Re: [PHP] str_replace oddity

2007-09-22 Thread Jim Lucas

Kevin Waterson wrote:

I am using str_replace to strip double quotes.

$string = 'This string has quotes in it';

$string = str_replace('', '', $string);

this seems to work, yet when I put the $string into mysql,
it uses backslashes to escape where the quotes were. The
double-quotes are gone, yet it still escapes the 'ghost'
where they were.

I even tried 
str_replace(array(\x8c, \x9c, ', ''), '', $string)

but the ghost remains and mysql continues to escape them.

I check the charsets, and the db is Latin-1 and the sting is ISO-8859-1

Any thoughts on this would be most graciously accepted.
Kind regards
kevin



is $string honestly something that you are getting via a form submit?

if so, your system might have magic quotes enabled.

This would automatically escape quotes with the attempt to make the 
values safer, and then you go and run your str_replace command and 
remove the double quotes, you end up leaving the '\' that the system 
automatically put in the value for you.


read up on magic quote gpc

hope this helps.

Jim

--
Jim Lucas


Perseverance is not a long race;
it is many short races one after the other

Walter Elliot



Some men are born to greatness, some achieve greatness,
and some have greatness thrust upon them.

Twelfth Night, Act II, Scene V
by William Shakespeare

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] php personal project

2007-09-22 Thread Crayon Shin Chan
On Friday 21 September 2007, Karl james wrote:

 I am in need of some help.
 I would love to get some assistance on this.
 I need to start creating a database for my website.
 This will be for a fantasy football league website.
 To store stats on the database for archive purposes,
 And be able to pull them out on html reports.

You've been working on this fantasy football league thing for *years*. 
You mean you still haven't gotten it off the ground yet?

-- 
Crayon

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Limiting connection to mysql using old mysql module (not mysqli)

2007-09-22 Thread Per Jessen
Stut wrote:

 Stefano Esposito wrote:
 i'm in need to limit the numbers of conection to the database,
 whithout loose of functionality. There is a general strategy to
 achieve this?
 
 1) Caching
 2) Caching
 3) Caching
 
 And if all that fails...
 
 4) Caching

And mysqls query cache does that pretty well. 

http://dev.mysql.com/doc/refman/5.0/en/query-cache.html


/Per Jessen, Zürich

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] php personal project

2007-09-22 Thread tedd

At 3:33 PM +0800 9/22/07, Crayon Shin Chan wrote:

On Friday 21 September 2007, Karl james wrote:


 I am in need of some help.
 I would love to get some assistance on this.
 I need to start creating a database for my website.
 This will be for a fantasy football league website.
 To store stats on the database for archive purposes,
 And be able to pull them out on html reports.


You've been working on this fantasy football league thing for *years*.
You mean you still haven't gotten it off the ground yet?


I think the big problem here is that the words fantasy and 
football really don't go together.


Like in the old Rocky and Bullwinkle show when a government agent 
identified himself to Rocky as Military Intelligence and Rocky 
replied Sounds like a contradiction in terms.


Cheers,

tedd

--
---
http://sperling.com  http://ancientstones.com  http://earthstones.com

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] php personal project

2007-09-22 Thread Børge Holen
On Saturday 22 September 2007 02:33:57 Crayon Shin Chan wrote:
 On Friday 21 September 2007, Karl james wrote:
  I am in need of some help.
  I would love to get some assistance on this.
  I need to start creating a database for my website.
  This will be for a fantasy football league website.
  To store stats on the database for archive purposes,
  And be able to pull them out on html reports.

 You've been working on this fantasy football league thing for *years*.
 You mean you still haven't gotten it off the ground yet?

is this the same dude with the same question from last year?
omg


 --
 Crayon

--
Børge Holen

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] php personal project

2007-09-22 Thread Børge Holen
On Saturday 22 September 2007 12:06:27 Karl James wrote:
 HAHAHA!! VERY FUNY!!

 Apparently, no one wants to help.
 So, much for the sympathy factor.

 Karl


 Original Message
 From: Børge_Holen [EMAIL PROTECTED]
 Sent: 09/22/07 12:29 PM
 To: php-general@lists.php.net
 Subject: Re: [PHP] php personal project
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

 On Saturday 22 September 2007 02:33:57 Crayon Shin Chan wrote:
  On Friday 21 September 2007, Karl james wrote:
   I am in need of some help.
   I would love to get some assistance on this.
   I need to start creating a database for my website.
   This will be for a fantasy football league website.
   To store stats on the database for archive purposes,
   And be able to pull them out on html reports.
 
  You've been working on this fantasy football league thing for *years*.
  You mean you still haven't gotten it off the ground yet?

 is this the same dude with the same question from last year?
 omg

  --
  Crayon

 --
 Børge Holen

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php

Yes, well... What most people pick up very fast around here is the rule of 
help people help themselves.
You want the whole freakin page without actually have to start anythin 
yourself. Show up some code, something that youre pondering about... 
anything.
Start storing whatever results from yer database fix codes and expand it with  
your own enhancing capabilities.

I would very much recon that the knowledge residing within this email 
community is bought the hard way, hell... most of these ppl probably bought a 
php book out of some sort of problem or they needed for some background 
information on a specific topic or maby as a souvenir, I don't know but they 
did not learn php from the book (did you?).

--
Børge Holen

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread Jeff Cohan
Chris wrote:
 [error] = 2
 And also gives you an error code.

Yes, I know and knew that. That's why the upload ultimately fails
(which is okay).

My point is that when a file's size exceeds the MAX_FILE_SIZE value,
I want the browser to (a) detect that it's too large BEFORE
attempting to upload it and (b) report the file size back to the
user. That's what's not happening.

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] php personal project

2007-09-22 Thread Guillaume Theoret
* Disclaimer: The following may sound condescending (I hope not) but
you said you're a newbie so I'll try to start with the very basics.

For your database tables questions you basically want the tables to
represent real life things. For example, a player, a team, etc.

So let's make a quick list of things you might want to store information about:
Players (an NFL player)
Teams (a NFL team)
Coaches (a NFL coach)
Fantasy Owners (one of your friends who has a fantasy team)

Now that we have that list we have to decide what information we want
to keep about each.

For example a player will need a name, an age, a salary, possible
other stuff that's unique to him alone. Same for teams, coaches and
fantasy owners.

Now that we have a little information about each we need to decide how
to link everything together. In order to properly link things together
(to keep each database record (or row) unique) we need to give each
record a unique id. An auto-incremented integer serves perfecly. So
we'll have player_id, team_id, coach_id, owner_id.

Teams have many players but players only play on one team. In this
case we have a one to many relationship between teams and players.
In this case you want to store the team_id in the player table.

The relationship between fantasy owners and players can be more
complicated however. Depending on the rules you set up owners will
surely have several players but players may be owned by several
owners. Here we have a many to many relationship. In this case we
need what's called a middle table, basically a table whose sole
purpose is to link 2 other tables together. We'll call this table
owners_players and it will only have 2 fields: owner_id and player_id.
So when you want all players on an owner's team you select * from
owners_players where owner_id = x and with each of those results you
look up the player's information from his unique id (though it's
easier to do a join but I don't want to get into table joins right now
that's more complicated).

I've shown the two more complicated types of relationship but there's
still another: one to one. In this case you can put the id of the
linked-to record of the other table in either table, it doesn't
particularly matter, put it where you think it makes most sense.

This should be enough to at least get you started collecting some data.

On 9/21/07, Karl james [EMAIL PROTECTED] wrote:
 Team,



 I am in need of some help.

 I would love to get some assistance on this.

 I need to start creating a database for my website.

 This will be for a fantasy football league website.

 To store stats on the database for archive purposes,

 And be able to pull them out on html reports.



 I want to do something similar to this site here.

 http://www.webleaguemanager.com/demo/reports/FantasyStandingsRpt.html



 Please review the reports page on the left.



 I want to do all except for real time scoring.

 Do not have the monies to purchase that yet, LOL.



 I will be extracting the data from other sites, like NFL.com and ESPN.com



 I know I need to create the players, members, stats tables.

 But, I am not sure how to set them up correctly.

 I can send you all a word file if you private message me.

 It will show what I am looking for.



 Here is a link on my wish list at the moment.



 http://www.theufl.com/ufl_project.htm



 I want to do all the work. I basically just need a instructor to help me
 along the way

 To, the end. I seem to never get any one to help me on this. Maybe, because
 I am

 A newbie and not sure what to do or what right questions to ask as well.



 Any help in this ordeal would be greatly appreciated. I have NO TIME TABLE
 on this.

 Just, a personal goal of mine for me and my friends.



 Please help me through this! :-)







 Karl James

 [EMAIL PROTECTED]

 www.theufl.com







-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Limiting connection to mysql using old mysql module (not mysqli)

2007-09-22 Thread Stut

Per Jessen wrote:

Stut wrote:


Stefano Esposito wrote:

i'm in need to limit the numbers of conection to the database,
whithout loose of functionality. There is a general strategy to
achieve this?

1) Caching
2) Caching
3) Caching

And if all that fails...

4) Caching


And mysqls query cache does that pretty well. 


http://dev.mysql.com/doc/refman/5.0/en/query-cache.html


Indeed, but only if you're making a lot of repetitive queries to the 
database. However, since the OP wants to reduce the number of 
connections to the database, query caching may reduce the time each 
connection is held for it will not reduce the overall number of connections.


The point I'm trying to make is that while the query cache can be a huge 
improvement to some websites it's not a substitute for query optimisation.


-Stut

--
http://stut.net/

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



RE: [PHP] Access name of variable in $_POST array

2007-09-22 Thread Dan Parry
 -Original Message-
 From: Daniel Brown [mailto:[EMAIL PROTECTED]
 Sent: 21 September 2007 23:27
 To: Stut
 Cc: Eric Lommatsch; php-general@lists.php.net
 Subject: Re: [PHP] Access name of variable in $_POST array
 
 On 9/21/07, Stut [EMAIL PROTECTED] wrote:
  Please include the list when replying.
 
  Eric Lommatsch wrote:
   -Original Message-
   From: Stut [mailto:[EMAIL PROTECTED]
   Sent: Friday, September 21, 2007 3:09 PM
   To: Eric Lommatsch
   Cc: php-general@lists.php.net
   Subject: Re: [PHP] Access name of variable in $_POST array
  
   Eric Lommatsch wrote:
   I am writing a PHP script that is going to accept variables that
 are
   passed from a PDF form and should write both the name of the
 variable
   and its value to a text file.
  
  
   I can get the value that I want to retrieve with out problem.
 However,
   even though I have searched through the PHP.net site and googled
 this
   as well I have not yet been able to find the syntax that I need to
 get
   the names of the variables in the $_Post array.
  
   Can someone point me to the place in the PHP manual where I can
 find
   the syntax to get the name of a variable in the $_POST array?
  
   http://php.net/array_keys
  
   As in...
  
   $varnames = array_keys($_POST);
  
   -Stut
  
   --
   http://stut.net/
  
   Hello Stut,
  
   That is not exactly what I am looking for. If I try using that in
 My PHP
   script what I get as a result of that is repeatedly the Phrase
 Post Array
   when I check the values there. The PDF form that is posting to the
 PHP script
   is passing variable names like Employer_name or Employee_Name.
 I am
   hoping to get those variable names.
 
  Put this line at the top of the script that the form posts to...
 
  print 'pre'.print_r($_POST, true).'/pre'; exit;
 
  That will display the contents of the $_POST array and you should be
  able to figure out where everything is.
 
  By the sounds of it the posted values are actually in $_POST['Post
  Array'] but use the above line to be sure.
 
  -Stut
 
  --
  http://stut.net/
 
  --
  PHP General Mailing List (http://www.php.net/)
  To unsubscribe, visit: http://www.php.net/unsub.php
 
 
 
 Maybe this will get you started and give you some ideas.
 
 ?
 foreach($_POST as $p = $v) {
 $$p = $v;
 echo $p. = .$v.\n;
 }
 ?

I might be missing something but I fail to see the point of the variable
variable assignation (which is best to be avoided :) )

Dan

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



RE: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread Dan Parry
 -Original Message-
 From: Jeff Cohan [mailto:[EMAIL PROTECTED]
 Sent: 23 September 2007 00:02
 To: php-general@lists.php.net
 Subject: Re: [PHP] MAX_FILE_SIZE not working with file uploads
 
 Chris wrote:
  [error] = 2
  And also gives you an error code.
 
 Yes, I know and knew that. That's why the upload ultimately fails
 (which is okay).
 
 My point is that when a file's size exceeds the MAX_FILE_SIZE value,
 I want the browser to (a) detect that it's too large BEFORE
 attempting to upload

I might be wrong but this would be classed as 'exploitable'... Webservers
should not be allowed to read from or write to clients... Of course there is
ActiveX...

Dan

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread Jeff Cohan


Dan Parry wrote:
 I might be wrong but this would be classed as 
 'exploitable'... Webservers should not be allowed 
 to read from or write to clients... Of course there 
 is ActiveX...

I think we're off the point.

My script is simply interrogating the value of the
$_FILES[userfile][size] array element. It's coming up as ZERO if it
exceeds the MAX_FILE_SIZE. That seems odd to me. But maybe that's
the way it's SUPPOSED to work. That's why I started this thread out
with What am I missing?.

Said another way:

It seems that the server had to know the size of the file in order
to know it exceeded MAX_FILE_SIZE. So how can my script find out the
size?

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



RE: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread Dan Parry
 -Original Message-
 From: Jeff Cohan [mailto:[EMAIL PROTECTED]
 Sent: 23 September 2007 02:45
 To: php-general@lists.php.net
 Subject: Re: [PHP] MAX_FILE_SIZE not working with file uploads
 
 
 
 Dan Parry wrote:
  I might be wrong but this would be classed as
  'exploitable'... Webservers should not be allowed
  to read from or write to clients... Of course there
  is ActiveX...
 
 I think we're off the point.
 
 My script is simply interrogating the value of the
 $_FILES[userfile][size] array element. It's coming up as ZERO if it
 exceeds the MAX_FILE_SIZE. That seems odd to me. But maybe that's
 the way it's SUPPOSED to work. That's why I started this thread out
 with What am I missing?.
 
 Said another way:
 
 It seems that the server had to know the size of the file in order
 to know it exceeded MAX_FILE_SIZE. So how can my script find out the
 size?

I'm not sure it can... The server has to accept the file before it can
process any details on it

The MAX_FILE_SIZE input field is notoriously unreliable... I think if it
returns zero (0) then the PHP limit is reached

Dan

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] str_replace oddity

2007-09-22 Thread heavyccasey
So replace ' \ ' instead of '  '.

On 9/22/07, Jim Lucas [EMAIL PROTECTED] wrote:
 Kevin Waterson wrote:
  I am using str_replace to strip double quotes.
 
  $string = 'This string has quotes in it';
 
  $string = str_replace('', '', $string);
 
  this seems to work, yet when I put the $string into mysql,
  it uses backslashes to escape where the quotes were. The
  double-quotes are gone, yet it still escapes the 'ghost'
  where they were.
 
  I even tried
  str_replace(array(\x8c, \x9c, ', ''), '', $string)
  but the ghost remains and mysql continues to escape them.
 
  I check the charsets, and the db is Latin-1 and the sting is ISO-8859-1
 
  Any thoughts on this would be most graciously accepted.
  Kind regards
  kevin
 
 
 is $string honestly something that you are getting via a form submit?

 if so, your system might have magic quotes enabled.

 This would automatically escape quotes with the attempt to make the
 values safer, and then you go and run your str_replace command and
 remove the double quotes, you end up leaving the '\' that the system
 automatically put in the value for you.

 read up on magic quote gpc

 hope this helps.

 Jim

 --
 Jim Lucas


  Perseverance is not a long race;
  it is many short races one after the other

 Walter Elliot



  Some men are born to greatness, some achieve greatness,
  and some have greatness thrust upon them.

 Twelfth Night, Act II, Scene V
  by William Shakespeare

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread Ray
On Saturday 22 September 2007 7:44:55 pm Jeff Cohan wrote:
 Dan Parry wrote:
  I might be wrong but this would be classed as
  'exploitable'... Webservers should not be allowed
  to read from or write to clients... Of course there
  is ActiveX...

 I think we're off the point.

 My script is simply interrogating the value of the
 $_FILES[userfile][size] array element. It's coming up as ZERO if it
 exceeds the MAX_FILE_SIZE. 

Exactly, no valid file was uploaded. The size of the valid file is therefore 
zero.

 That seems odd to me. 
 But maybe that's 
 the way it's SUPPOSED to work. That's why I started this thread out
 with What am I missing?.

 Said another way:

 It seems that the server had to know the size of the file in order
 to know it exceeded MAX_FILE_SIZE. So how can my script find out the
 size?

Can you use Javascript to check file size client side, send data via AJAX then 
issue warnings? (Remember the php mantra: PHP is a server side language )

As noted in the php.net documentation you quoted, and as mentioned previously, 
MAX_FILE_SIZE is a _hint_ to the browser. some browsers just don't take 
hints.
Ray

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



RE: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread Dan Parry
 -Original Message-
 From: Ray [mailto:[EMAIL PROTECTED]
 Sent: 23 September 2007 02:25
 To: php-general@lists.php.net
 Subject: Re: [PHP] MAX_FILE_SIZE not working with file uploads
 
 On Saturday 22 September 2007 7:44:55 pm Jeff Cohan wrote:
  Dan Parry wrote:
   I might be wrong but this would be classed as
   'exploitable'... Webservers should not be allowed
   to read from or write to clients... Of course there
   is ActiveX...
 
  I think we're off the point.
 
  My script is simply interrogating the value of the
  $_FILES[userfile][size] array element. It's coming up as ZERO if it
  exceeds the MAX_FILE_SIZE.
 
 Exactly, no valid file was uploaded. The size of the valid file is
 therefore
 zero.
 
  That seems odd to me.
  But maybe that's
  the way it's SUPPOSED to work. That's why I started this thread out
  with What am I missing?.
 
  Said another way:
 
  It seems that the server had to know the size of the file in order
  to know it exceeded MAX_FILE_SIZE. So how can my script find out the
  size?
 
 Can you use Javascript to check file size client side, send data via
 AJAX then
 issue warnings

This would be the exploitable 'feature' I mentioned... Client-side files
should never be readable

Dan

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread Ray
On Saturday 22 September 2007 7:39:01 pm Dan Parry wrote:
  -Original Message-
  From: Ray [mailto:[EMAIL PROTECTED]
  Sent: 23 September 2007 02:25
  To: php-general@lists.php.net
  Subject: Re: [PHP] MAX_FILE_SIZE not working with file uploads
 
  On Saturday 22 September 2007 7:44:55 pm Jeff Cohan wrote:
   Dan Parry wrote:
I might be wrong but this would be classed as
'exploitable'... Webservers should not be allowed
to read from or write to clients... Of course there
is ActiveX...
  
   I think we're off the point.
  
   My script is simply interrogating the value of the
   $_FILES[userfile][size] array element. It's coming up as ZERO if it
   exceeds the MAX_FILE_SIZE.
 
  Exactly, no valid file was uploaded. The size of the valid file is
  therefore
  zero.
 
   That seems odd to me.
   But maybe that's
   the way it's SUPPOSED to work. That's why I started this thread out
   with What am I missing?.
  
   Said another way:
  
   It seems that the server had to know the size of the file in order
   to know it exceeded MAX_FILE_SIZE. So how can my script find out the
   size?
 
  Can you use Javascript to check file size client side, send data via
  AJAX then
  issue warnings

 This would be the exploitable 'feature' I mentioned... Client-side files
 should never be readable

 Dan

If the contents of a file were readable, I would definitely agree with you.  
I'm not convinced that the ability to detect the filesize of a file that the 
user selected would be exploitable, but it's a moot point as it doesn't work 
in javascript. (as someone else pointed out, maybe activeX?)
I'm not a javaScript expert, but I am learning, so I dug out the book, and put 
together the following script. (Ugly, insecure, and doesn't really do 
anything, but quick and It works, at least on my machine/browser combo)
Select a file, and the page will tell you everything It can about the file. My 
machine reports size as zero.
Ray

(Script guaranteed to occupy 0 or more bites of diskspace.)

html
headTITLEtest/TITLE
script type=text/javascript
function uptest()
{
alert (document.test.fileTest.defaultValue);
alert (document.test.fileTest.form);
alert (document.test.fileTest.name);
alert (document.test.fileTest.readOnly);
alert ('size follows');
alert (document.test.fileTest.size);
alert (document.test.fileTest.type);
alert (document.test.fileTest.value);

}
/script
/head
body
form name=test method=post
File: input type=file onchange=uptest() name=fileTest/
/form
/body
/html

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread Jim Lucas

Jeff Cohan wrote:


Dan Parry wrote:
I might be wrong but this would be classed as 
'exploitable'... Webservers should not be allowed 
to read from or write to clients... Of course there 
is ActiveX...


I think we're off the point.

My script is simply interrogating the value of the
$_FILES[userfile][size] array element. It's coming up as ZERO if it
exceeds the MAX_FILE_SIZE. That seems odd to me. But maybe that's
the way it's SUPPOSED to work. That's why I started this thread out
with What am I missing?.

Said another way:

It seems that the server had to know the size of the file in order
to know it exceeded MAX_FILE_SIZE. So how can my script find out the
size?



OK, not sure why anybody has pointed this out, but...

A signed Javascript session is allowed to access the local file system 
through the browser.  But an un-signed JS process/session is not.


Now, the reason that PHP can't do anything about the file upload while 
in process, is that PHP doesn't know anything about the file upload 
until Apache/IIS/... hands off the uploaded file to PHP.


Apache is actually the part receiving the uploaded file.  Once it is 
completely uploaded, the web server passes the temporary file name to 
php and then php gets what information about it it can.


Try trapping the error.  You will probably want to try with a setting in 
the php.ini or a .htaccess file that will change your error_handler 
function to some custom function that you can then use to allow the 
script to continue running, but capture and pass off information to the 
rest of your scripts.


Then see if in the $_FILES array you find a temp file name.  before your 
script ends, you might be able to look at the stats of that temp file 
and gleam some of the information that you are wanting to know from it.



Remember, when uploading a file, your scripts are only parsed before the 
upload actually starts.  Once your upload completes, successfully, will 
it then execute your php scripts.


From what research and testing that I have done, this is the way PHP 
handles uploads.  This was on a Redhat/Apache/PHP4 setup.  back about 6 
years ago.


Hope it is still accurate.

Jim

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread brian

Ray wrote:

On Saturday 22 September 2007 7:39:01 pm Dan Parry wrote:



This would be the exploitable 'feature' I mentioned... Client-side files
should never be readable

Dan



If the contents of a file were readable, I would definitely agree with you.  
I'm not convinced that the ability to detect the filesize of a file that the 
user selected would be exploitable, but it's a moot point as it doesn't work 
in javascript. (as someone else pointed out, maybe activeX?)


If Javascript can read the *directory* (and, thus, the size of the file) 
i'd be a bit nervous about that.


I'm not a javaScript expert, but I am learning, so I dug out the book, and put 
together the following script. (Ugly, insecure, and doesn't really do 
anything, but quick and It works, at least on my machine/browser combo)
Select a file, and the page will tell you everything It can about the file. My 
machine reports size as zero.


Wouldn't that suggest that it's not working, then? ;-)

Anyway, your script is interrogating the file *input element*, not the 
file, itself. Where you're trying to get the file size 
(document.test.fileTest.size) you're actually grabbing the value of the 
input's size attribute, which has a default of 0. You'll see this if 
you edit the input to have, eg. size=100


brian

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread brian

Jeff Cohan wrote:


Dan Parry wrote:

I might be wrong but this would be classed as 
'exploitable'... Webservers should not be allowed 
to read from or write to clients... Of course there 
is ActiveX...



I think we're off the point.

My script is simply interrogating the value of the
$_FILES[userfile][size] array element. It's coming up as ZERO if it
exceeds the MAX_FILE_SIZE. That seems odd to me. But maybe that's
the way it's SUPPOSED to work. That's why I started this thread out
with What am I missing?.

Said another way:

It seems that the server had to know the size of the file in order
to know it exceeded MAX_FILE_SIZE. So how can my script find out the
size?



Not at all. The user-agent is built to ignore files that exceed the 
MAX_FILE_SIZE value. The hooks into the OS that it utilises to send the 
file to the server also allow it to poll the file size (if it couldn't, 
things would get messy on the server, quick). But Javascript is a whole 
'nother thing, and it is not (normally--see Jim Lucas' post) able to get 
this information (thankfully).


So, your PHP script is not receiving a file at all.

brian

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] MAX_FILE_SIZE not working with file uploads

2007-09-22 Thread brian

brian wrote:

Jeff Cohan wrote:


It seems that the server had to know the size of the file in order
to know it exceeded MAX_FILE_SIZE. So how can my script find out the
size?



Not at all. The user-agent is built to ignore files that exceed the 
MAX_FILE_SIZE value.


Ack! I meant, The user-agent *should be* built to ignore ...

ie. MAX_FILE_SIZE is generally a client-side tool (and thus not to be 
relied upon too much) but will be honoured by PHP as well (if it does 
not exceed post_max_size in php.ini).


brian

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php