:37 pm, [EMAIL PROTECTED] wrote:
> Does anyone know of a good script for form security, where someone
> goes to
> login and then they have to type a number, disabling automated scripts
> from
> logging in versus a physical user. It is widely used by domain
> registrars
> who protect the identity of a domain name.
>
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
[EMAIL PROTECTED] wrote:
Does anyone know of a good script for form security, where someone goes to
login and then they have to type a number, disabling automated scripts from
logging in versus a physical user. It is widely used by domain registrars
who protect the identity of a domain name.
I'm not sure if you mean to stop comment spam, in which case search for
captcha on your favourite search engine.
Pear has a package:
http://pear.php.net/package/Text_CAPTCHA
If you mean the actual id's, then they would most likely come from the
database (so id '110953' would be person 'X', '1106594' would be person
'Y'). There's no particular magic there.
--
Postgresql & php tutorials
http://www.designmagick.com/
--- End Message ---
--- Begin Message ---
Hello,
on 04/30/2006 09:37 PM [EMAIL PROTECTED] said the following:
> Does anyone know of a good script for form security, where someone goes to
> login and then they have to type a number, disabling automated scripts from
> logging in versus a physical user. It is widely used by domain registrars
> who protect the identity of a domain name.
You may want to try this forms generation and validation class that
comes with a CAPTCHA validation input. It shows a validation image with
a fuzzy text that needs to be entered in text input . It also shows a
redraw button to make the text be rendered again in case cannot
understand it.
Since it is part of a forms generation class that can generate forms of
many types of inputs, it is ideal to integrate in more complex forms
with fields for other purposes like submiting comments or contact forms.
http://www.phpclasses.org/formsgeneration
--
Regards,
Manuel Lemos
Metastorage - Data object relational mapping layer generator
http://www.metastorage.net/
PHP Classes - Free ready to use OOP components written in PHP
http://www.phpclasses.org/
--- End Message ---
--- Begin Message ---
Instantiating an object does have some extra overhead that the static
call bypasses.
How much overhead depends on the complexity of the object, I would
predict that it's mainly in its constructor and any parent
constructors.
I can't speak to differences in PHP4/PHP5 in this specific regard, but
would make a wild guess that they would not be THAT different in
performance if the thing works in both.
On Sun, April 30, 2006 9:12 am, Edward Vermillion wrote:
> I'm still trying to get my head around all the OOP stuff and was
> wondering if there is any basic difference between calling a static
> function as opposed to creating an object, in situations where both
> methods will do the same thing for you. Is there any overhead to
> creating an object from a class that might impact time/memory
> consumption(efficiency), or does PHP treat these two methods the
> same? I'm currently working with PHP4 but am also curious as to how
> it works in PHP5.
>
> I.E.:
>
> <pseudoCode>
> class Foo {
>
> var $_vars = array();
>
> function &setVar1($var) {
> static $localVars = array();
> if (!empty($localVars[$var])) {
> return $localVars[$var];
> } else {
> $localVars[$var] =& new $var();
> return $localVars[$var];
> }
> }
>
> function &setVar2($var) {
> if (!empty($this->_vars[$var])) {
> return $this->_vars[$var];
> } else {
> $this->_vars[$var] =& new $var();
> return $this->_vars[$var];
> }
> }
> }
>
> $result1 =& Foo::setVar1('something');
>
> $bar = new Foo();
> $result2 =& $bar->setVar2('something');
> </pseudoCode>
>
> Right now I'm working on an object controller type of class, but I
> can see where I might run into this situation in other areas where
> storing a value in a static function variable or a class variable
> would accomplish much the same thing as far as the calling code is
> concerned.
>
> Any thoughts?
>
> Ed
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
On Sun, April 30, 2006 6:38 am, Ross wrote:
> I am using this to compare todays date with dates retieved from a
> database.
> The problem is it seem to retrun the same value for the $then variable
>
> and can be seen ot working here....
>
> http://nationalservicesscotland.com/cms/time.php
>
>
> <?
>
> session_start();
> include ('../shared/connect.php');
>
> $query= "SELECT headline, id, expiry, link FROM events";
Instead of fighting with mktime and using PHP logic to discard data
you pull through the narrow pipe from MySQL to PHP, why not just
construct your query to return what you want?
SELECT substring(headline, 1, 80), length(substring(headline, 80, 1))
as ellipsis, id, link FROM events where expiry >= now()";
You can use $row['ellipsis'] to decide to print "..." or not for the
headline itself.
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
On Sun, April 30, 2006 6:17 am, Smart Software wrote:
> while(query )//here the query is opened
Please, JUST post your real code in http://pastebin.com or something!
We CANNOT figure out what the [bleep] you really have from this!
> {
> <table ">
> <tr>
> <td ><?php query->name ?> </td> // record from database
> <td > Please fill in your age:</td> //text
> <td "><input name="age" type="text" </td> //textbox,
> <td ><a href="<? echo
> "otherform.php?age=PLACE_HERE_THE_VALUE_FROM_QUANTITY_TEXTBOX&name=query->name";
> ?> "</td>
> </tr>
> </table>
> }
>
> how can i get the value from the textbox? i don't have form tag
> if i have 50 records, there are 50 textboxes named "age" right?
If you want 30 boxes named 'age', then you should name them like:
name="age[]" or, possible, name="age[42]" where 42 is the ID of the
record whose age is being displayed/input.
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
On Sun, April 30, 2006 12:31 am, scot wrote:
> Hi there,
> Not sure if this is proper place to post but here it goes. We got
> nailed by
> someone using c99shell today. They were able to upload and overwrite a
> bunch
> of index files. I am working on discovering how they were able to get
> it on
> our server. Here's some basic info. I am by no means a php expert.
> Should
> things be different? Is there a good paper out there somewhere in
> regards to
> windows / iis5 / php security?
I know nothing about c99shell, but I can tell you...
> php 4.4.1
> Safe Mode: OFF
> Open basedir: none
This should be a directory starting with C:\ and ending in a directory
where PHP can have a "workspace" to read/write files, and that
directory (and sub-dirs) should be exclusively reserveed for PHP data.
> Display Errors: ON
This is bad on a production server.
It exposes too much of your internal workings to Bad Guys.
> Short Open Tags: ON
Turn them off, not for security, but for compatibility with other
servers where they will be off.
> File Uploads: ON
Do you USE file uploads?...
Turn them off, if not.
> Magic Quotes: ON
This should be off so you can sanitize your input data, and then use
http://php.net/mysql_real_escape_string
> Register Globals: ON
OFF OFF OFF!!!
Unless you can guarantee your PHP code is 100% perfect with every
variable always initialized, including any PHP software you
download/install, then this MUST be turned OFF!
> Output Buffering: OFF
> Session save path: e:\PHP\sessiondata
This may need to be within open_basedir...
> Session auto start: 0
> XML enabled: Yes
> Zlib enabled: Yes
> Disabled Functions: none
>
> Here is also a snip of log (altered IP's and URL) of what I think is
> the
> hack of the site. (I could be wrong)
>
> 2006-04-29 23:47:46 x.x.x.x - x.x.x.x 80 GET /index.html - 200 0 958
> 105 172
> HTTP/1.0 www.blah.com Wget/1.9.1 - -
> 2006-04-29 23:49:32 x.x.x.x - x.x.x.x 80 GET /index.html - 200 0 953
> 122 297
> HTTP/1.1 www.blah.com libwww-perl/5.805 - -
Errrr. It's unlikely in the extreme that 2 GETs messed you up...
And somebody wrote a perl script to do something, but you haven't told
us what on that last line...
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
I got smacked by it as well. File-upload area that they uploaded a
.php.rar file and then accessed the sucker (must have reconfigured their
browser for handling?).
At any rate, my file-upload area now is a file-upload and you can't
access it anymore area. It lists it, but... you can't play with it.
Might I remind everyone... BACKUP YOUR IMPORTANT STUFF NIGHTLY
For anyone who wants a copy of c99 (or 2 other variants), let me know
and I will email them to you. I have spent hours working with some of
the more obscure and stronger security settings but was still able to
use them, which is my file-upload area is now rigged the way that it is.
Wolf
scot wrote:
> Hi there,
> Not sure if this is proper place to post but here it goes. We got nailed by
> someone using c99shell today. They were able to upload and overwrite a bunch
--- End Message ---
--- Begin Message ---
tedd wrote:
<rant>
[snip]
However, considering the experiences I've had with Indians,
Hope you are serious about this sentence.. Out of entire Indian
population, there are ~750,000 IT professionals. How many did you meet?
Out of these how many experiences were bad/worse?
I don't mean to sound racist, but "I have found" there is a
significant difference between our cultures with respect to the
meaning of "your word" -- and as such, I will not do business with any
Indian company NOR with any company (domestic or overseas) that hires
an Indian to negotiate a contract!
"I have found" it is simply a waste of my time to try to find
profitable common ground. They are concerned with one thing, and one
thing only, and that is how cheap can they get it
Ooh, I am starting to wonder why numerous US companies have there BPOs
and Call Centers in India (leave software factories alone) if the motive
is not cheap (as in cost) service for the kind of quality they get vs
what they would get their own country.
-- and they seldom have a clue as to what "it" is -- but, contrary to
their lip-service, it certainly isn't quality.
I have seen them waste several million dollars to save less than ten
thousand (no lie). It was with an oil deal, not programming, and these
people were just plain stupid.
.. and your this conclusion is based on how many such incidences..? One?
Two?
I have seen several cases where police held US citizens for illicit
trafficking, child pornography (in Goa) etc. Can I extrapolate these
instances to draw some conclusion about entire country?
</rant>
--
Sameer N. Ingole
Blog: http://weblogic.noroot.org/
---
Better to light one candle than to curse the darkness.
--- End Message ---
--- Begin Message ---
When I run the Zend debugger, it returns an error telling me it cannot find
a certain include, while when I run the site it works fine.
My development machine is a WIMP (the server is a LAMP but it's not relevant
here).
This is not the first include in this site, but the first include inside of
an include:
require("includes/initiate.php");
I have tried pretty much everything:
require("initiate.php");
require("/includes/initiate.php");
require("./initiate.php");
And a few others more exotic.
The error I get is:
Debug Warning: C:\Inetpub\wwwroot\bfbb\includes\pages\header.php line 3 -
main(includes/initiate.php): failed to open stream: No such file or
directory
Compile Error: C:\Inetpub\wwwroot\bfbb\includes\pages\header.php line 3 -
main(): Failed opening required 'includes/initiate.php'
(include_path='.;c:\php4\pear')
The include initiate.php calls a bunch of functions and classes.
Should I change the include_path to make Zend understand where to look? And
why don't I get the error message with the previous includes?
I am testing Zend to determine if it is good environment (currently using
Dreamweaver, which is not that bad, but I heard that Zend is the reference).
Thanks for the help!
--- End Message ---
--- Begin Message ---
At 01:06 AM 5/1/2006, Nicolas Verhaeghe wrote:
When I run the Zend debugger, it returns an error telling me it cannot find
a certain include, while when I run the site it works fine.
...
The error I get is:
Debug Warning: C:\Inetpub\wwwroot\bfbb\includes\pages\header.php line 3 -
main(includes/initiate.php): failed to open stream: No such file or
directory
Compile Error: C:\Inetpub\wwwroot\bfbb\includes\pages\header.php line 3 -
main(): Failed opening required 'includes/initiate.php'
(include_path='.;c:\php4\pear')
Could it have anything to do with the difference between
forward-slashes on the net and back-slashes on a local computer?
Paul
--- End Message ---
--- Begin Message ---
Nicolas Verhaeghe wrote:
When I run the Zend debugger, it returns an error telling me it cannot find
a certain include, while when I run the site it works fine.
My development machine is a WIMP (the server is a LAMP but it's not relevant
here).
there is a world of difference between IIS and Apache - might I suggest you
install a copy of apache on your local machine and use that instead, it
would rule out another difference between the dev and production envs.
This is not the first include in this site, but the first include inside of
an include:
require("includes/initiate.php");
I have tried pretty much everything:
require("initiate.php");
require("/includes/initiate.php");
require("./initiate.php");
And a few others more exotic.
The error I get is:
Debug Warning: C:\Inetpub\wwwroot\bfbb\includes\pages\header.php line 3 -
main(includes/initiate.php): failed to open stream: No such file or
directory
Compile Error: C:\Inetpub\wwwroot\bfbb\includes\pages\header.php line 3 -
main(): Failed opening required 'includes/initiate.php'
(include_path='.;c:\php4\pear')
The include initiate.php calls a bunch of functions and classes.
Should I change the include_path to make Zend understand where to look? And
why don't I get the error message with the previous includes?
I am testing Zend to determine if it is good environment (currently using
Dreamweaver, which is not that bad, but I heard that Zend is the reference).
I have seen problems with Zend Server/Debugger related to includes/requires
failing
where the file definitely does exist. the 'solution' in the cases where I was
party was always
to restart apache - I'd add that I've only ever seen this happen on windows
boxes
(local development).
It might be worth reinstalling everything and getting the apache2/php5 up2date
(and ofcourse installing the correct version of the zend extensions) so that
your working with
a clean slate.
Thanks for the help!
--- End Message ---
--- Begin Message ---
Hi,
I was looking all over the internet and I don't understand when and
how does the PHP session expirate.
I suppose that it happens when the user is inactive.
On my website I don't use cookies for session and it has standard
php.ini configuration:
session.gc_maxlifetime = 1440
session.gc_divisor = 100
session.gc_probability = 1
session.cache_expire = 180
So, does this mean, that if the visitor is 180 minutes inactive it
automatically deletes the session ??
Thanks,
Martin
--- End Message ---
--- Begin Message ---
Hi,
This is just a quick query as I am bit doubtful of the
result..
basically, I get the username and ip of a person who
logs into a remote site and i have to save this data
(please note that this would be thousands of logins)
so I was wondering if it would be better to save the
username and ip as an empty file where the filename
contains both...
e.g:
<username>:<ip>
or in plain english:
my_username:201.1.1.22
This would save me in hundreds/thousands of calls to
the database and would (in theory) be faster as I
would be accessing the filesystem instead of the
DB....
Right?
Sometimes i get no username but just the ip address,
in which case I will first have to see if this IP is
already "logged" by me, and if yes, match the username
to the ip.
All usernames:ips expire in 1-24 hrs, I will be
running a cron to 'cull' these dead logins.
Am I on the right track or is it too much of a hassle
and just go in for the database option?
Thanks!
Ryan
------
- The faulty interface lies between the chair and the keyboard.
- Creativity is great, but plagiarism is faster!
- Smile, everyone loves a moron. :-)
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
--- End Message ---
--- Begin Message ---
Personally I would do the DB option and timestamp that sucker as well.
I use it to set/copy :IP, user, SessionID, timestamp. I found it
simpler and easier as I was already using the database anyways, so
another call to it was not going to kill me. And with having the
timestamp in the field as well, then the script that adds the new IP I
configured to delete ones that had expired so it did double-duty for me.
As for the no login, only IP, it was easier to track with the DB fields
for me.
YMMV, but I HTH.
Wolf
Ryan A wrote:
> Hi,
> This is just a quick query as I am bit doubtful of the
> result..
>
<-- SNIP -->
--- End Message ---
--- Begin Message ---
Also, try using mysql_pconnect rather than mysql_connect to set up a
persistent database connection.
On 01/05/06, Wolf <[EMAIL PROTECTED]> wrote:
Personally I would do the DB option and timestamp that sucker as well.
I use it to set/copy :IP, user, SessionID, timestamp. I found it
simpler and easier as I was already using the database anyways, so
another call to it was not going to kill me. And with having the
timestamp in the field as well, then the script that adds the new IP I
configured to delete ones that had expired so it did double-duty for me.
As for the no login, only IP, it was easier to track with the DB fields
for me.
YMMV, but I HTH.
Wolf
Ryan A wrote:
> Hi,
> This is just a quick query as I am bit doubtful of the
> result..
>
<-- SNIP -->
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
--
http://www.web-buddha.co.uk
dynamic web programming from Reigate, Surrey UK (php, mysql, xhtml, css)
look out for project karma, our new venture, coming soon!
--- End Message ---
