The macosxhints Forums

The macosxhints Forums (http://hintsforums.macworld.com/index.php)
-   OS X Developer (http://hintsforums.macworld.com/forumdisplay.php?f=27)
-   -   PHP help (http://hintsforums.macworld.com/showthread.php?t=84860)

ryans 01-24-2008 04:09 PM
PHP help
 
Hello all!
I have been using PHP on my server and have a problem;
I am writing an Admin tool for my server, at the moment I am only writing the "View" part, not the edit part.

I can view the data by doing:
displayAccounts()

and here is the code:
Code:
// define url var
/*
$sort = $_GET['sort'];
*/
$account = $_GET['account'];


// Make a MySQL Connection
function displayAccounts(){
mysql_connect("localhost", "root", "root") or die(mysql_error());
mysql_select_db("a_28_logon") or die(mysql_error());

// Retrieve all the data from the "example" table
/* variable result */

if(!$sort || !$account){
$result = mysql_query("SELECT acct,login,password,gm,email,lastip FROM accounts ORDER BY acct DESC,login")
or die(mysql_error()); 
}
else{
$result = mysql_query("SELECT acct,login,password,gm,email,lastip FROM accounts ORDER BY acct DESC,login WHERE login='$account'")
or die(mysql_error()); 
};
/* end of result */
now i would like to baable to do this:
file.php?account=Admin

and (as you see) it would change results and add the varable..

this is not working. Please help me..

Also, I think I messed up the:
if(!$sort... etc


please help!!!

tw 01-24-2008 04:52 PM
well, you may want to use if ( empty($sort) || empty($account) ), or at least put in some check for non-existance, like $sort = ( isset($_GET['sort']) ) ? $_GET['sort'] : false;. I don't see anything wrong with your MySQL statement, but if MySQL throws an internal error (because you typed a variable wrong, or it can't find a row where login='Admin', or etc.) PHP will simply return false and go on processing the script.

ryans 01-24-2008 05:15 PM
alright...

i found my problem...

i changed it to this and it worked:
Code:
/* variable result */

if($_GET['account'] == ''){
$result = mysql_query("SELECT acct,login,password,gm,email,lastip FROM accounts ORDER BY acct DESC,login")
or die(mysql_error()); 
}
else{
$result = mysql_query("SELECT acct,login,password,gm,email,lastip FROM accounts WHERE login = '".$_GET['account']."' LIMIT 80")
or die(mysql_error()); 
};
/* end of result */
now i am working on sometihng else.. i will post here if i got a new problem

acme.mail.order 01-25-2008 01:05 AM
Although it's fine for now, your queries will quickly become unreadable if you stir in more variables. Try this way instead:

Code:
$query = sprintf("SELECT acct,login,password,gm,email,lastip ".
                "FROM accounts ".
                "WHERE login = '%s' LIMIT %d",
                addslashes($_GET['account']), 80);

if($debug) echo $query;
$result = mysql_query($query);

ryans 01-25-2008 02:54 PM
ok then.. lets try this
 
that seems confusing....
%s?? %d??

may i ask what the "addslashes" does?

also, this is my new code:
Code:
// define url var
$account = $_GET['account'];

// Make a MySQL Connection
function displayAccounts(){
mysql_connect("localhost", "root", "root") or die(mysql_error());
mysql_select_db("a_28_logon") or die(mysql_error());

// Retrieve all the data from the "example" table
/* variable result */

if($_GET['account'] == ''){
$result = mysql_query("SELECT acct,login,password,gm,email,lastip FROM accounts ORDER BY acct DESC,login")
or die(mysql_error()); 
}
else{
$result = mysql_query("SELECT acct,login,password,gm,email,lastip FROM accounts WHERE login LIKE '%".$_GET['account']."%' LIMIT 80")
or die(mysql_error()); 
};
/* end of result */
// store the record of the "example" table into $row
/*
$row = mysql_fetch_array( $result );
*/
  /* Error occurred, return given name by default */
  $num_rows = mysql_numrows($result);
  if(!$result || ($num_rows < 0)){
      echo "Error displaying info";
      return;
  }
  if($num_rows == 0){
      echo "No Characters";
      return;
  }

// Print out the contents of the entry



/* Display table contents */
  echo "<table align=\"center\" border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n";
  echo "<tr><td><b>Acct ID</b></td></td><td><b>Login</b></td><td>GM</td><td>Email</td><td>Last IP</td></tr>\n";
  for($i=0; $i<$num_rows; $i++){
      $acct = mysql_result($result,$i,"acct");
      $login = mysql_result($result,$i,"login");
      $password = mysql_result($result,$i,"password");
      $gm = mysql_result($result,$i,"gm");
      $email = mysql_result($result,$i,"email");
      $lastip = mysql_result($result,$i,"lastip");
      echo "<tr><td>$acct</a></td><td>$login</td><td>$gm</td><td>$email</td><td>$lastip</td></tr>\n";
  }
  echo "</table><br>\n";
};
then i call it with displayAccounts()

if you could explain how to add yours to my code, then it might be easyer for me to understand...

ryans 01-25-2008 03:36 PM
aww.. ok i am now working on a edit page..

idk if anyone can help, but if you can PLEASE do.

I get this error:
"Parse error: syntax error, unexpected $end in /Library/WebServer/Documents/adminpanel/admin/files/editcopy.php"

here is my FULL code:
Code:
<?php
/* set variables */
$thispage=='EditMain';
$account = $_GET['account'];

/* done */
function displayEdit(){
// Make a MySQL Connection
function displayAccounts(){
mysql_connect("localhost", "root", "root") or die(mysql_error());
mysql_select_db("a_28_logon") or die(mysql_error());

/* add the checker: */
if( $_GET['account'] == ''){
echo "No Account Picked...<br><br><a href=\"view.php\">Find an account now</a><br>";
}
else{
$acctest = mysql_query("SELECT login FROM accounts WHERE account = '".$_GET['account']."' LIMIT 20")
or die(mysql_error());

  /* Error occurred, return given name by default */
  $num_rows_edit = mysql_numrows($acctest);
  if(!$result || ($num_rows_edit < 0)){
      echo "Error displaying info";
      return;
  }
  if($num_rows_edit == 0){
      echo "Not a valid character";
      return;
  }
if($num_rows_edit == 1){
$allowedit=='yes';
}       
else{
echo "More than 1 charcacter, try to use the exact name";
}

if( $allowedit == 'yes' ){
$result = mysql_query("SELECT * FROM accounts WHERE login = '".$_GET['account']."' LIMIT 1")
or die(mysql_error());

  /* Error occurred, return given name by default */
  $num_rows = mysql_numrows($result);
  if(!$result || ($num_rows < 0)){
      echo "Error displaying info";
      return;
  }
  if($num_rows == 0){
      echo "Nothing Weird";
      return;
  }

/* Display table contents */
  echo "<table align=\"center\" border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n";
  echo "<tr><td><b>Acct ID</b></td></td><td><b>Login</b></td><td>GM</td><td>Email</td><td>Last IP</td></tr>\n";
  for($i=0; $i<$num_rows; $i++){
      $acct = mysql_result($result,$i,"acct");
      $login = mysql_result($result,$i,"login");
      $password = mysql_result($result,$i,"password");
      $gm = mysql_result($result,$i,"gm");
      $email = mysql_result($result,$i,"email");
      $lastip = mysql_result($result,$i,"lastip");
      echo "<tr><td><input type=\"text\" name=\"acct\" value=\"$acct\"></a></td><td><input type=\"text\" name=\"login\" value=\"$login\"></td><td>$gm</td><td><input type=\"text\" name=\"email\" value=\"$email\"></td><td>$lastip</td></tr>\n";
  }
  echo "</table><br>\n";
}
};
/* done with checker */

/* add header file */

include('includes/header.php');

/* page time */
?>
<center>
<h4>Edit page</h4>
<br>
<?
displayEdit()
?>
<br><br>


</body>
</html>
maybe if anyone could simply it? or make it work!

thanks so much!!

navaho 01-25-2008 04:30 PM
well, if nothing else

displayEdit()

needs to be

displayEdit();

And addslashes is documented with ALL php functions at php.net

http://us3.php.net/addslashes

If you're embedding php code in html or if you're taking data from a form and putting it into a database you'll need to know it and know it well.

acme.mail.order 01-25-2008 08:28 PM
To expand on what navaho said, addslashes makes it a lot harder for someone to type "drop database *;" into a form field and nuke your system.

And an "Unexpected $end" can also mean that you are missing a } somewhere.

Quote:
that seems confusing....
%s?? %d??
Not at all. %s means use string data, %d means use numeric (digit) data. sprintf allows you to do very complex data replacements in a string while maintaining readability. Concatenating many array references will be really difficult to understand 6 months from now.

printf ("%s fish, %s fish, % fish, %s fish.", "one", $numbernames[2], (if($result) ? "red" : "no"), chr(98).chr(108).chr(117).chr(101) )

one fish, two fish, red fish, blue fish.

acme.mail.order 01-26-2008 12:50 AM
Your code above has 12 { but only 10 }. Hence the "Unexpected $end".

And a code tidy-up:

Code:
printf( '<tr><td><input type="text" name="acct" value="%s"></td>
<td><input type="text" name="login" value="%s"></td>
<td>%s<td>
<td><input type="text" name="email" value="%s"></td>
<td>%s</td></tr>',
$acct, $login, $gm, $email, $lastip);

ryans 01-26-2008 09:11 AM
Quote:
Originally Posted by acme.mail.order (Post 445682)
To expand on what navaho said, addslashes makes it a lot harder for someone to type "drop database *;" into a form field and nuke your system.

And an "Unexpected $end" can also mean that you are missing a } somewhere.
ok thanks!

here are my files:
http://pastebin.com/f2f47c57a --edit page
http://pastebin.com/f1fae5aa7 --- edit process page
http://pastebin.com/f215eae5f ---search page


____________
i figured out the '}' thing... yes, i added them (in the right place) and its fixed..

could someone please help me add the "addslashes"-- it kinda scares me that someone could do "drop table *" in a form, and the way i wrote it, i think they can...

thanks so much

tw 01-26-2008 03:27 PM
actually, this somewhat depends on which version of PHP you're using, but I'd use mysql_real_escape_string() rather than addslashes(). does the same thing, but a little better.

the worry here is that someone will enter something into a text field that will play off of MySQL's liberal interpretation of quotes and commands. basically you trick php into adding extra quotes into a MySQL command. the example they have on the php.net page - which is down at the moment, so I can't get a direct link - runs like this:

you want to sent this sql command to MySQL

"select * from tableA where name='$name' and pass='$pass'"

so if someone puts george and gumbo into the name and pass fields in the webpage, this command becomes

"select * from tableA where name='george' and pass='gumbo'"

but, if someone types george and ' or ' '=' , the command sent to MySQL is

"select * from tableA where name='george' and pass='' or ' '=' '"

which will return all the data in tableA, because ' '=' ' is always true. escaping the quotes using addslashes or mysql_real_escape_string() means that MySQL will see the quote marks in the text field as text rather than as part of the command syntax.

to use it, just add in the line $myText = mysql_real_escape_string($myText) before you send anything via a mysql_query()

ryans 01-26-2008 03:58 PM
so it would be like this:
Code:
$query = "SELECT * from accounts";
$querytext = mysql_real_escape_string($query);
$result = mysql_query($querytext);
am i correct??

ryans 01-26-2008 04:13 PM
this is what i have... no errors, but it just dont work....
Code:
<?php
$acct = $_GET['acct'];
$login = $_GET['login'];
$email = $_GET['email'];

if( $login = '' || $email = '' ){
echo "Nope... you tried to mess something up...";
}
else{
// Make a MySQL Connection
mysql_connect("localhost", "root", "root") or die(mysql_error());
mysql_select_db("a_28_logon") or die(mysql_error());

/* edit query */
$acctsafe = mysql_real_escape_string($_GET['acct']);
$loginsafe = mysql_real_escape_string($_GET['acct']);
$emailsafe = mysql_real_escape_string($_GET['email']);

/* $main = "UPDATE accounts SET login='".$loginsafe."', email='".$emailsafe."' WHERE acct='".$emailsafe."'"; */
$query = mysql_query("UPDATE accounts SET login='".$loginsafe."', email='".$emailsafe."' WHERE acct='".$emailsafe."'")
or die(mysql_error());

echo "Should have changed";
echo "<br>";
echo "<a href=\"index.php\">Go Back</a>";



};
?>

tw 01-26-2008 04:23 PM
Quote:
Originally Posted by ryans (Post 445895)
so it would be like this:
Code:
$query = "SELECT * from accounts";
$querytext = mysql_real_escape_string($query);
$result = mysql_query($querytext);
am i correct??
well, not exactly. in the case you've presented there is no client-derived data, so nothing you need to escape. it would make more sense in a case like this:

Code:
$user_name = $_POST['user_name']
$user_name_cleaned = mysql_real_escape_string($user_name);
$query = "SELECT * from accounts where name='$user_name_cleaned'";
$result = mysql_query($query);
$user_name is POST data the client has just submitted, so you escape any problematic characters the user might have added in the form and use that cleaned string in your query string.

you might also look into the strip_tags() function of PHP. that's not as vital for security - it just removes html tags from anything people type intoforms (you'll sometimes get people trying to slip links to their webpages into form elements if they think the text is going to get written straight back out to the browser

ryans 01-26-2008 04:26 PM
you did see my code?? right??

it shows what i am doing.. it just dont work

tw 01-26-2008 04:31 PM
Quote:
Originally Posted by ryans (Post 445904)
this is what i have... no errors, but it just dont work....
you're setting account = emailsafe - shouldn't that be acctsafe?
with modifications...
Code:
"UPDATE accounts SET login='$loginsafe', email='$emailsafe' WHERE acct='$acctsafe'"
note: within double-quotes, php will process variables, even if the variables are within single-quotes that are inside double-quotes. quoting can get tricky - you should read the php.net page on strings carefully...

tw 01-26-2008 04:32 PM
Quote:
Originally Posted by ryans (Post 445911)
you did see my code?? right??

it shows what i am doing.. it just dont work
sorry - time lag... :)

ryans 01-26-2008 04:52 PM
ok... i see what i did wrong.. will post in a bit

ryans 01-26-2008 04:56 PM
thanks guys!!!
(tw) and others!!

now I got a new project-- puting all these files in a login system (using the accounts table that i allready have)..

my goal is this:
make a login system for the admin area..
where anyone in the accounts table can login but only people who have a "z" in the "GM" collumn can see the "admin" area... the rest of the users can only edit their account...

anyone wanna help?
I dont have an idea where to start...

acme.mail.order 01-26-2008 08:04 PM
Code:
$result = mysql_query($query);
$thisrow = mysql_fetch_array($result, MYSQL_ASSOC);
if($thisrow['GM'] == 'z') include ("adminarea.php");

ryans 01-26-2008 10:04 PM
ok.. I think i would use a echo instead that, like this:

--regular member pages
Code:
$mmquery = "SELECT * from accounts WHERE login='$name' && password='$password'";
$mmresult = mysql_query($mmquery);
$mmthisrow = mysql_fetch_array($mmresult, MYSQL_ASSOC);

if($mmthisrow['GM'] == '%z%'){
echo "<a href=\"admin/panel/index.php\">Admin Area</a>";
}
and then for the admin pages themself:
Code:
$pagequery = "SELECT * from accounts WHERE login='$name' && password='$password'";
$pageresult = mysql_query($pagequery);
$pagethisrow = mysql_fetch_array($pageresult, MYSQL_ASSOC);
if($pagethisrow == '%z%'){
?>
<!-- copy page code here -->
<?
}
else{
echo "Sorry, your not a Admin";
};
?>

ryans 01-26-2008 10:05 PM
am i using the '&&' right?

acme.mail.order 01-26-2008 10:09 PM
What's this?
Quote:
Originally Posted by ryans (Post 446001)
if($mmthisrow['GM'] == '%z%'){
Are you actually storing the values exactly like that? "%z%"?? Why?

Quote:
echo "<a href=\"admin/panel/index.php\">Admin Area</a>";
Now you have to work up a completely separate authentication system for the admin/panel area. Doubles your work.

tw 01-26-2008 10:28 PM
Quote:
Originally Posted by ryans (Post 446002)
am i using the '&&' right?
&& is php code - use the word and inside mysql statements

ryans 01-26-2008 10:35 PM
alright, will do..

and i wont have to do double the work.. what you mean?

acme.mail.order 01-26-2008 10:45 PM
Quote:
Originally Posted by tw (Post 446012)
&& is php code - use the word and inside mysql statements
Mysql (at least mysql5) recognizes && as a logical AND.

Quote:
Originally Posted by ryans (Post 446013)
alright, will do..

and i wont have to do double the work.. what you mean?
Linking to another page after authentication doesn't protect the other page. Anyone who knows the address can access it. So you now need to re-authenticate the user, either with POST data (bad), a cookie (better), an encrypted cookie (best) or Yet Another Login Form.

However, if you include a page fragment after authentication you not only hide the code, you hide the code's location as the file name never has to be presented to the user.

ryans 01-26-2008 10:52 PM
no.. i could use the same system that allows the user to see the link...

anyways i am kinda new at php... i wouldnt know about using the cookies...

thanks
ryans

tw 01-26-2008 10:57 PM
Quote:
Originally Posted by acme.mail.order (Post 446016)
Mysql (at least mysql5) recognizes && as a logical AND.
ah, sorry - I'm stuck using mysql 4 until my server upgrades (which might be about the time mysql 12 comes out - universities, I tell ya...)

acme.mail.order 01-26-2008 11:13 PM
And here I thought universities were supposed to be at the leading edge of everything - technology, knowledge, drinking contests etc.

tw 01-26-2008 11:24 PM
Quote:
Originally Posted by acme.mail.order (Post 446027)
And here I thought universities were supposed to be at the leading edge of everything - technology, knowledge, drinking contests etc.
yeah, well. university bureaucracies do to professors what some professors do to lab rats. karma, I suppose... but it does help us keep ahead on the drinking contests. :D

ryans 01-30-2008 02:37 PM
no.. i need the %z%

because its WILDCARD

acme.mail.order 01-30-2008 06:38 PM
% is a SQL wildcard, it is not stored in the database that way. And you've used it in a PHP function, not a database context. The PHP == operator will treat what you typed as literal text. You need to read the PHP manual section on string functions. And if you use it in SQL as a wildcard you can't use the equality operator. Read the SQL manual section on string functions too.

ryans 01-30-2008 08:09 PM
so, even though i need the wild card, i dont put it in?

Weird.. I will give it a try though..

acme.mail.order 01-31-2008 12:16 AM
You are trying to use a SQL wildcard in a PHP operation. Won't work.

This:
Code:
$pagethisrow = mysql_fetch_array($pageresult, MYSQL_ASSOC);
if($pagethisrow == '%z%')
will never match. Ever. In the first line, $pagethisrow becomes an array. In the second row, you ask "is this array variable equal to this 3-character text string?" As oranges are not toasters it will always return false.

This:
Code:
$mmresult = mysql_query($mmquery);
$mmthisrow = mysql_fetch_array($mmresult, MYSQL_ASSOC);

if($mmthisrow['GM'] == '%z%'){
is better, as it has a chance of matching. But this is a literal string comparison - there is no wildcard character. You need to use something like:
Code:
if( false !== strpos($mmthisrow['GM'], 'z') ) {

The proper use of '%' as a wildcard is in the SELECT query, for example

Code:
SELECT * from accounts WHERE login='$name' && password='$password' && GM LIKE '%z%'

ryans 01-31-2008 03:02 PM
alright thanks


All times are GMT -5. The time now is 06:13 AM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.
Site design © IDG Consumer & SMB; individuals retain copyright of their postings
but consent to the possible use of their material in other areas of IDG Consumer & SMB.