Re: [PHP-DB] SQL injection

2015-06-21 Thread Richard
Date: Sunday, June 21, 2015 12:39:06 PM -0400 From: Aziz Saleh azizsa...@gmail.com On Sun, Jun 21, 2015 at 9:19 AM, Lester Caine les...@lsces.co.uk wrote: OK - this had no chance of success since publish_date_desc is processed using the _desc ( or _asc ) and any invalid data stripped

Re: [PHP-DB] SQL injection

2015-06-21 Thread Aziz Saleh
On Sun, Jun 21, 2015 at 9:19 AM, Lester Caine les...@lsces.co.uk wrote: OK - this had no chance of success since publish_date_desc is processed using the _desc ( or _asc ) and any invalid data stripped

Re: [PHP-DB] SQL injection

2015-06-21 Thread Mark Murphy
But what does your application do when it gets an invalid SQL statement? Maybe it is telling the attacker something important about your database so that they can compromise it with the appropriate injection. On 2:36PM, Sun, Jun 21, 2015 Lester Caine les...@lsces.co.uk wrote: On 21/06/15 18:55,

Re: [PHP-DB] SQL injection

2015-06-21 Thread Lester Caine
On 21/06/15 20:14, Mark Murphy wrote: But what does your application do when it gets an invalid SQL statement? Maybe it is telling the attacker something important about your database so that they can compromise it with the appropriate injection. It just defaults to the first news article in

Re: [PHP-DB] SQL injection

2015-06-21 Thread Lester Caine
On 21/06/15 18:55, Richard wrote: OK - this had no chance of success since publish_date_desc is processed using the _desc ( or _asc ) and any invalid data stripped sort_mode=publish_date_desc%20or%20(1,2)=(select*from(select%20n

Re: [PHP-DB] SQL Injection

2015-05-16 Thread Lester Caine
On 16/05/15 10:00, Karl DeSaulniers wrote: That does clarify things a bit better on both the @ question and prepared statements. Thank you for the link as well. So new question.. what is the best type of database to use for someone who wants to start small and grow big? My findings led me

Re: [PHP-DB] SQL Injection

2015-05-16 Thread Karl DeSaulniers
On May 16, 2015, at 8:42 AM, Lester Caine les...@lsces.co.uk wrote: On 16/05/15 10:00, Karl DeSaulniers wrote: That does clarify things a bit better on both the @ question and prepared statements. Thank you for the link as well. So new question.. what is the best type of database to use

Re: [PHP-DB] SQL Injection

2015-05-16 Thread Lester Caine
On 16/05/15 14:51, Karl DeSaulniers wrote: Interesting. I program in MySQL on a hosting plan by a third party. I have heard/read MySQL is not an enterprise solution, but for the basic business with say less than 100,000 customers, it does the job and well. Larger than that I had hear Postgres

Re: [PHP-DB] SQL Injection

2015-05-16 Thread Lester Caine
On 15/05/15 06:21, Karl DeSaulniers wrote: Oh ok. Now it makes a little more sense. I have worked in ASP before, but I am programming in PHP and MySQL at the moment. I am going to look into Prepared Statements. Thanks for your feedback. Just to clarify things a little here and explain

Re: [PHP-DB] SQL Injection

2015-05-16 Thread Karl DeSaulniers
On May 16, 2015, at 3:51 AM, Lester Caine les...@lsces.co.uk wrote: On 15/05/15 06:21, Karl DeSaulniers wrote: Oh ok. Now it makes a little more sense. I have worked in ASP before, but I am programming in PHP and MySQL at the moment. I am going to look into Prepared Statements. Thanks

Re: [PHP-DB] SQL Injection

2015-05-15 Thread Ruprecht Helms
On 15.05.2015 07:21, Karl DeSaulniers wrote: On May 14, 2015, at 11:11 PM, Onatawahtaw onatawah...@yahoo.ca wrote: Hi Karl, If you look at the link you provided you'll notice that some of the code is for ASP.net and some is for PHP. I have looked in the link. Most problems by inject an

Re: [PHP-DB] SQL Injection

2015-05-15 Thread Onatawahtaw
-Kevin Waddell Proverbs 3:5-6 On Fri, 5/15/15, Ruprecht Helms rhe...@rheynmail.de wrote: Subject: Re: [PHP-DB] SQL Injection To: php-db@lists.php.net Date: Friday, May 15, 2015, 10:16 AM On 15.05.2015 07:21, Karl DeSaulniers wrote: On May

Re: [PHP-DB] SQL Injection

2015-05-14 Thread Aziz Saleh
On Thu, May 14, 2015 at 9:05 PM, Karl DeSaulniers k...@designdrumm.com wrote: Hello Everyone, Have a quick question. Was reading some material and wanted some Players perspective. I know w3schools is not the de-facto on everything, so I wanted to know how reliable is the information on this

Re: [PHP-DB] SQL Injection

2015-05-14 Thread Karl DeSaulniers
On May 14, 2015, at 8:09 PM, Aziz Saleh azizsa...@gmail.com wrote: On Thu, May 14, 2015 at 9:05 PM, Karl DeSaulniers k...@designdrumm.com wrote: Hello Everyone, Have a quick question. Was reading some material and wanted some Players perspective. I know w3schools is not the de-facto

Re: [PHP-DB] SQL Injection

2015-05-14 Thread Jigme Datse Yli-Rasku
On 15/05/14 18:19 , Karl DeSaulniers wrote: On May 14, 2015, at 8:09 PM, Aziz Saleh azizsa...@gmail.com wrote: On Thu, May 14, 2015 at 9:05 PM, Karl DeSaulniers k...@designdrumm.com wrote: Hello Everyone, Have a quick question. Was reading some material and wanted some Players perspective.

Re: [PHP-DB] SQL Injection

2015-05-14 Thread Karl DeSaulniers
On May 14, 2015, at 8:37 PM, Jigme Datse Yli-Rasku jigme.da...@gmail.com wrote: On 15/05/14 18:19 , Karl DeSaulniers wrote: On May 14, 2015, at 8:09 PM, Aziz Saleh azizsa...@gmail.com wrote: On Thu, May 14, 2015 at 9:05 PM, Karl DeSaulniers k...@designdrumm.com wrote: Hello Everyone,

Re: [PHP-DB] SQL Injection

2015-05-14 Thread Karl DeSaulniers
On May 14, 2015, at 11:11 PM, Onatawahtaw onatawah...@yahoo.ca wrote: Hi Karl, If you look at the link you provided you'll notice that some of the code is for ASP.net and some is for PHP. What of the two are you programming in? If you are programming in ASP.net you are asking your

Re: [PHP-DB] SQL Injection

2015-05-14 Thread Onatawahtaw
Hi Karl, If you look at the link you provided you'll notice that some of the code is for ASP.net and some is for PHP. What of the two are you programming in? If you are programming in ASP.net you are asking your question to the wrong mailing list as this list is for PHP. If you are programming

Re: [PHP-DB] SQL syntax

2013-01-15 Thread Amit Tandon
SELECT orderid FROM ORDERS_TABLE WHERE orderstatus IN ( 'Cancelled', 'New', 'Denied', 'Expired' , 'Failed' , 'Pending' , 'Refunded' , 'Reversed' , 'Under Review' , 'Voided') AND orderdate '.mysqli_real_escape_string($ yesterday); Another option would be to use

Re: [PHP-DB] SQL syntax

2013-01-15 Thread Karl DeSaulniers
On Jan 15, 2013, at 5:25 AM, Amit Tandon wrote: SELECT orderid FROM ORDERS_TABLE WHERE orderstatus IN ( 'Cancelled', 'New', 'Denied', 'Expired' , 'Failed' , 'Pending' , 'Refunded' , 'Reversed' , 'Under Review' , 'Voided') AND orderdate

Re: [PHP-DB] SQL omit record if ever had value set

2012-06-19 Thread Dee Ayy
On Mon, Jun 18, 2012 at 6:26 PM, Matijn Woudt tijn...@gmail.com wrote: On Mon, Jun 18, 2012 at 11:56 PM, Dee Ayy dee@gmail.com wrote: I would like a query that lists records where a column has not taken on a specific value when grouped by another column. N  V n1 v1 n1 v2 n2 v1 n2 v2

Re: [PHP-DB] SQL omit record if ever had value set

2012-06-18 Thread Matijn Woudt
On Mon, Jun 18, 2012 at 11:56 PM, Dee Ayy dee@gmail.com wrote: I would like a query that lists records where a column has not taken on a specific value when grouped by another column. N  V n1 v1 n1 v2 n2 v1 n2 v2 n2 v3 n3 v1 If v3 has ever been set for N, do not list N.  So the

Re: [PHP-DB] SQL for counting comments - is this smart?

2009-03-17 Thread Gerardo Benitez
Chris your answer is the better solution, I thinked that the option suggest by Martin was fine. anywhere, tanks for help us to improve us code. Gerardo. 2009/3/16 Chris dmag...@gmail.com Martin Zvarík wrote: Is it smart to use all of this on one page? Or should I rather do one SQL and let

Re: [PHP-DB] SQL for counting comments - is this smart?

2009-03-16 Thread Chris
Martin Zvarík wrote: Is it smart to use all of this on one page? Or should I rather do one SQL and let PHP count it? $q = $DB-q(SELECT COUNT(*) FROM comments); $int_total = $DB-frow($q); $q = $DB-q(SELECT COUNT(*) FROM comments WHERE approved IS NULL); $int_waiting = $DB-frow($q); $q =

Re: [PHP-DB] sql injections/best practises

2008-11-10 Thread mignon hunter
Thank you Christopher - this gives me some much needed direction. --- On Fri, 11/7/08, Christopher Jones [EMAIL PROTECTED] wrote: From: Christopher Jones [EMAIL PROTECTED] Subject: Re: [PHP-DB] sql injections/best practises To: [EMAIL PROTECTED] Cc: php-db@lists.php.net Date: Friday, November 7

Re: [PHP-DB] sql injections/best practises

2008-11-10 Thread mignon hunter
thank you so much Fergus for all this great info - this will get me started. --- On Sat, 11/8/08, Fergus Gibson [EMAIL PROTECTED] wrote: From: Fergus Gibson [EMAIL PROTECTED] Subject: Re: [PHP-DB] sql injections/best practises To: php-db@lists.php.net Date: Saturday, November 8, 2008, 12:42 PM

Re: [PHP-DB] sql injections/best practises

2008-11-10 Thread Fergus Gibson
On Mon, Nov 10, 2008 at 8:49 AM, mignon hunter [EMAIL PROTECTED] wrote: One other question. Our current site is written in jsp with Oracle. I'd like to use PHP. Do you have any thoughts on this? Your post, mignon, was pretty clearly directed to Christopher, but I hope neither of you will be

Re: [PHP-DB] sql injections/best practises

2008-11-10 Thread mignon hunter
.   Oracle is the db on most of the site - a little mysql too. --- On Fri, 11/7/08, Christopher Jones [EMAIL PROTECTED] wrote: From: Christopher Jones [EMAIL PROTECTED] Subject: Re: [PHP-DB] sql injections/best practises To: [EMAIL PROTECTED] Cc: php-db@lists.php.net Date: Friday, November 7, 2008, 5

Re: [PHP-DB] sql injections/best practises

2008-11-10 Thread Christopher Jones
mignon hunter wrote: Hi Christopher One other question. Our current site is written in jsp with Oracle. I'd like to use PHP. Do you have any thoughts on this? My recommendation is to utilize the existing skills you have; this echoes Fergus's comment. However, PHP is very popular and if

Re: [PHP-DB] sql injections/best practises

2008-11-08 Thread Fergus Gibson
On Fri, Nov 7, 2008 at 3:39 PM, Christopher Jones [EMAIL PROTECTED] wrote: mignon hunter wrote: I'm am trying to find some definitive best practises on database connections with php on both mysql and oracle. Most security issues come back to a simple concept. Assume anything in your scripts

Re: [PHP-DB] sql injections/best practises

2008-11-07 Thread Christopher Jones
mignon hunter wrote: I'm am trying to find some definitive best practises on database connections with php on both mysql and oracle. I'm starting to redesign a corporate website and am trying to find out more about security and the best practises for database queries and user input form

RE: [PHP-DB] sql problem

2007-12-16 Thread Bastien Koert
http://www.php.net/manual/en/function.number-format.php bastien Date: Sun, 16 Dec 2007 17:17:41 +0600 From: [EMAIL PROTECTED] To: php-db@lists.php.net Subject: [PHP-DB] sql problem my problem in the following code INSERT INTO `test` (

Re: [PHP-DB] sql statement - complex order by

2007-07-02 Thread Stut
Bryan wrote: SELECT * FROM productgroup WHERE groupid = $productid AND label = 'Cats' ORDER BY title SELECT * FROM productgroup WHERE groupid = $productid AND label != 'Cats' ORDER BY label,title I'd like to find a way to combine these 2 statements. I want to list out all the products,

Re: [PHP-DB] sql statement - complex order by

2007-07-02 Thread tg-php
Try this: SELECT * FROM productgroup WHERE groupid = $productid ORDER BY label = 'Cats' DESC, title The test SQL I did to make sure I understood it was this (against our Users table): select * from users order by first = 'Bob' DESC, first, last It put all the Bobs first, sorting them by

Re: [PHP-DB] sql statement - complex order by

2007-07-02 Thread Bryan
I think there's one small piece of data I left out. I'm working with php/mssql, no mysql. I'll move to mysql when I get everything else built. Mssql 2000 doesn't seem to like the = sign in the order by clause. It looks like both of you so far have come up with the same syntax though so it must

Re: [PHP-DB] sql statement - complex order by

2007-07-02 Thread Bryan
I think there's one small piece of data I left out. I'm working with php/mssql, not mysql. I'll move to mysql when I get everything else built. Mssql 2000 doesn't seem to like the = sign in the order by clause. It looks like both of you so far have come up with the same syntax though so it

Re: [PHP-DB] SQL unexpected T_CONSTANT_ENCAPSED_STRING Error

2007-03-22 Thread Jean-Marc Guillermin
Hi Laitha, And with backslashes before them ?? jm - Original Message - From: Lasitha Alawatta [EMAIL PROTECTED] To: php-db@lists.php.net Sent: Thursday, March 22, 2007 2:06 PM Subject: [PHP-DB] SQL unexpected T_CONSTANT_ENCAPSED_STRING Error Hi All, I have a sql script unable to

Re: [PHP-DB] SQL Query - Using variable from another SQL Query

2007-02-12 Thread Brad Bonkoski
Matthew Ferry wrote: Hello Everyone Got a simple / stupid question. Worked on this all night. I'm over looking something very basic here. The query event_time brings back the calendar id for each event that is pending in the future. ie 12, 13, 14, 26 (There could be 100 of them out

Re: [PHP-DB] SQL Query - Using variable from another SQL Query

2007-02-12 Thread tg-php
Try this as your SQL. It should give you all the results, then you can use PHP to sort it all out. SELECT * FROM egw_cal WHERE cal_category='501' and cal_id in (SELECT cal_id FROM egw_cal_dates where cal_start $tstamp) -TG = = = Original message = = = Hello Everyone Got a simple /

Re: [PHP-DB] SQL Query - Using variable from another SQL Query

2007-02-12 Thread Micah Stevens
This is a join - Read up on them, they're very useful and don't require the overhead of a sub-query. SELECT egw_cal.* FROM egw_cal_dates LEFT JOIN egw_cal using (cal_id) where egw_cal_dates.cal_start $tstamp AND egw_cal.cal_category = '501' -Micah On 02/12/2007

Re: [PHP-DB] SQL Query - Using variable from another SQL Query

2007-02-12 Thread Matthew Ferry
Thanks Everyone... After I sent that...I got thinking about doing both queries in one statement. So thats what I did. Its working fine... Here is the updated code: ?php $todays_year = date(Y); $todays_month = date(m); $todays_day = date(d); $tstamp = mktime(0, 0, 0, $todays_month,

Re: [PHP-DB] SQL Performance Help

2007-01-03 Thread Chris
Tony Grimes wrote: I'm developing a course calendar for a client and I'm running into performance problems with the admin site. For example, when I try to include registration counts in the course list, the page really slows down for large course lists (50 or so): COURSEATTENDEES

RE: [PHP-DB] SQL Performance Help

2006-12-27 Thread Bastien Koert
1. yes indexes could help, if mysql uses them. The mysql optimiser may or may not use the index for the query depending on the statement...it sounds like you are doing a full table scan on the data 2. there are two schools of thought here: a. run the whole thing as two statements (one outer

Re: [PHP-DB] SQL query error

2006-12-16 Thread Jeffrey
Chris Carter wrote: What wrong with this syntax, its not giving any error on runtime but I am facing a blank page while paging. $query= SELECT * FROM gurgaonmalls WHERE mallname = '$mallname' limit $eu, $limit ; Have you tried... echo p $query /p; ...to unsure the variables have the values

RE: [PHP-DB] SQL query

2006-09-28 Thread Edwin Cruz
Make sure that your second query is returning only one row, if it dont help, try this: $query=select email from usuarios where userName in (select username from fussv where folio = 'FUSS-130-2006') MySQL think that you second query returns more than 1 row, that's why mysql dont accept your

RE: [PHP-DB] SQL query

2006-09-28 Thread Dwight Altman
Check your version. Subselects were only added in MySQL Version 4.1. Regards, Dwight -Original Message- From: Edwin Cruz [mailto:[EMAIL PROTECTED] Sent: Thursday, September 28, 2006 10:53 AM To: 'Miguel Guirao'; php-db@lists.php.net Subject: RE: [PHP-DB] SQL query Make sure

RE: [PHP-DB] SQL query

2006-09-28 Thread Miguel Guirao
OK, this makes my day clear!! I have versión 3.23.49-3 of MySQL Thanks Dwight! -Original Message- From: Dwight Altman [mailto:[EMAIL PROTECTED] Sent: Jueves, 28 de Septiembre de 2006 11:32 a.m. To: php-db@lists.php.net Subject: RE: [PHP-DB] SQL query Check your version. Subselects

RE: [PHP-DB] sql output to a multidimensional array

2006-09-08 Thread K.A.Bouton
-Original Message- From: Chris [mailto:[EMAIL PROTECTED] Sent: Thursday, September 07, 2006 9:52 PM To: K.A.Bouton Cc: php-db@lists.php.net Subject: Re: [PHP-DB] sql output to a multidimensional array K.A.Bouton wrote: I need the output of my sql to be a multidimensional

Re: [PHP-DB] sql output to a multidimensional array

2006-09-07 Thread Chris
K.A.Bouton wrote: I need the output of my sql to be a multidimensional array as follows. chart [ 'chart_data' ] =3D array ( array ( , 2001, 2002, 2003, 2004 ), array ( AAA, 0, 10, 30, 63 ), array ( BBB, 100,

Re: [PHP-DB] sql output to a multidimensional array

2006-09-07 Thread Mitch Miller
K.A.Bouton wrote: I need the output of my sql to be a multidimensional array as follows. then Chris wrote: You won't be able to get an sql query to return in that format (I know what you're trying to do, I've used the same chart software). This is my MSSQL Server solution, and yep, it

Re: [PHP-DB] sql output to a multidimensional array

2006-09-07 Thread Chris
Mitch Miller wrote: K.A.Bouton wrote: I need the output of my sql to be a multidimensional array as follows. then Chris wrote: You won't be able to get an sql query to return in that format (I know what you're trying to do, I've used the same chart software). This is my MSSQL Server

Re: [PHP-DB] SQL Server COM question

2006-08-09 Thread Frank M. Kromann
Try the MSDN library: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ado270/htm/mdobjconnectionpme.asp - Frank Chris wrote: Todd Cary wrote: [Sorry - I misposted this in the General group] I am in the process of converting my clients PHP scripts that are using

Re: [PHP-DB] SQL Server COM question

2006-08-08 Thread Chris
Todd Cary wrote: [Sorry - I misposted this in the General group] I am in the process of converting my clients PHP scripts that are using Firebird so they will work with SQL Server (their request; not mine). Is there a reference where I can get the COM Methods and Properties? The php

Re: [PHP-DB] SQL Server COM question

2006-08-08 Thread Todd Cary
Chris wrote: Todd Cary wrote: [Sorry - I misposted this in the General group] I am in the process of converting my clients PHP scripts that are using Firebird so they will work with SQL Server (their request; not mine). Is there a reference where I can get the COM Methods and Properties?

Re: [PHP-DB] SQL Server COM question

2006-08-08 Thread Chris
Todd Cary wrote: Chris wrote: Todd Cary wrote: [Sorry - I misposted this in the General group] I am in the process of converting my clients PHP scripts that are using Firebird so they will work with SQL Server (their request; not mine). Is there a reference where I can get the COM Methods

RE: [PHP-DB] SQL request on DBase file

2006-02-11 Thread David BERCOT
Hi, Whats wonrg with the manual? http://ca3.php.net/manual/en/ref.oracle.php http://www.zend.com/products/zend_core/zend_core_for_oracle I looked at these links and I found nothing about .pdf files !!! I have no problem with Oracle, but only for requesting, in SQL, .dbf files... David.

RE: [PHP-DB] SQL request on DBase file

2006-02-11 Thread Bastien Koert
: RE: [PHP-DB] SQL request on DBase file Date: Sat, 11 Feb 2006 14:31:50 +0100 Hi, Whats wonrg with the manual? http://ca3.php.net/manual/en/ref.oracle.php http://www.zend.com/products/zend_core/zend_core_for_oracle I looked at these links and I found nothing about .pdf files !!! I have

RE: [PHP-DB] SQL request on DBase file

2006-02-11 Thread David BERCOT
(syntax is fantaisist) : Conn = OpenDatabase(PDF Driver,/var/www/repDBF); SQLStmt = Select * From DBFFile1 where Name = 'DUBOIS'; RS = Conn.Execute(SQLStmt); These is what I do in ASP on Windows... David. Bastien From: David BERCOT [EMAIL PROTECTED] To: php-db@lists.php.net Subject: RE: [PHP

RE: [PHP-DB] SQL request on DBase file

2006-02-10 Thread Bastien Koert
Whats wonrg with the manual? http://ca3.php.net/manual/en/ref.oracle.php http://www.zend.com/products/zend_core/zend_core_for_oracle Bastien From: David BERCOT [EMAIL PROTECTED] To: php-db@lists.php.net Subject: [PHP-DB] SQL request on DBase file Date: Sat, 11 Feb 2006 00:28:16 +0100 Hi,

Re: [PHP-DB] SQL Server - do I need PHP to run COMMIT?

2005-12-16 Thread Robert Twitty
Using COMMIT is only required if you issued a BEGIN TRANS before your INSERTs, UPDATEs and / or DELETEs. All transactions are automatically committed if you don't use BEGIN TRANS. Are you backing up the transaction logs regularly? -- bob On Fri, 16 Dec 2005, Alex Gemmell wrote: Hello people,

Re: [PHP-DB] SQL Server - do I need PHP to run COMMIT?

2005-12-16 Thread Alex Gemmell
Yes, the transaction logs are being backed up and shrunk regularly. I am told while they are 400MB most of that is empty space and it's really about 50MB in size. Apparently that is still a bit too big and indicates a possible problem. I'm glad all transactions are auto-commited. I

Re: [PHP-DB] SQL Server - do I need PHP to run COMMIT?

2005-12-16 Thread Robert Twitty
Do you have the truncate log on checkpoint option enabled? Also, if you want to reduce the size of the log file if shrinking doesn't work, try running the following against the database. Of course, you should backup the DB first. SET NOCOUNT ON DECLARE @LogicalFileName sysname,

Re: [PHP-DB] SQL Injection attack

2005-08-25 Thread tg-php
I'm pretty amateur at this too, but have done a little reading on the subject. Here's some nuggets to ponder while the real experts write their responses: :) 1. Magic quotes + mysql_escape_string = double escaped stuff. I think the general opinion is the magic quotes is evil, but I'm sure

Re: [PHP-DB] SQL Injection attack

2005-08-25 Thread Jordan Miller
NOTE: http://www.php.net/mysql_escape_string Version: 4.3.0 Description: This function became deprecated, do not use this function. Instead, use mysql_real_escape_string(). Jordan On Aug 25, 2005, at 2:15 PM, [EMAIL PROTECTED] tg- [EMAIL PROTECTED] wrote: Using mysql_escape_string

Re: [PHP-DB] SQL Injection attack

2005-08-25 Thread tg-php
Haha.. what the hell? Ok, I know this is an older copy of the script I wrote because I know I took out the All this does is escape the data comment and I KNOW I saw the thing about mysql_escape_string() being deprecated... don't know why it's still in there. Hah Thanks for pointing that out.

Re: [PHP-DB] SQL Injection attack

2005-08-25 Thread Vicente
Estimado veditio, you wrote: I've got a ton of forms that use the $_POST variable to send information into the database [...] Any suggestions on how to tighten up the form security, or does magic_quotes help enough? I'm not a security expert but after some attacks I have implemented this

Re: [PHP-DB] SQL or array ?

2005-04-23 Thread Mark Cain
explain the phrase big array. What is big to you might not be big to the server nor to me but then again maybe it's bigger. Are you talking dozens, hundreds, thousands, millions?? - Original Message - From: Paul Reilly [EMAIL PROTECTED] To: php-db@lists.php.net Sent: Saturday, April 23,

Re: [PHP-DB] SQL or array ?

2005-04-23 Thread Paul Reilly
explain the phrase big array. I guess everything is relative! We're talking about 300-500 items here. Paul -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DB] SQL or array ?

2005-04-23 Thread M Saleh EG
Only? That aint too big, but now i'm confused what's ur hardware and O.Sspecs? 300 to 500 would be a peice of cake to load. However, it depends on ur system. I would rather use the array than hitting the db for the query. Because the bottom line is that you will receive your data in an array no

Re: [PHP-DB] SQL prob

2005-01-31 Thread Bobo Wieland
Thanks, but DISTINCT doesn't work... But I managed to get it to work anyway by including namn_1 NOT LIKE 'H%' in the second WHERE-clause... Micah Stevens wrote: use DISTINCT? On Sunday 30 January 2005 12:51 pm, Bobo Wieland wrote: Anyone that can help me with this one? I want this

Re: [PHP-DB] SQL prob

2005-01-30 Thread Micah Stevens
use DISTINCT? On Sunday 30 January 2005 12:51 pm, Bobo Wieland wrote: Anyone that can help me with this one? I want this SQL-statement to retrive only distinct values from the original table column named (not the AS stuff) ( SELECT * , namn_2 AS sec_namn, namn_1 AS one FROM sortiment

Re: [PHP-DB] SQL statement

2005-01-07 Thread Jochem Maas
PHPDiscuss - PHP Newsgroups and mailing lists wrote: Hello everybody, I'm building a small application and I have trouble passing a POST variable form one page to another inside the SQL statement. The query displayed below works great without the .$_POST['CompanyName']. $query_company_listing =

RE: [PHP-DB] SQL statement syntaxis

2005-01-07 Thread Bastien Koert
missing the singles quotes around the company name text element $query_company_listing = SELECT CompanyID, CompanyName, CompanyOrDepartment, BillingAddress, City, PostalCode, PhoneNumber FROM company WHERE company.CompanyName='.$_POST['CompanyName'].' ORDER BY CompanyName ASC; bastien From:

Re: [PHP-DB] SQL statement

2005-01-07 Thread Jochem Maas
Jason, can you please turn off the return receipts on emails you send to the list. it's bloody annoying to have 'The Sender wishes to be notified' popup messages everytime I read one of your emails (and, alas, I don't have the skill to hack the return receipt crap right out of Tbird). BTW

Re: [PHP-DB] SQL statement

2005-01-07 Thread graeme
Hi, To stop the return receipt dialog appearing in Tbird... Tools... Options... Advanced... Return Receipt and select Never send a return receipt. Or you can choose some of the other selections. graeme Jochem Maas wrote: Jason, can you please turn off the return receipts on emails you send to

RE: [PHP-DB] SQL statement

2005-01-06 Thread Jason Walker
First off - $_POST['CompanyName'] is valid, right? Can you do something like this?: if (isset($_POST['CompanyName'])){ $sqlCompanyName = $_POST['CompanyName']; } else { return them back to the form, or something? } $query_company_listing = SELECT CompanyID, CompanyName,

Re: [PHP-DB] SQL Insert problem (SOLVED), Thanks!

2004-08-08 Thread Vincent Jordan
: [SPAM] Re: [PHP-DB] SQL Insert problem From: Vincent Jordan [EMAIL PROTECTED] $sql = INSERT INTO rmarequest (firstname, lastname, address, address2, city, state, zip, phone, email, serial, product, reason, rmanumber)VALUES ('$firstname', '$lastname', '$address', '$city

RE: [PHP-DB] SQL Insert problem

2004-08-05 Thread Hutchins, Richard
You're missing address2 in your list of values. This means that you have an unmatching number of column names and values in your query and that'll make the query bomb. Rich -Original Message- From: Vincent Jordan [mailto:[EMAIL PROTECTED] Sent: Thursday, August 05, 2004 10:25 AM To:

RE: [PHP-DB] SQL Insert problem

2004-08-05 Thread Vincent Jordan
, August 05, 2004 10:26 AM To: [EMAIL PROTECTED] Subject: RE: [PHP-DB] SQL Insert problem You're missing address2 in your list of values. This means that you have an unmatching number of column names and values in your query and that'll make the query bomb. Rich -Original Message

Re: [PHP-DB] SQL Insert problem

2004-08-05 Thread Torsten Roehr
John W. Holmes [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] From: Vincent Jordan [EMAIL PROTECTED] Im having a problem inserting data. Ive looked over this again and again and can not find what ive missed. Everything else works besides the db insert. It would have helped if

Re: [PHP-DB] SQL Insert problem

2004-08-05 Thread John W. Holmes
From: Vincent Jordan [EMAIL PROTECTED] $sql = INSERT INTO rmarequest (firstname, lastname, address, address2, city, state, zip, phone, email, serial, product, reason, rmanumber)VALUES ('$firstname', '$lastname', '$address', '$city', '$state', '$zip', '$phone', '$email',

RE: [PHP-DB] SQL Insert problem

2004-08-05 Thread Hutchins, Richard
: Thursday, August 05, 2004 11:06 AM To: [EMAIL PROTECTED] Subject: RE: [PHP-DB] SQL Insert problem I have inserted '$address2', correctly in the row however it is still not putting the data in the table. I am not getting an error but I do believe I have correct syntax set to display

RE: [PHP-DB] SQL Insert problem

2004-08-05 Thread Miles Thompson
it is still not putting the data in the table. I am not getting an error but I do believe I have correct syntax set to display problems. -Original Message- From: Hutchins, Richard [mailto:[EMAIL PROTECTED] Sent: Thursday, August 05, 2004 10:26 AM To: [EMAIL PROTECTED] Subject: RE: [PHP

Re: [PHP-DB] SQL help

2004-06-23 Thread Gabe
I have tried that and I don't get an error, but I don't get any records returned either. And I have lowered the search string like you mentioned. Here's what I tried ( Access syntax ): SELECT autoQuesID,fldQuesTitle,fldBody FROM tblFAQ_Question WHERE LCase(fldBody) LIKE '%$strSearchFor%';

Re: [PHP-DB] SQL Statement

2004-05-18 Thread Cal Evans
Jimi, PHP does not return an error because it knows nothing about valid sql. It's just knows if it's a valid PHP statement. (which it is because you've got the 's in the right place and a ; at the end. ) :) It's up to MySQL to return an error. As to your statement. 1: It's easier and valid in

Re: [PHP-DB] SQL Statement

2004-05-18 Thread John W. Holmes
Thompson, Jimi wrote: So then I try do this ?php if ($fk_phone != NULL) { $sqlwrk = SELECT `pk_phone_reports`, SUM(`calls`) AS `total_calls`, `date`, `calls` , `fk_ph_num` FROM `phone_reports`; $sqlwrk .= WHERE `pk_phone_number` = . $fk_phone; $rswrk =

Re: [PHP-DB] SQL question!

2004-05-03 Thread Larry E . Ullman
I have these tables. Users ( id,name,etc ) Coments : ( id , comment ) How do I do this kind of query: I thought in one thing like this but I cant figure it out. Example: Select * from users order by id desc in (select count (id) from comments) Expected result: List of users: * User1 See

Re: [PHP-DB] SQL for Showing the number of queries served on each day.

2004-04-30 Thread John W. Holmes
Vern wrote: I found this code below that allows me to retreive the queries served on my server for each day but can't figure out how to actually display the information using echo. Can some one give me an example using the following SQL? SELECT DATE_FORMAT(ex_date, '%Y %m %d %W'), COUNT(id) FROM

Re: [PHP-DB] SQL for Showing the number of queries served on each day.

2004-04-30 Thread Vern
That did it thanks -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DB] SQL Server Query Failed

2004-03-17 Thread Bruno Ferreira
david wrote: Hello there! I have just about driven myself crazy with an odd intermittent problem. [snip] I'd first start by turning on all logging I could in the SQL server so that I could see what's happening straight from the horse's mouth... Bruno Ferreira --- [This E-mail scanned

Re: [PHP-DB] SQL Server Query Failed

2004-03-17 Thread Robert Twitty
What type of field is PhaseFK? -- bob On Wed, 17 Mar 2004, david wrote: Hello there! I have just about driven myself crazy with an odd intermittent problem. I have an intranet site, a good size one at that, on a Windows 2000 Server, running Apache, connecting to another Windows 2000

Re: [PHP-DB] SQL File Import problem (Was: HELP!!!)

2004-02-27 Thread Ricardo Lopes
. - Original Message - From: Doug Thompson [EMAIL PROTECTED] To: Robin 'Sparky' Kopetzky [EMAIL PROTECTED] Cc: Erwin Kerk [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Friday, February 27, 2004 1:04 AM Subject: Re: [PHP-DB] SQL File Import problem (Was: HELP!!!) On Fri, 27 Feb 2004 01:16:20

Re: [PHP-DB] SQL File Import problem (Was: HELP!!!)

2004-02-26 Thread Doug Thompson
On Fri, 27 Feb 2004 01:16:20 +0100, Erwin Kerk wrote: Robin 'Sparky' Kopetzky wrote: Good afternoon! I used SQLYOG to export the tables and data from a Mysql database. Now, when i try to re-import the data back into a different database, I get an error stating Error : MySQL server has gone

RE: [PHP-DB] SQL File Import problem (Was: HELP!!!)

2004-02-26 Thread Robin 'Sparky' Kopetzky
Thank you to all who helped. I was able using UltraEdit to chop up the sql file and created all of the individual INSERT statements. Now, I'm up and running again. Slow but it worked! Thanks again! Robin Kopetzky -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit:

Re: [PHP-DB] SQL File Import problem (Was: HELP!!!)

2004-02-26 Thread Erwin Kerk
Robin 'Sparky' Kopetzky wrote: Good afternoon! I used SQLYOG to export the tables and data from a Mysql database. Now, when i try to re-import the data back into a different database, I get an error stating Error : MySQL server has gone away. What is happening and how do I fix this. I NEED this

RE: [PHP-DB] sql, problem with join and presentation

2004-02-17 Thread Angelo Zanetti
i think the newer versions of MYSQL allow for subselects and I think that is what you want. see www.mysql.net -Original Message- From: mayo [mailto:[EMAIL PROTECTED] Sent: Sunday, February 15, 2004 11:56 PM To: php-db Subject: [PHP-DB] sql, problem with join and presentation Currently

Re: [PHP-DB] sql, problem with join and presentation

2004-02-17 Thread Frank Flynn
There are two ways to do what you ask: 1 - run your first query (just the classes no sections) and before the loop to display the results open a new - different connection to the DB then in the loop where you are displaying the results after displaying each class run a query to find all of it's

Re: [PHP-DB] sql, grouping problem

2004-02-16 Thread John W. Holmes
mayo wrote: cold fusion allows you to group output (see below) Select c.classId, c.classTexts, c.classDescription, cc.classCodeSection, cc.classDate, cc.classTime, cc.classLocation, cc.classInstructor FROM CLASSES c, CLASSCODES cc WHERE c.classId = cc.classId AND ... ORDER BY

RE: [PHP-DB] sql query, editing?

2004-01-15 Thread Humberto Silva
Create a form for editing the record Then on the display funtion just put a link on each record to that form and pass the id of that record like a href=editrecord.php?id=?=$row['id']?edit/a On the edit form just grab the data of the $id passed on the url and put those values on the input fields

RE: [PHP-DB] SQL query...

2004-01-15 Thread brett king
SELECT DISTINCT(file_name), Count(file_name) FROM $table_name WHERE date BETWEEN '2003-10-01' AND '2003-12-31' group by file_name order by ??? desc In the above sql statement, I'm trying to achieve: 1. select all file names, between two dates. 2. list them, and order by the highest number of

  1   2   >