Re: [PHP] Auto logout

2005-03-15 Thread Dan Tappin
I do not think there is really any way around the dual login from the 
same browser issue.

As for the auto-logout I have a suggestion.  I have the same set-up for 
one of my sites.  I have a session MySQL database and I track the id of 
a user once they login and then that record is updated with a timestamp 
each time a page is reloaded.  So at any given time you can calculate 
the inactivity of a user via the database and show a online status.

I then have a cron job that runs every 5 minutes and it deletes records 
from my session database as records expire i.e. more than 30 minutes 
etc.  My PHP pages behind the login then run a check on every load for 
a current session database entry based on the user id.  Their PHP 
session may still be valid but if the database record does not exist 
the user is sent to the login page via a header redirect.

Dan T
On Mar 15, 2005, at 11:06 AM, Vaibhav Sibal wrote:
Hi
I wanted to implement an auto-logout feature for my project so that if
a terminal is left unattended for say 10 minutes, it should
automatically logoff the user. Apart from this, there is another
problem that I am encountering with my authentication scheme, the
scene is as follows :
(1) I am using a $_SESSION variable to transfer the username across
pages, what happens is that I cannot login more than one user from the
same machine since if i try the same the SESSION[username] variable's
value gets changed to the most latest login name. How do i get around
this ?
(2) Secondly, What happens is, when the user logs off from the system,
there are two things that happen at that time, first is that the
session variable is killed manually. The second is that the logged in
status of the user is updated in the database. So what happens is that
when the user is logged on the system, the database shows the user
logged in status as 1 otw it shows it as 0. Now the problem is that if
by chance the user closes the current browser window without actually
logging off, the session variable gets killed automatically but the
database is not updated accordingly. Please suggest some way around
this also.
I would be really happy if you guys can help me with this.
Thanks in advance
Vaibhav
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[PHP] long mysql_connect times

2005-03-14 Thread Dan Tappin
I have a PHP5.x site under development with MySQL 4.1.x.  I had the 
site running fine and there were no speed issues at all.  Everything is 
on the same system (a dual G5 Xserve).

Today however the PHP pages with MySQL calls started to take forever to 
load.  Static html and php files still loaded instantly.

I tracked the issue down to mysql_connect.  Initial calls to this 
function are taking 5 to 10 seconds each.  Subsequent calls missing a 
mysql_close call do not have the latency issue.  Normally I try have 
each call to mysql_connect followed by a mysql_close to keep my mysql 
tales in order.

I have tried:
 - loading the pages remotely and locally (both slow)
 - checked the Apache / MySQL logs
 - manually ran the mysql queries to check for slow queries (all 0.0x 
seconds duration)
 - restarted apache / mysql

My next step is a hard restart (off hours later tonight) but until then 
I was wondering if anyone has any ideas?  I am stumped.

Thanks,
Dan T
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


Re: [PHP] long mysql_connect times

2005-03-14 Thread Dan Tappin
Just an update... on a hunch I changed my mysql_connect to 
mysql_pconnect.  As expected the first one still takes 5 to 10 seconds 
and after that subsequent pages load instantly as expected.

Dan T
On Mar 14, 2005, at 3:07 PM, Dan Tappin wrote:
I have a PHP5.x site under development with MySQL 4.1.x.  I had the 
site running fine and there were no speed issues at all.  Everything 
is on the same system (a dual G5 Xserve).

Today however the PHP pages with MySQL calls started to take forever 
to load.  Static html and php files still loaded instantly.

I tracked the issue down to mysql_connect.  Initial calls to this 
function are taking 5 to 10 seconds each.  Subsequent calls missing a 
mysql_close call do not have the latency issue.  Normally I try have 
each call to mysql_connect followed by a mysql_close to keep my mysql 
tales in order.

I have tried:
 - loading the pages remotely and locally (both slow)
 - checked the Apache / MySQL logs
 - manually ran the mysql queries to check for slow queries (all 0.0x 
seconds duration)
 - restarted apache / mysql

My next step is a hard restart (off hours later tonight) but until 
then I was wondering if anyone has any ideas?  I am stumped.

Thanks,
Dan T
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


Re: [PHP] parse error, unexpected T_ENCAPSED_AND_WHITESPACE

2005-03-14 Thread Dan Tappin
Why not make it simple?:
// end PHP code ?
tdinput type='checkbox' name='status[? echo $row['profileID']; ?]' 
value='true'/td

? // continue PHP code
Dan T
On Mar 14, 2005, at 3:58 PM, Jeff Schmidt wrote:
Hello,
  I'm beating my head, and can't figure out *WHY* PHP is giving me 
this error. The full error text is:

Parse error: parse error, unexpected T_ENCAPSED_AND_WHITESPACE, 
expecting T_STRING or T_VARIABLE or T_NUM_STRING in 
/hsphere/local/home/welding/weldingconsultants.com/wcapp/admin.php on 
line 82

Line 82 is:
print 'tdinput type=\'checkbox\' name=\'status[' . 
$row[profileID] . ']' . ' value='true'//td\n;

The problem seems to have something to do with the construct 
$row[profileID] - I say this, because I pulled that out into a 
seperate line before this, at one point, just to test, and assigned it 
to a variable, and put the variable in place of the array access. That 
is, to test, at one point, my file had:

$profID = $row[profileID];
print 'tdinput type=\'checkbox\' name=\'status[' . $profID . ']' . 
' value='true'//td\n;

When I had done that, the parser started choking at the top line.
I've attached the full file, to see the context that this is in.
Can *anyone* explain this error? It's completely breaking my script. I 
suspect, that the *real* error is somewhere earlier in the file, but 
I've read through it 20 times and just can't find anything out of 
place (can't find any obvious syntax errors, for example).

Thanks for any help you can give me,
Jeff Schmidt
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


Re: [PHP] a new it company

2005-03-09 Thread Dan Tappin
I think Rory has trouble jumping to conclusions.  I was attacked off 
list by Rory thinking I was another list member... another dant 
(remember the OT adult content rant / thread?).

I would agree that this is not really spam... just bad judgment.  The 
flood of angry replies to this poster should teach them their lesson 
about mailing list etiquette.  If it continues they will simply be 
banned from the list.

With free speech you have to live with the odd incident like this.
Dan Tappin (Dan T)
On Mar 9, 2005, at 11:29 AM, Jochem Maas wrote:
Rory Browne wrote:
SPAMMER
From your email address I'm assuming that your name is Sharvan Saxena.
It seems like too much of a coincidence that the contact person on
that site(Tanuj Saxena), and your good self, have the same surname.
Because it seems your are a spammer, and a liar(you concealed your
I'd class him as stupid or ignorant maybe - but one hand sent email 
doesn't
really class someone as a spammer does it, I thought the bar was a 
little
higher than 1 email :-)
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[PHP] Mistaken Identity - Was: Anti-password trading/sharing solutions

2005-03-02 Thread Dan Tappin
Please note that my name is DAN TAPPIN not DAN TRAINOR 
[EMAIL PROTECTED].  Although our last names start with the same 
letter you will note that the following characters and our email 
addresses are different.

Please double check your facts before you open your big fat ranting 
mouths.

Dan Tappin (The list member formerly known as Dan T)
Side Note:
I could really give a rats-a** if Dan Trainor hosts adult material.  If 
the subjects are of age then get over it.  They are adults - they made 
their choices.  There is a little thing here called personal 
responsibility.  Why do some people insist on trying to save everyone 
from themselves and force morality down everyones throat?

On Mar 1, 2005, at 7:36 PM, Rory Browne wrote:
Dan
I think you could have handled this better. I don't have a problem
with your choice of business, provided you aren't exploiting, forcing,
or underpaying, your 'content-sources'. On the other hand I resent the
way you've spoken to friends of mine. Also from looking through your
responses, I note a hint of hypocracy.
In future I suggest showing respect, to people who in the communitys
view have earned it, until such time as you have built up the
credability to do otherwise.
Suggestion - figure out what you want, STFW, and if you can't find
what you need, get someone to program it.

On Tue, 1 Mar 2005 13:53:32 -0700, Dan Tappin [EMAIL PROTECTED] wrote:
What about using a simple session database to ensure multiple logins
are not allowed.  You can create a session, store the session ID in
mysql.  If the same user tries to login again from a different 
location
i.e. new session ID you can lock them out / log this activity.

You really can't prevent the shared password issue unless you billed 
on
a per login basis.  The bottom line is that you end up accepting that
you grant access to a user you give up controlling the sharing.  You
can only prevent multiple login's which is pretty good.  It really 
does
not matter if two people use the site 12 hours per day or one 24 hours
per day.

You can track IP's to look for suspected sharing i.e. use ARIN / RIPE
look-ups and see if the same user log's in from multiple subnets.  I
would think that this would be quite easy with PHP and a MySQL type
log.
Do your best to limit abuse and move on.
Dan T
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


Re: [PHP] How can I secure database passwords used by PHP webpages

2005-03-02 Thread Dan Tappin
The best way is to not store the password at all.
Store a hash of the password like this:
INSERT INTO users SET pass = MD5('password');
Now not knowing how you authenticate those passwords this might not 
work.

If it's an internal web page via PHP all you do is MD5 the users 
supplied password and compare to you DB.

Dan Tappin (The other Dan T)
On Mar 1, 2005, at 5:09 PM, Rob Tanner wrote:
WE have a number of PHP webpages that access one of several MySql 
databases
and while the PHP files that contain the passwords cannot be accessed 
via the
web, we are becoming increasingly concerned over the possibility of 
other
webpage maintainers viewing those files.  How have other folks 
protected
database passwords needed by PHP apps?

Thanks.
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


Re: [PHP] Setting cookie on first visit

2005-03-02 Thread Dan Tappin
The manual detail this issue:
http://ca.php.net/setcookie
You can't see the cookie until you hit the next page.  There is no way 
view the newly set cookie.

Dan Tappin
On Mar 2, 2005, at 2:18 AM, Tom Whitbread wrote:
I am using a cookie to detect what skin a user wants to display. The 
problem is if a user visits the site for the first time the cookie is 
not being set. I am detecting if its being set or not with

if(!isset($_COOKIE['skin'])){ ... }
It's not setting the cookie untill a user refreshes the page once. How 
can I ensure it's set when it hasnt been set before?

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[suspicious - maybe spam] [PHP] [suspicious - maybe spam] Re: [PHP] Connecting to a AS/400?

2005-03-02 Thread Dan Tappin
You need to clearer on 'connecting to' .
Do you mean FTP, MySQL etc???
Dan Tappin
On Mar 2, 2005, at 8:54 AM, Frank Arensmeier wrote:
Hello!
Is there anyone who has some experience in connecting to a IBM AS/400 
server with PHP? Any ideas where to start?

Regards,
Frank

Frank Arensmeier
Marketing Support
NIKE HYDRAULICS AB
Box 1107
631 80 Eskilstuna
Sweden
tel +46 16 82 34
fax +46 16 13 93 16
email: [EMAIL PROTECTED]
www.nikehydraulics.com
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


Re: [PHP] textarea posting duplicate text

2005-03-01 Thread Dan Tappin
It's definitely on your end:
http://www.orourke.ca/test.php
I verified your issue on your server and could not reproduce it on mine.
Our phpinfo data looks the same.
Here's a hunch.  Try calling output buffering at the top of your page:
 ob_start();
I have this on my site to allow for mid-page redirects.  I have no idea 
if this is the cause.  Just an idea.  Perhaps an Apache 2 issue?  Can 
any one else confirm this on Apache 2 / PHP 4.3.10?

Dan T
On Mar 1, 2005, at 7:43 AM, Elizabeth Lawrence wrote:
Thanks, Dan. I copied your code exactly and posted it here:
http://www.tidefans.com/test.php I pasted a large part of O'Henry's 
Gift of
the Magi into the textarea, and it gets repeated, as before.

Thanks for any help,
Elizabeth
-Original Message-
From: Dan Tappin [mailto:[EMAIL PROTECTED]
Sent: Monday, February 28, 2005 6:59 PM
To: Elizabeth Lawrence
Subject: Re: [PHP] textarea posting duplicate text
Create a new file:
test.php
with this exactly in the contents:
HTML
HEAD
TITLETEST/TITLE
/HEAD
BODY
FORM ACTION=test.php METHOD=post NAME=test
TEXTAREA NAME=textarea ROWS=4
COLS=40/TEXTAREA
PINPUT TYPE=submit NAME=submitButtonName/P
/FORM
P? print_r($_REQUEST); ?/P
/BODY
/HTML
Load the page, enter some text and hit submit.  Rule out some strange
issue with your page.  Confirm it's a PHP issue not a coding one.
Dan T
On Feb 28, 2005, at 8:03 AM, Elizabeth Lawrence wrote:
Hello. I have been asked to look at a PHP issue for someone, and I
can't
figure out what the problem is. I'm hoping one of you experts can 
help!


They are using Red Hat Linux / Ensim Pro 4.0.2, PHP 4.3.10, and Apache
2.0.

The problem: When a lot of text is entered into a textarea on a form,
the
text that shows up in the $_POST['textarea'] variable has the text
that was
entered, but it is duplicated. This is causing problems for their
forums.
Here is a very simple script I placed on the server:
www.tidefans.com/textarea_test.php (code below)
When I place the same script on another server I have access to, the
textarea text is posted fine.
Is this a PHP setting somewhere that I'm missing?

Here is the code for the PHP script mentioned above:
html
head
titleTest PHP Script/title
/head
body
form method=post action=textarea_test.php name=Form1
textarea cols=50 rows=20 name=textarea
//[a bunch of text goes here]
/textareabr
input type=text name=text size=20 value=This is some textbr
input type=submit name=Submit value=Submit
?php
if ($_POST[Submit] != )
{
  echo h1_POST values/h1;
  echo pTextarea submitted:/p;
  echo pre . $_POST[textarea] . /pre;
  echo pTextbox submitted:/p;
  echo pre . $_POST[text] . /pre;
  echo pSubmit submitted:/p;
  echo pre . $_POST[Submit] . /pre;
}
?
/form
?php
phpinfo();
?
/body
/html

If anyone can point me in the right direction, I would appreciate it 
so
much!

Elizabeth

Elizabeth Lawrence
[EMAIL PROTECTED]

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


Re: [PHP] Semi-OT: Anti-password trading/sharing solutions

2005-03-01 Thread Dan Tappin
What about using a simple session database to ensure multiple logins 
are not allowed.  You can create a session, store the session ID in 
mysql.  If the same user tries to login again from a different location 
i.e. new session ID you can lock them out / log this activity.

You really can't prevent the shared password issue unless you billed on 
a per login basis.  The bottom line is that you end up accepting that 
you grant access to a user you give up controlling the sharing.  You 
can only prevent multiple login's which is pretty good.  It really does 
not matter if two people use the site 12 hours per day or one 24 hours 
per day.

You can track IP's to look for suspected sharing i.e. use ARIN / RIPE 
look-ups and see if the same user log's in from multiple subnets.  I 
would think that this would be quite easy with PHP and a MySQL type 
log.

Do your best to limit abuse and move on.
Dan T
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


Re: [PHP] Supporting Cancel

2005-03-01 Thread Dan Tappin
That sounds ugly.
To be honest the real answer will be unpopular but since the old system 
is unusable, not maintainable it should be replaced.   I think if you 
estimated the time / cost to rebuild the system from scratch it would 
still be the better than trying to continue with this PITA system.

Why don't you at least start on a new UI from this point and show the 
company the benefits and then work on replacing the old UI?

I think holding on to the old way of doing things just because so much 
time was put into it is perhaps a short term solution.

Dan T
On Mar 1, 2005, at 3:56 PM, Richard Lynch wrote:
My current employer has designed a sort of CMS (except it has so many
site-specific hard-coded features that it's not a CMS at all) where 
things
happen such as:

If you are in the middle of adding a new user, their name appears with 
a
yellow background, and only after you fill out the other pages and hit
Submit on the last page, does the user really become active.

If you change a user's status, that checkbox appears in a yellow
background until they hit submit on the next page.
They've also got Cancel buttons that cancel out of your current 
action
which is stacked on top of some other action...  EG: Adding a new 
group
and then adding a new user to that group, you can cancel out of 
adding
the new user and end up back at the new group's management page, with
the new group still not really created.

This behaviour is all over the place in a zillion different 
fields/tables
in a database I didn't design, and would just as soon not try to mess 
with
as much as possible.

So I'm trying to think of a Modular and consistent way to handle 
this...

One idea I'm pondering goes like this:
Create a session_action table, which has:
id
session_id
rank (order of operation)
query (text)
Then, at the top of each page, start a transaction which consists of 
ALL
the queries so far that they WOULD execute if they were on the page 
where
they could hit the Submit button, and they did hit the submit button.

Then, at the end of each script, ROLLBACK the transaction.
Of course, when they do hit the Submit button, do a COMMIT.
Then I'd need to either:
A) Be able to ask the database for a query to be run OUTSIDE the 
context
of the transaction, even though I am inside that context, OR
B) Run the queries for a page both before and after the partial
transaction, and compare result sets.

A) Sounds real nice, but I've never seen that in the MySQL manual, or 
any
other SQL manual...  What am I supposed to Google for here?

B) is do-able, but gonna get ugly real fast in comparing result sets...
Has anybody done this in PHP (w/ MySQL) and have any hard-won 
experience?

Anybody got a better idea for handling this sort of design in any
reasonable fashion?
My predecessor has a zillion temp_xyz tables where stuff that's not 
yet
submitted is stored, and then he did funky things to work out what to
show to any given user, and I can't even figure it out, much less work
with it...

And adding a temp_xyz table for every single table in the database 
would
drive me nuts anyway.

I'm also considering adding a table:
create pending_actions(
user_id (who sees this pending action)
table_name (what other table will change)
action (enum{insert, delete, update})
field (name of field to change [or ID to delete/insert])
value (value to change to)
and somehow trying to do a UNION or something with that for each query.
Ugh!
Can you tell I'm not real happy with this design ? :-v
Open to any ideas.  (or good job offers, at this point in my day :-^)
--
Like Music?
http://l-i-e.com/artists.htm
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


Re: [PHP] help with adding

2005-02-25 Thread Dan Tappin
You could try:
for ($i = 1; isset( $_POST['qty'.$i] ); $i++)
{
$qty = $_POST['qty'.$i];
$total .= $qty;
echo $qty . 'br /';
}
echo $total;
Dan T
On Feb 24, 2005, at 8:39 AM, Jay Fitzgerald wrote:
I have messed with this for a couple of days and cant get it right. 
Maybe I
need sleep :-)


The code below is echoing the qty correctly (10, 5, 25)

for ($i = 1; $i = $sendnum; $i++)
{
$qty = $_POST['qty'.$i];
echo $qty . 'br /';
}

The question is, how would I take add each of these numbers (10+5+25)?

Any help is appreciated.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[PHP] Enable CLI on Mac OS X

2003-02-13 Thread Dan Tappin
Hello all,

I am running a few Apache 1.3.x / PHP 4.2.3 systems and I would like to 
mess around with using PHP from the command line.

I installed PHP from a nice .pkg installer from Tenon (www.tenon.com) 
and it runs fine.  The problem is that there is no source code on my 
system to run a simple ./configure --enable-cli etc...

I am thinking that I need to install PHP (v4.3 while I am at it) from 
scratch to do this.  I was wondering if anyone can think of a work 
around or any other ideas?

Thanks,

Dan


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[PHP] Form element names starting with the + character????

2002-10-27 Thread Dan Tappin
I have a simple method of creating easy form processing I thought

I came up with the idea (I am not claiming to be the first) to have form
elements I want to update via MySQL starting with either - or +.

Example:

+name=DAN
[EMAIL PROTECTED]
-notes=
id=1

The first 2 are required and will be updated, the 3rd is optional and will
be updated and the 4th (id) is simply passed as form data.

The idea here is that I parse the $_POST variable to auto create a UPDATE
table SET name = 'Dan', email = '[EMAIL PROTECTED]' WHERE = 1 string for
MySQL.

The issue is that if I use the + to indicate a required field for error
trapping my $_POST array ends up like this:

+namD=AN
[EMAIL PROTECTED]
-notes=
id=1

Either this is a PHP / HTTP bug or I am up against some strange post naming
restriction.  I searched the web, the PHP site (includeing the bugs) and
could not spot an obvious reference.

Any ideas out there?

Dan


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Form element names starting with the + character????

2002-10-27 Thread Dan Tappin
I figured it was something like that.

Thanks,

Dan

On Sunday, October 27, 2002, at 01:41  AM, eNetwizard Developers Team 
wrote:

My understanding is since $+ is illegal, PHP strips the illegal
characters from the post variables when creating the post array.  I 
once
read it somewhere and if I recall correctly it either strips them
entirely or turns them into underscores.

-Samuel | http://enetwizard.net


-Original Message-
From: Dan Tappin [mailto:dan;wavefront.ca]
Sent: Sunday, October 27, 2002 2:20 AM
To: [EMAIL PROTECTED]
Subject: [PHP] Form element names starting with the + character

I have a simple method of creating easy form processing I
thought

I came up with the idea (I am not claiming to be the first) to have 
form
elements I want to update via MySQL starting with either - or +.

Example:

+name=DAN
[EMAIL PROTECTED]
-notes=
id=1

The first 2 are required and will be updated, the 3rd is optional and
will
be updated and the 4th (id) is simply passed as form data.

The idea here is that I parse the $_POST variable to auto create a
UPDATE
table SET name = 'Dan', email = '[EMAIL PROTECTED]' WHERE = 1 string 
for
MySQL.

The issue is that if I use the + to indicate a required field for
error
trapping my $_POST array ends up like this:

+namD=AN
[EMAIL PROTECTED]
-notes=
id=1

Either this is a PHP / HTTP bug or I am up against some strange post
naming
restriction.  I searched the web, the PHP site (includeing the bugs) 
and
could not spot an obvious reference.

Any ideas out there?

Dan


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php







--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Form element names starting with the + character????

2002-10-27 Thread Dan Tappin
Hello Edwin,

What do you mean by SQL injection...?

Thanks,

Dan

On Sunday, October 27, 2002, at 01:01  AM, @ Edwin wrote:


Hello,

Are you sure you want to do something like this?

This seems like a good candidate for an SQL injection...

(Well, I'm not really sure how you're doing it so I could be wrong.)

Just wondering...

- E

Dan Tappin [EMAIL PROTECTED] wrote:


I have a simple method of creating easy form processing I 
thought

I came up with the idea (I am not claiming to be the first) to have 
form
elements I want to update via MySQL starting with either - or +.

Example:

+name=DAN
[EMAIL PROTECTED]
-notes=
id=1

The first 2 are required and will be updated, the 3rd is optional and 
will
be updated and the 4th (id) is simply passed as form data.

The idea here is that I parse the $_POST variable to auto create a 
UPDATE
table SET name = 'Dan', email = '[EMAIL PROTECTED]' WHERE = 1 string 
for
MySQL.

The issue is that if I use the + to indicate a required field for 
error
trapping my $_POST array ends up like this:

+namD=AN
[EMAIL PROTECTED]
-notes=
id=1

Either this is a PHP / HTTP bug or I am up against some strange post
naming

restriction.  I searched the web, the PHP site (includeing the bugs) 
and
could not spot an obvious reference.

Any ideas out there?

Dan


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php





--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




[PHP] Mac OS X EI TEXTAREA Problem

2002-10-26 Thread Dan Tappin
I am setting a MySQL update page where a user is provided a HTML form to
update with data auto poulated from a MySQL database via PHP.

All the form element work except for TEXTAREA.

No matter what encoding I use (htmlspecial, htmlentities etc) I get the
browser displaying garbeld text.

Example:

MySQL data:

Headquartered in ABC Building in Anytown,  Any Province, ABC Inc. employs
approximately 2,500 people and holds almost $9 billion in quality growth
assets.  A fully integrated oil and gas company, ABC ranks second in
production and third in reserves relative to Canada's four other integrated
oil and gas companies and is the fourth-largest downstream retailer.

HTML TEXTAREA Source:

Headquartered in ABC Building in Anytown,  Any Province, ABC Inc. employs
approximately 2,500 people and holds almost $9 billion in quality growth
assets.  A fully integrated oil and gas company, ABC ranks second in
production and third in reserves relative to Canada's four other integrated
oil and gas companies and is the fourth-largest downstream retailer.

TEXTAREA Data:

5{d in ABC Building in Anytown,  Any Province, ABC Inc. employs
approximately 2,500 people and holds almost $9 billion in quality growth
assets.  A fully integrated oil and gas company, ABC ranks second in
production and third in reserves relative to Canada's four other integrated
oil and gas companies and is the fourth-largest downstream retailer.

Or

pd in ABC Building in Anytown,  Any Province, ABC Inc. employs
approximately 2,500 people and holds almost $9 billion in quality growth
assets.  A fully integrated oil and gas company, ABC ranks second in
production and third in reserves relative to Canada's four other integrated
oil and gas companies and is the fourth-largest downstream retailer.

I can't get the same results in Netscape 7 Mac or either Windows versions.
I will blame Microsoft unless there is some obscure encoding issue I can't
find. :^)

Thanks,

Dan


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




[PHP] Strange PHP + MySQL add / update issue with NULL values

2002-08-17 Thread Dan Tappin

I have a table where I have specified several columns which I have specified
that NULL values are not allowed.

I have created a PHP based create / update / delete page where users can
update the table.

I have an INSERT script that takes the user input and generates the
following query statement.

Insert:

INSERT INTO table SET required_field = NULL

I have set the required field to NULL which results in an error because
naturally this is a required field.  If I use an actual value the query runs
fine and the row is added.


Now I have another page that allows the user to update the existing rows.

Update:

UPDATE table SET required_field = NULL WHERE id = '2'

This assumes that the user has cleared a required field and is attempting to
enter NULL data for a required field.  If I execute this directly in mysql
the query fails (0 rows touched).

If I execute this via PHP from the web page the row is updated but it passes
 instead of NULL so the row is updated.  The query above is echoed right
from the web page and pasted into MySQL.

Any idea?

Thanks,

Dan


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] RE: Strange PHP + MySQL add / update issue with NULLvalues

2002-08-17 Thread Dan Tappin

That is what PHP / MySQL seems to be doing to the query once it is sent.

I want to pass NULL to the column not a blank field (i.e.  for text and 0
for numbers).  If I do INSERT INTO table SET required_field = I get the
same results.  NULL means no value at all and  is a empty string which in
MySQL terms are two completely different things.

I have also noticed another weird issue:

UPDATE table SET required_field = NULL, notrequired_field = NULL WHERE id =
'2'

Results in:

idrequired_field notrequired_field

2 NULL

This is strange...  All of my NOT NULL columns result in '' data instead of
NULL but colunms that do not have a NOT NULL constraint do result in NULL!

Dan

 Try this instead:
 
 INSERT INTO table SET required_field =
 
 -Original Message-
 From: Dan Tappin [mailto:[EMAIL PROTECTED]]
 Sent: Saturday, August 17, 2002 12:56 PM
 To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
 Subject: Strange PHP + MySQL add / update issue with NULL values
 
 
 I have a table where I have specified several columns which I
 have specified
 that NULL values are not allowed.
 
 I have created a PHP based create / update / delete page where users can
 update the table.
 
 I have an INSERT script that takes the user input and generates the
 following query statement.
 
 Insert:
 
 INSERT INTO table SET required_field = NULL
 
 I have set the required field to NULL which results in an error because
 naturally this is a required field.  If I use an actual value the
 query runs
 fine and the row is added.
 
 
 Now I have another page that allows the user to update the existing rows.
 
 Update:
 
 UPDATE table SET required_field = NULL WHERE id = '2'
 
 This assumes that the user has cleared a required field and is
 attempting to
 enter NULL data for a required field.  If I execute this directly in mysql
 the query fails (0 rows touched).
 
 If I execute this via PHP from the web page the row is updated
 but it passes
  instead of NULL so the row is updated.  The query above is echoed right
 from the web page and pasted into MySQL.
 
 Any idea?
 
 Thanks,
 
 Dan


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




[PHP] Conditional Popup Menus with PHP/mySQL and Java?

2002-08-15 Thread Dan Tappin

I am looking for an example of conditional menus using PHP / mySQL to
populate the options and values of the menus and java to change these
properties with out needing to submit the form to update it.

Here is the best, closest example I could find using a static page:

http://www.webreference.com/js/tips/020112.html

I am looking to create a set of popup menus via PHP and mySQL such as:

FORM NAME=menu
SELECT NAME=menu1 onChange=somejavascript()
OPTION VALUE=1 SELECTEDAnimal
OPTION VALUE=2Vegetable
OPTION VALUE=3Mineral
/SELECT

SELECT NAME=menu2
OPTION VALUE=1.1 SELECTEDCat
OPTION VALUE=1.2Dog
OPTION VALUE=1.3Horse
/SELECT
/FORM

The idea being that when I change menu1 the choices on menu2 change
accordingly. Menu1 is easy.  The java script to make menu2 is where I am
lost.  The link above is great but it does not address setting the values of
menu2.  Also the java uses the text of menu1 not the values (1,2,3 etc).
These values are the id values from my mySQL DB and make the queries easier.

Any ideas / examples out there?


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Conditional Popup Menus with PHP/mySQL and Java?

2002-08-15 Thread Dan Tappin

Yes a javascript list is my next stop.  After doing some digging I thought I
would give the PHP list a shot first.

I find it kind of gross loading ALL the data onto the page but I like the
look the conditional menus give.

Thanks,

Dan

 This is a javascript thing.  Try comp.lang.javascript... the only thing u
 really need to know is that you have to send ALL the data to the page with
 javascript, then effectively, it's a static HTML page.
 
 Justin French
 
 
 
 on 16/08/02 12:19 AM, Dan Tappin ([EMAIL PROTECTED]) wrote:
 
 I am looking for an example of conditional menus using PHP / mySQL to
 populate the options and values of the menus and java to change these
 properties with out needing to submit the form to update it.
 
 Here is the best, closest example I could find using a static page:
 
 http://www.webreference.com/js/tips/020112.html
 
 I am looking to create a set of popup menus via PHP and mySQL such as:
 
 FORM NAME=menu
 SELECT NAME=menu1 onChange=somejavascript()
 OPTION VALUE=1 SELECTEDAnimal
 OPTION VALUE=2Vegetable
 OPTION VALUE=3Mineral
 /SELECT
 
 SELECT NAME=menu2
 OPTION VALUE=1.1 SELECTEDCat
 OPTION VALUE=1.2Dog
 OPTION VALUE=1.3Horse
 /SELECT
 /FORM
 
 The idea being that when I change menu1 the choices on menu2 change
 accordingly. Menu1 is easy.  The java script to make menu2 is where I am
 lost.  The link above is great but it does not address setting the values of
 menu2.  Also the java uses the text of menu1 not the values (1,2,3 etc).
 These values are the id values from my mySQL DB and make the queries easier.
 
 Any ideas / examples out there?




-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Group and count at the same time?

2002-08-15 Thread Dan Tappin

I think you want something like this:

SELECT genre, COUNT(*) as count FROM music GROUP BY genre;

Dan

 I am using PHP to maintain a catalog of music and have been just fine with
 it but have run into one thing i want to do and need some advice.
 
 The format of the data is like so:
 
 upc|genre|distributor|details
 
 What I want to do is grab a summary. So it would end up printing out:
 
 rock (43)
 country (41)
 
 and so on. Is this possible to do with one query or will I need to do it
 with more? So I want to count the number of each genre and provide a count
 for each.
 
 Jeff



-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] session.use_trans_sid

2002-06-29 Thread Dan Tappin

 On Saturday 29 June 2002 18:02, Dan Tappin wrote:
 I am setting up a login section of my site using sessions.  I have the
 login working with and without cookies enabled.  I do not want to restrict
 my users be requiring cookies.
 
 The problem is that I can't seem to get PHP to auto append the session id
 to the relative URLs on the page.
 
 I have the following PHP settings:
 
 php_value session.use_cookies 0
 php_value session.use_trans_sid 1
 
 I also had these setings in my php.ini file.
 
 Was your php compiled with '--enable-trans-sid' ?

Yes.  I checked that.

Dan



-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




[PHP] Sessions [Help]

2002-06-29 Thread Dan Tappin

This is a follow-up to another thread - [PHP] session.use_trans_sid

I am setting up a login section of my site using sessions.  I have the login
working with and without cookies enabled.  I do not want to restrict my
users be requiring cookies.

Here is my /login/login.php file which takes the results of the user login
form:

?

session_start();

if ($username  $password)
{

// Here is a MySQL query to verify that the username and password are valid

$num_rows = mysql_num_rows($login_result);

if ($num_rows 0 )
{
$row = mysql_fetch_array($login_result);
session_register(id);  // I register the user id for later use
$id = $row[id];   // I set the user id

// Once the user is verified I redirect to the main user page

$redirect =
http://www.fakeserver.com/login/home/index.php?sid=.session_id();
header(Location: $redirect);
};
};
?


The problem is that I can't seem to get PHP to auto append the session id to
the relative URLs on the following pages.

Here is a include that I have added to each subsequent page to verify that
this is a valid user:

?

// Now this is perhaps part of the issue.  I can't get these pages to keep
the session id unless I call session_name('sid') first.  I changed PHPSESSID
to SID in the config files.  If I comment out this my session variable $id
which I use to check for a valid session gets lost and my logout() function
triggers.

session_name('sid');

session_start();

if(!$id) {

logout();  // My logout function that clears the session variables and
destroys the session

};

// The rest of the HTML...

?

The problem is that the SID is not getting automatically added to the URL's.
If I allow cookies all is fine.  I can go from page to page in my 'secure'
login section and the $id session variable is accessible and the
verification works fine.  If I disable cookies the auto addition of the SID
does not happen at all.  The first page is fine because I hard coded the SID
into the header() call.  If I manual add the SID to local links it works as
well and I am not logged out.

This is driving me crazy!

I have the following PHP settings in my Apache VH:

php_value session.use_cookies 0  // This seems to have no effect on the
trans_sid issue as I have tried it both ways
php_value session.use_trans_sid 1

I also had these setings in my php.ini file.

Am I missing something basic about sessions here?  I have looked all over
the web for a simular problem and I can't find one.  Help!! :^)

Thanks,

Dan



-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




[PHP] Apache Default File Include

2002-04-04 Thread Dan Tappin

I had seen some where the procedure to add a default file to include in all
pages served in a virtual domain under Apache.

Can anyone point me to a FAQ on this of some keywords that I should search
the Apache site for.

I want to have a PHP file with all my generic functions loaded on every page
with out need to remember to add the include.

Thanks,

Dan

P.S. Please CC me as I am on digest 



Re: [PHP] Apache Default File Include

2002-04-04 Thread Dan Tappin

Thanks... That is exactly what I was looking for.

Dan
 
 go to the PHP online documentation and look in the configuration section.
 
 auto_append_file string
 Specifies the name of a file that is automatically parsed after the main
 file. The file is included as if it was called with the include() function,
 so include_path is used.
 
 The special value none disables auto-appending.
 
 Note: If the script is terminated with exit(), auto-append will not occur.
 
 auto_prepend_file string
 Specifies the name of a file that is automatically parsed before the main
 file. The file is included as if it was called with the include() function,
 so include_path is used.
 
 The special value none disables auto-prepending.
 - Original Message -
 From: Dan Tappin [EMAIL PROTECTED]
 To: PHP [EMAIL PROTECTED]
 Sent: Thursday, April 04, 2002 3:05 PM
 Subject: [PHP] Apache Default File Include
 
  I had seen some where the procedure to add a default file to include in
 all
  pages served in a virtual domain under Apache.
 
  Can anyone point me to a FAQ on this of some keywords that I should search
  the Apache site for.
 
  I want to have a PHP file with all my generic functions loaded on every
 page
  with out need to remember to add the include.
 
  Thanks,
 
  Dan
 
  P.S. Please CC me as I am on digest




[PHP] Sending a header redirect mid-page

2002-03-28 Thread Dan Tappin

I am trying to add error trapping to my site.  In particular I want to
direct visitors to an error page when for what ever reason a MySQL
connection can not be made.  Rather than a page full of errors I want a
generic 'we are temporarily closed performing maintenance etc.. etc'

Basically after a failed mysql_connect attempt I want a redirection to this
error page.  I have searched the PHP site and mailing lists and I have seen
a few solutions.

In particular I found the use of ob_start() before the header info is send
on the page then the use of the follow for the redirect:

if($dbfail) {

ob_end_clean();
header(Location: http://.$SERVER_NAME./closed.php;);
exit;  // Halt the rest of the page from loading

};

I have also thought about just using a mysql_connect test in the header of
each page that I have a mysql query in and have the redirect there.  I want
to have such an include any way to add some generic functions to call from
anywhere as well.

My only concern is that I am adding another mysql_connect and I don't want
to slow things down any (things are blazing fast now but I want to keep it
that way).

It would be really nice if there was a one line function that could do this.
I also use Lasso and they have a simple [URL_Redirect:'http://domain.com']
tag which does the job.

I am also unfamiliar with the output buffer functions even after reading up
on them in the manual.  If I call ob_start() at the start of my page do I
need to call a closing ob function after my $dbfail code if the connection
is successful and my redirect ob_end_clean(); call is not made?

Any help would be greatly appreciated.

Thanks,

Dan
P.S. Please CC me/the list as I am on Digest Mode :^)
-- 
Dan Tappin
Wavefront Communications Limited
P:(403) 241-0062
F:(403) 241-0302
E: [EMAIL PROTECTED]



-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Sending a header redirect mid-page

2002-03-28 Thread Dan Tappin

 -Original Message-
 From: Dan Tappin [mailto:[EMAIL PROTECTED]]
 Sent: Thursday, March 28, 2002 12:36 PM
 
 My only concern is that I am adding another mysql_connect and
 
 Why do it twice?  The connection will still be there later in the script.

Yes... I realized that after I hit send :^)

 I don't want to slow things down any (things are blazing fast now but I
 want to keep it that way).
 
 It's not worth worrying about microseconds

That's what I figured.
 
 It would be really nice if there was a one line function that
 could do this. I also use Lasso and they have a simple
 [URL_Redirect:'http://domain.com'] tag which does the job.
 
 You could write a function that does that like:
 function connect_to_db($host,$dbName,$user,$pass,$redirectTo) {
 $db = mysql_connect($host,$user,$pass);
 if (!db) {
 log(mysql_error());
 header(Location: $redirectTo);
 exit;
 }
 if (!mysql_select_db($dbname,$db)) {
  log(mysql_error());
  header(Location: $redirectTo);
  exit;
 }
 return $db;
 }

That is a really good idea.  Now do I need to do something like this:

? include('phpmysqlstuff.inc'); ?
html
Blaa blaa blaa
/html
? ob_end_clean(); ?

 
 I am also unfamiliar with the output buffer functions even
 after reading up on them in the manual.  If I call ob_start()
 at the start of 
 my page do I need to call a closing ob function after my $dbfail code if
 the connection is successful and my redirect ob_end_clean(); call is
 not made? 
 
 No, ob_end* ends the buffering.

I still do not get the ob stuff.  Is there any issue with having a
ob_start(); in my initial include and no ob_end* after this.  I guess I
still really don't understand what is actual happening when I call
ob_start().  All I know if that I can then call the header function where
ever I want later.
 
I just want to know if I am creating any type security, or memory issue by
calling ob_start and then not calling ob_end*.  I am going to take a guess
that when the server hits the end of the file the end is called anyway.

Thanks,

Dan


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




[PHP] Weird INCLUDE / mySQL problem

2002-03-16 Thread Dan Tappin

I have a simple INCLUDE file that creates a default dynamic tab style table
of contact for the top of each of my pages.

I wanted a solution where I could control the content by simply changing an
integer in mySQL indicating weather a tab was visible or not. It works but I
now have a strange problem.

Each entry in the DB has unique id but I recently added a 'order' value. For
example: Home = 10, Buy = 20, Sell = 30, Contact = 40. Well I added Manage =
35 so that I could sort my results and control the order with our re-writing
code.

The problem is that when I use the include the sort order gets lost. In all
cases I have the ORDER BY toc_order which are my 10,20,30,35 values in each
row.

Can anyone shed some light on this issue?

Here is a link for an example:

http://test.oilfiielddepot.com/test

Please CC me as I am on digest mode.

Thanks,

Dan Tappin ([EMAIL PROTECTED])


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php