php-general Digest 11 May 2006 07:26:48 -0000 Issue 4121
Topics (messages 235935 through 235966):
Re: Cannot suppress fsockopen errors
235935 by: Richard Lynch
Re: internal operation
235936 by: Richard Lynch
235941 by: Rory Browne
Re: Good Answers
235937 by: João Cândido de Souza Neto
235939 by: Richard Lynch
235942 by: Micky Hulse
235943 by: tedd
235946 by: Jochem Maas
235953 by: Ligaya Turmelle
235954 by: Ligaya Turmelle
Re: Is there an easier way of doing this?
235938 by: Richard Lynch
Re: Upload File
235940 by: Rory Browne
235948 by: Jochem Maas
235950 by: Jochem Maas
question about using temporary named pipe in the string for system
235944 by: Ginger Cheng
235945 by: Joe Henry
235947 by: Jochem Maas
Re: PHP URL query
235949 by: Jochem Maas
Re: file Upload - checking file size before uploading
235951 by: Wolf
235956 by: Chris
235962 by: Wolf
Re: PHP suddenly stops working on FreeBSD
235952 by: Matt
php parsing and db content
235955 by: Schalk
235957 by: Chris
235958 by: Chris
235959 by: Schalk
235961 by: Schalk
235963 by: Chris
getting $_GET params from iFrame window to parent
235960 by: blackwater dev
Parsing images
235964 by: Dotan Cohen
235965 by: Dan Harrington
235966 by: Peter Hoskin
Administrivia:
To subscribe to the digest, e-mail:
[EMAIL PROTECTED]
To unsubscribe from the digest, e-mail:
[EMAIL PROTECTED]
To post to the list, e-mail:
[email protected]
----------------------------------------------------------------------
--- Begin Message ---
On Wed, May 10, 2006 5:30 am, Nick Wilson wrote:
> Im having a hard time surpressing fsckopen() errors. I've looked at
> the
> manual and searched around, but what i am doing /appears/ to be
> correct,
> yet im still geting warnings...
>
> here's the code:
>
> // open a socket to the server
> if($handle = @fsockopen($bits['host'], 80, $errno, $errstr, 10) or
> die("die")) {
> return true;
> }
>
> and here are the warnings:
>
> warning: fsockopen(): php_network_getaddresses: getaddrinfo failed:
> Name
> or service not known in
> /var/www/localhost/vhosts/payment.communicontent.com/modules/partners/inc/includes/validateBlog.inc
> on line 53.
>
> warning: fsockopen(): unable to connect to www.ivana.dk:80 in
> /var/www/localhost/vhosts/payment.communicontent.com/modules/partners/inc/includes/validateBlog.inc
> on line 53.
>
> I've even tried looking though php.ini for any clues and i dont see
> anything useful. Does anyone have an idea of what im missing here?
@ should suppress those, I would think...
You may want to try using http://php.net/set_error_handler
And on your production server, the errors should be going to an
error_log and not the browser anyway.
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
On Wed, May 10, 2006 4:11 am, Luke Cole wrote:
> Do the file system and directory functions, perform the file system
> command relative to your OS.
>
> e.g.
> does the internal code of the function:
> rename("oldname", "newname");
>
> do exactly (in unix file systems):
> `mv oldname newname`
>
> do exactly (in windows file systems):
> `ren oldname newname`
I believe there are C libraries from, say, <stdlib> that they are
using, which, under the hood, are what the shells use.
So, in reality, it's more like:
PHP ----------\
+-------- C library to rename file
DOS/Shell-----/
> If not, how does it do it?
I could be wrong. Maybe it's just magic. :-)
> Also, if one disables users from using ``,
> are all file system and directory functions disabled to?
I don't think so.
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
www.php.net/streams
On 5/10/06, Richard Lynch <[EMAIL PROTECTED]> wrote:
On Wed, May 10, 2006 4:11 am, Luke Cole wrote:
> Do the file system and directory functions, perform the file system
> command relative to your OS.
>
> e.g.
> does the internal code of the function:
> rename("oldname", "newname");
>
> do exactly (in unix file systems):
> `mv oldname newname`
>
> do exactly (in windows file systems):
> `ren oldname newname`
I believe there are C libraries from, say, <stdlib> that they are
using, which, under the hood, are what the shells use.
So, in reality, it's more like:
PHP ----------\
+-------- C library to rename file
DOS/Shell-----/
> If not, how does it do it?
I could be wrong. Maybe it's just magic. :-)
> Also, if one disables users from using ``,
> are all file system and directory functions disabled to?
I don't think so.
--
Like Music?
http://l-i-e.com/artists.htm
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
--- End Message ---
--- Begin Message ---
I agree.
Some times i don´t put my questions here because i don´t know how to ask.
But, many people do.
""Richard Lynch"" <[EMAIL PROTECTED]> escreveu na mensagem
news:[EMAIL PROTECTED]
> Hey y'all...
>
> In the spirit of improving the mailing list, I'd like to suggest that
> we, as a group, attempt to not provide answers with Bad Practices, or
> at least always to point out that the Sample is Bad Practice for
> production sites?
>
> For example, an answer to a question about <?php echo $foo?> where it
> is clear that register_globals is "off" should either specifically
> sanitize the data, or make reference to the need to sanitize the data,
> or link to http://phpsec.org or something along those lines.
>
> Otherwise, we merely perpetuate the problems of Bad Code with our
> answers to newbies, who then run off and write insecure sites and
> cause us more grief down the road.
>
> Hmmm. Maybe this should be part of a Netiquette document "How to give
> good answers" right next to that "How to ask good questions" document
> :-^
>
> --
> Like Music?
> http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
On Wed, May 10, 2006 2:16 pm, Eric Butera wrote:
> On 5/10/06, Richard Lynch <[EMAIL PROTECTED]> wrote:
> these issues because they don't even know to consider these things. I
> still see so many examples passed on that have the ability to inject
> SQL or spam via E-Mail Header injection. I mean to be fair the php
> manual never mentions that if you don't protect the parameters going
> into mail() injection is possible.
>
> I know the argument always ends up being "The language is there, you
> need to protect yourself from shooting your own foot." But isn't PHP
> so popular because the barrier into programming with it so low?
I understand that the Manual and our answers could not possibly
anticipate, much less provide advice to avoid, every possible
combination of events that leads to losing one's foot.
That said, if we didn't care about keeping our feet, wouldn't we all
be writing CGI scripts and custom Apache Modules in C?
PHP *has* lowered the "entry barrier" ridiculously low, to the point
where we've got "idiots and English majors" writing really cool
software -- complete with a total lack of any security features
whatsoever.
We've made it so damn easy -- Isn't it our responsibility, to some
degree, to warn users that they really do need to buy those trigger
guards and locked cabinets and store the ammo separately from the
weapon?
This is always a judgement call, but do we really want to spend the
next decade living with the consequences of NOT providing Security
advice to newbies?
zillions of web forms for email feedback with header injections
zillions of XSS attacks
We have to be pragmatic about this and inform users what NOT to do of
the most common mistakes, if only to protect ourselves from the
collateral damage of them shooting their foot off
It's our own inboxes and our own bandwidth, and, ultimately, the
quality of the Internet itself at stake.
If we can document for beginners the most common security mistakes,
and have that documentation "in their face" when they first encounter
the "answer" to what they perceive as their "current problem" surely
that's worth a little effort and the blurring of the line drawn at
just providing the function and leaving the responsibility on the user
to be responsible.
I sometimes think PHP is a like a loaded gun in the hands of a child,
it's just too damn easy to use and to get yourself into serious
trouble SO quickly and easily.
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
Good thread. Great points.
I always thought this Sitepoint thread was very helpful:
<http://snipurl.com/qafg>
Cheers,
Micky
--- End Message ---
--- Begin Message ---
Hmmm. Maybe this should be part of a Netiquette document "How to give
good answers" right next to that "How to ask good questions" document
:-^
Yep, and right next to "How to think good", "How to Google", and "How to RTFM"
:-)
tedd
--
--------------------------------------------------------------------------------
http://sperling.com
--- End Message ---
--- Begin Message ---
As usual, Richard shows the quality of his mettle! :-)
I absolutely agree, some ideas:
1. have the mailing list automatically add a single line to the
mailing list sig that promotes security/good-practice and points to phpsec.org?
(I guess only someone like Rasmus could say whether this was even an
acceptable proposition)
2. promote 'hacking ethos' in general - which starts with RTFM but goes
further in that 'newbies' should be encouraged to broaden their understanding
of a problem area beyond 'getting it to work'
3. dish out more praise to those 'newbies' that do go the extra mile to
enrich their own skills beyond what is strictly necessary to get their
job done. encourage research and problem solving.
4. conversely I do believe we can [keep] making it clear that certain
attitudes don't cut it - I'm referring to the 'please do my job for me
crowd' - (in the end you can't save the all ;-) - maybe we can 'nominate'
certain experienced people to reply to messages which are blatantly bad
questions (and/or show blatant signs of not being interested in the 'why's)
encouraging people not to answer until the OP until he/she shows signs
of wanting to expand their own understanding and researching their own
problems. for instance the only reason I hardly ever have reason to
ask a question on the list is because the information/answers I'm looking
for have 99% of the time already been documented in articles/tutorials/etc
on web - (i.e. I'm always saying 'how the **** does that work' and almost
always someone 'out there' has already written something that explains it!
it's a matter of finding it and taking the time to read/re-read)
[quite probably point 4 does not come accross the way I meant - in which
please ignore :-)]
in short I stand by you notion and will try to do my part.
[the kind is dead, long live php]
Richard Lynch wrote:
Hey y'all...
In the spirit of improving the mailing list, I'd like to suggest that
we, as a group, attempt to not provide answers with Bad Practices, or
at least always to point out that the Sample is Bad Practice for
production sites?
For example, an answer to a question about <?php echo $foo?> where it
is clear that register_globals is "off" should either specifically
sanitize the data, or make reference to the need to sanitize the data,
or link to http://phpsec.org or something along those lines.
Otherwise, we merely perpetuate the problems of Bad Code with our
answers to newbies, who then run off and write insecure sites and
cause us more grief down the road.
Hmmm. Maybe this should be part of a Netiquette document "How to give
good answers" right next to that "How to ask good questions" document
:-^
--- End Message ---
--- Begin Message ---
Jay Blanchard wrote:
[snip]
In the spirit of improving the mailing list, I'd like to suggest that
we, as a group, attempt to not provide answers with Bad Practices, or
at least always to point out that the Sample is Bad Practice for
production sites?
For example, an answer to a question about <?php echo $foo?> where it
is clear that register_globals is "off" should either specifically
sanitize the data, or make reference to the need to sanitize the data,
or link to http://phpsec.org or something along those lines.
Otherwise, we merely perpetuate the problems of Bad Code with our
answers to newbies, who then run off and write insecure sites and
cause us more grief down the road.
Hmmm. Maybe this should be part of a Netiquette document "How to give
good answers" right next to that "How to ask good questions" document
:-^
[/snip]
I vote for that. I need to find that doc...curt z had it on a site
here is the link for the improved newbie doc -
http://zirzow.dyndns.org/php-general/NEWBIE
--
life is a game... so have fun.
--- End Message ---
--- Begin Message ---
Richard Lynch wrote:
Hey y'all...
In the spirit of improving the mailing list, I'd like to suggest that
we, as a group, attempt to not provide answers with Bad Practices, or
at least always to point out that the Sample is Bad Practice for
production sites?
For example, an answer to a question about <?php echo $foo?> where it
is clear that register_globals is "off" should either specifically
sanitize the data, or make reference to the need to sanitize the data,
or link to http://phpsec.org or something along those lines.
Otherwise, we merely perpetuate the problems of Bad Code with our
answers to newbies, who then run off and write insecure sites and
cause us more grief down the road.
Hmmm. Maybe this should be part of a Netiquette document "How to give
good answers" right next to that "How to ask good questions" document
:-^
Might I make a suggestion for an addition to the newbie email - in the
"where to find more information" section - add a link either to the
manual security section or phpsec.org
--
life is a game... so have fun.
--- End Message ---
--- Begin Message ---
for ($i = 1; $i <= 20; $i++){
if (isset($_POST[$i])){
//insert blah blah blah
}
}
Also, I don't think '1' is valid NAME for HTML specification.
You could use:
NAME="menu[1]"
Then in PHP:
$menu = $_POST['menu'];
for ($i = 1; $i <= 20; $i++){
if (isset($menu[$i])){
}
}
And, of course, you need to scrub your data.
http://phpsec.org
On Wed, May 10, 2006 3:49 am, Chris Grigor wrote:
> morning all,
>
> Is there an easier way of doing the following??
>
> form1 submitting to form1.php
> <input type="checkbox" name="1">
> <input type="checkbox" name="2">
> <input type="submit>
>
> form1.php
>
> <?php
>
> $link = mysql_connect('host', 'user', 'pass') or die ("Connection
> failed:" . mysql_error());
>
> mysql_select_db('yourdbname', $link) or die ("selection failed: " .
> mysql_error());
>
> if(isset($_POST[1])) {
> mysql_query("INSERT INTO menu (label) VALUES ('item 1
> selected')");
> }
> else {
> mysql_query("INSERT INTO menu (label) VALUES ('item 1 not
> selected')");
> }
> if(isset($_POST[2])) {
> mysql_query("INSERT INTO menu (label) VALUES ('item 2
> selected')");
> }
> else {
> mysql_query("INSERT INTO menu (label) VALUES ('item 2 not
> selected')");
> }
>
> mysql_close($link);
> ?>
>
> So my question is, if I have a form with 20 + items which can be
> checkboxes, when submitted do I need to go through each one and add it
> to the datasbase or maybe some kind of loop?.
>
> Thank you
>
> Chris
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
There are names for people who use the blob field of a MySQL db to store
images.
Moron, and Idiot are just two examples, but if other circumstances exist,
you can say newbie as well. As a newbie I thought myself that storing images
in a DB would be a nice clean solution. Voices of experience said otherwise.
Over the years as I grew more experienced I began to understand myself, why
putting images into a MySQL Db is a Bad Thing[tm].
Use blobs to store small amounts of transient data. Use the FS to store
something as large and semi-static as images.
Sorry if this seems rough / harsh, but if it causes a person to think twice
before using MySQL as a file storage solution, then it's justified.
There are a few less polite names for people who develop software like this
that I have to maintain later.
Are you going to write queries that involve the data *IN* the file as
part of the search, sort, or filtering?
PHP has the facilities built-in to perform this search/sort/filter - while
their use isn't always the cleanest solution, anything is better than
putting files in a db.
If you can't find the features you require, then feel free to use external
tools - anything to avoid db file storage.
--- End Message ---
--- Begin Message ---
thank you Edward.
Edward Vermillion wrote:
>
> On May 10, 2006, at 10:53 AM, Peter Hoskin wrote:
>
>>
>> GOOGLE DO NOT ARGUE
>
>
> o_O....?
yeah! I did figure it really was about time they changed their
'Do No Evil' slogan given their escapades in china
funnily enough I watched a documentary the other day about the
potential for information/propaganda abuse given the way major
search engines operator and dominate.
'Google: do not argue' is pretty fitting all in all. lol.
>
>>
>> So, if ASCII and Binary are both codesets... which does SQL use to store
>> its data?
>>
>
> ASCII is a codeset, utf* is a codeset.... binary is a, um... , binary
> data.
>
> varchar, etc => ASCII/utf*/whatever => stored as text
> int, etc => integer => stored as integer or long or whatever
> BLOB => Binary Large OBject => stored as binary data
there is a funny little story about where the name BLOB came from:
http://www.cvalde.net/misc/blob_true_history.htm
>
> While you're right that it's better performance and maintenance wise to
> use the filesystem to store binary objects, especially very large ones,
> it's not necessarily 'wrong' to use MySQL.
>
> http://dev.mysql.com/doc/refman/5.1/en/index.html
>
> Ed
>
--- End Message ---
--- Begin Message ---
Jochem Maas wrote:
thank you Edward.
...
there is a funny little story about where the name BLOB came from:
http://www.cvalde.net/misc/blob_true_history.htm
just to note that BLOBs where invented by the guy that designed Interbase
which just happens to be the ancestor of the coolest DBMS you can connect
to php with ;-) namely firebird. of course I'm biased - a friend of mine
wrote the php ibase/fbird extension :-)
--- End Message ---
--- Begin Message ---
Hello, PHP gurus,
I have a command that I want to run using system function. The
command exploits temporary named pipes in the place of temporary files.
my command is
paste <(cut -f1 file1) <(cut -f2 file2) > final_file
It works perfectly well if I just type it in my interactive
shell. But if I do a
<?php
$cmd = " paste <(cut -f1 file1) <(cut -f2 file2) > final_file";
system($cmd);
?>
I got the syntax error msg as
"sh: -c: line 1: syntax error near unexpected token `('". I have tried
to 'escapeshellcmd' the command and run it in system, then I got
paste: invalid option -- f
Try `paste --help' for more information.
Also tried exec. I really want to take advantage of the
temporary named pipes so I don't have to worry about the temporary files
generated. I've been googling around without much help. Could anyone
plz give me some hint? Thanks a lot
ginger
--- End Message ---
--- Begin Message ---
On Wednesday 10 May 2006 4:02 pm, Ginger Cheng wrote:
> Hello, PHP gurus,
> I have a command that I want to run using system function. The
> command exploits temporary named pipes in the place of temporary files.
>
> my command is
>
> paste <(cut -f1 file1) <(cut -f2 file2) > final_file
>
> It works perfectly well if I just type it in my interactive
> shell. But if I do a
>
> <?php
> $cmd = " paste <(cut -f1 file1) <(cut -f2 file2) > final_file";
> system($cmd);
> ?>
>
> I got the syntax error msg as
> "sh: -c: line 1: syntax error near unexpected token `('". I have tried
> to 'escapeshellcmd' the command and run it in system, then I got
>
> paste: invalid option -- f
> Try `paste --help' for more information.
>
> Also tried exec. I really want to take advantage of the
> temporary named pipes so I don't have to worry about the temporary files
> generated. I've been googling around without much help. Could anyone
> plz give me some hint? Thanks a lot
> ginger
Think you might want the shell_exec() command instead.
http://us2.php.net/manual/en/function.shell-exec.php
HTH
--
Joe Henry
www.celebrityaccess.com
[EMAIL PROTECTED]
--- End Message ---
--- Begin Message ---
Ginger Cheng wrote:
Hello, PHP gurus,
I have a command that I want to run using system function. The
command exploits temporary named pipes in the place of temporary files.
my command is
paste <(cut -f1 file1) <(cut -f2 file2) > final_file
It works perfectly well if I just type it in my interactive
shell. But if I do a
<?php $cmd = " paste <(cut -f1 file1) <(cut -f2 file2) >
final_file";
system($cmd);
?>
I got the syntax error msg as
"sh: -c: line 1: syntax error near unexpected token `('". I have tried
I notice that the 'sh' shell is being used according to your error output,
I'm guessing that maybe your interactive shell is running something like 'bash'
and that this discrepency might the root cause of the problem. just a guess -
I don't know how you would define another shell for php to use either :-/.
another thing to try is the backticks operator, as described on the following
page:
http://php.net/manual/en/language.operators.execution.php
to 'escapeshellcmd' the command and run it in system, then I got
paste: invalid option -- f
Try `paste --help' for more information.
Also tried exec. I really want to take advantage of the
temporary named pipes so I don't have to worry about the temporary files
generated. I've been googling around without much help. Could anyone
plz give me some hint? Thanks a lot
ginger
--- End Message ---
--- Begin Message ---
IraqiGeek wrote:
Hi all,
...
two things which have nothing to do with your original question
(that seems to have been covered rather well)
Regards,
IraqiGeek
www.iraqigeek.com
try viewing your site in firefox - notice all those question marks
in the content? might be interesting to find out why that is. :-)
Boat: A hole in the water surrounded by wood into which one pours money.
that really made me laugh :-)
--- End Message ---
--- Begin Message ---
In your form uploading script:
# individual file size limit - in bytes (102400 bytes = 100KB)
$file_size_ind = "838860800"; // 819.2 MB
$weight=$_FILES[fileupload][size];
if ($weight>$file_size_ind)
{
echo"<br><img src=\"$dir_img/error.gif\" width=\"15\"
height=\"15\"> <b><font size=\"2\">ERROR: please get the file size
less than ".$file_size_ind." BYTES (".round(($file_size_ind/1024),2)."
KB)</font></b><br>»<a href=\"$_SERVER[PHP_SELF]\">back</a>";
}
James Nunnerley wrote:
> Is there anyway to check the size of a file before it starts uploading it?
> For instance, if the file is huge, and takes ages to upload, and is then
> rejected by the server, the user will be somewhat annoyed!
>
>
>
> I'm not even sure this is a php question!
>
>
>
> Cheers
>
> Nunners
>
>
--- End Message ---
--- Begin Message ---
Wolf wrote:
In your form uploading script:
# individual file size limit - in bytes (102400 bytes = 100KB)
$file_size_ind = "838860800"; // 819.2 MB
$weight=$_FILES[fileupload][size];
if ($weight>$file_size_ind)
{
echo"<br><img src=\"$dir_img/error.gif\" width=\"15\"
height=\"15\"> <b><font size=\"2\">ERROR: please get the file size
less than ".$file_size_ind." BYTES (".round(($file_size_ind/1024),2)."
KB)</font></b><br>»<a href=\"$_SERVER[PHP_SELF]\">back</a>";
}
That has already attempted to upload the file to the server.. which is
what the OP didn't want.
Would be handy to be able to do this but *shrug*..
--
Postgresql & php tutorials
http://www.designmagick.com/
--- End Message ---
--- Begin Message ---
True, but it checks it at the first attempt to upload, not when the file
is done or partially uploaded. Granted, not what the OP asked for
exactly, but better then what he has now and better then spending more
time looking...
Wolf
Chris wrote:
> Wolf wrote:
>> In your form uploading script:
>> # individual file size limit - in bytes (102400 bytes = 100KB)
>> $file_size_ind = "838860800"; // 819.2 MB
>>
>>
>> $weight=$_FILES[fileupload][size];
>>
>> if ($weight>$file_size_ind)
>> {
>> echo"<br><img src=\"$dir_img/error.gif\" width=\"15\"
>> height=\"15\"> <b><font size=\"2\">ERROR: please get the file size
>> less than ".$file_size_ind." BYTES (".round(($file_size_ind/1024),2)."
>> KB)</font></b><br>»<a href=\"$_SERVER[PHP_SELF]\">back</a>";
>> }
>
> That has already attempted to upload the file to the server.. which is
> what the OP didn't want.
>
> Would be handy to be able to do this but *shrug*..
>
--- End Message ---
--- Begin Message ---
Just in case you ever need to check the configure line again in the
future, you can get at it (even if you've built through the FreeBSD
ports) through a phpinfo page. The third section on that page is
labeled "Configure Command" and lists all the options used during the
build.
Matt
On 5/10/06, Paul Waring <[EMAIL PROTECTED]> wrote:
On 10/05/06, Richard Collyer <[EMAIL PROTECTED]> wrote:
> Does this do the same with PHP5? Remember mod_php5 has gone from ports
> so lang/php5 then make config and select build apache option.
I've no idea whether it does that with PHP5, but I'm not ready to
upgrade to that version yet (perhaps over the summer when I have a bit
more spare time I'll attempt it).
Paul
--
Data Circle
http://datacircle.org
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
--- End Message ---
--- Begin Message ---
Greetings All,
I have the following problem. I load certain links and breadcrumbs from
the database into a external .php file which I include on various pages
within the site. Due to this I have defined a constant '_root' and
precede all links with this to ensure that the links will work no matter
from where inside the site structure they are called.
My problem is this, when I load these links from the database into the
external .php file and the load the page that includes this, the line
<?php echo _root ?> is not parsed and shows up in the links, for example:
/our_work/<?php echo _root ?>/our_work/index.php when it should be
/site_root/our_work/index.php
How can I ensure that these calls to <?php echo _root ?> are parsed
before sent to the browser?
Thanks!
--
Kind Regards
Schalk Neethling
Web Developer.Designer.Programmer.President
Volume4.Business.Solution.Developers
--- End Message ---
--- Begin Message ---
Schalk wrote:
Greetings All,
I have the following problem. I load certain links and breadcrumbs from
the database into a external .php file which I include on various pages
within the site. Due to this I have defined a constant '_root' and
precede all links with this to ensure that the links will work no matter
from where inside the site structure they are called.
My problem is this, when I load these links from the database into the
external .php file and the load the page that includes this, the line
<?php echo _root ?> is not parsed and shows up in the links, for example:
/our_work/<?php echo _root ?>/our_work/index.php when it should be
/site_root/our_work/index.php
How can I ensure that these calls to <?php echo _root ?> are parsed
before sent to the browser?
Why do you need to store _root in the data? Wouldn't it be better to
take it out and then prefix it before displaying? No complications then.
You're attempting to convert text into php code - make sure you sanitize
*all* of your data extremely carefully.
In theory I could have <?php mail('[EMAIL PROTECTED]', 'blah', `cat
/etc/passwd`); ?> type code in there and it would execute it.
eval should do it but you have been warned (see many threads in the past
about why eval is bad).
--
Postgresql & php tutorials
http://www.designmagick.com/
--- End Message ---
--- Begin Message ---
Chris wrote:
Schalk wrote:
Greetings All,
I have the following problem. I load certain links and breadcrumbs
from the database into a external .php file which I include on various
pages within the site. Due to this I have defined a constant '_root'
and precede all links with this to ensure that the links will work no
matter from where inside the site structure they are called.
My problem is this, when I load these links from the database into the
external .php file and the load the page that includes this, the line
<?php echo _root ?> is not parsed and shows up in the links, for example:
/our_work/<?php echo _root ?>/our_work/index.php when it should be
/site_root/our_work/index.php
How can I ensure that these calls to <?php echo _root ?> are parsed
before sent to the browser?
Why do you need to store _root in the data? Wouldn't it be better to
take it out and then prefix it before displaying? No complications then.
....
actually if it's only one variable, this might do it for you:
$content = str_replace('<?php echo _root ?>', _root, $content);
but that's still a bad way to do this.
--
Postgresql & php tutorials
http://www.designmagick.com/
--- End Message ---
--- Begin Message ---
Chris wrote:
Chris wrote:
Schalk wrote:
Greetings All,
I have the following problem. I load certain links and breadcrumbs
from the database into a external .php file which I include on
various pages within the site. Due to this I have defined a constant
'_root' and precede all links with this to ensure that the links
will work no matter from where inside the site structure they are
called.
My problem is this, when I load these links from the database into
the external .php file and the load the page that includes this, the
line <?php echo _root ?> is not parsed and shows up in the links,
for example:
/our_work/<?php echo _root ?>/our_work/index.php when it should be
/site_root/our_work/index.php
How can I ensure that these calls to <?php echo _root ?> are parsed
before sent to the browser?
Why do you need to store _root in the data? Wouldn't it be better to
take it out and then prefix it before displaying? No complications then.
....
actually if it's only one variable, this might do it for you:
$content = str_replace('<?php echo _root ?>', _root, $content);
but that's still a bad way to do this.
Chris,
The reason I need root in there is because sometimes it would be
something like text > link > link, so in these cases I cannot merely
prefix _root.
--
Kind Regards
Schalk Neethling
Web Developer.Designer.Programmer.President
Volume4.Business.Solution.Developers
--- End Message ---
--- Begin Message ---
Chris wrote:
Chris wrote:
....
actually if it's only one variable, this might do it for you:
$content = str_replace('<?php echo _root ?>', _root, $content);
but that's still a bad way to do this.
Chris,
This works:
$breadcrumb = $row_pathway['pathway'];
$breadcrumb = str_replace('<?php echo _root ?>', _root, $breadcrumb);
echo $breadcrumb;
However, I would still like to know why this is a bad way to do this and
hopefully find a better way. Still learning all the aspects of PHP so
any input is appreciated.
--
Kind Regards
Schalk Neethling
Web Developer.Designer.Programmer.President
Volume4.Business.Solution.Developers
--- End Message ---
--- Begin Message ---
Schalk wrote:
Chris wrote:
Chris wrote:
....
actually if it's only one variable, this might do it for you:
$content = str_replace('<?php echo _root ?>', _root, $content);
but that's still a bad way to do this.
Chris,
This works:
$breadcrumb = $row_pathway['pathway'];
$breadcrumb = str_replace('<?php echo _root ?>', _root, $breadcrumb);
echo $breadcrumb;
However, I would still like to know why this is a bad way to do this and
hopefully find a better way. Still learning all the aspects of PHP so
any input is appreciated.
Because you're including your config details in your data (I don't think
you should do this, but others may disagree).
The str_replace method should be pretty fast and won't introduce any
security issues like the 'eval' method I originally mentioned would.
--
Postgresql & php tutorials
http://www.designmagick.com/
--- End Message ---
--- Begin Message ---
Hello all,
I have a small site which provides search functionalities. My search sites
are framed in my clients sites via iframe. I have a client who would like
to put the search form somewhere else on their site (it is currenly all on
my page within the iframe) and then call their search page to do the search,
so in essence I need a way to grab the $_REQUEST params from the calling
site if they exist...is this possible?
<main site url="mainsite.com?param1=hello¶m2=there">
**How do I see these params from within the iFrame?
<iFrame mysite url="mysite.com?param2=good¶m3=bye">
I, of course, can see these params fine as this is my site
</main>
Thanks!
--- End Message ---
--- Begin Message ---
Hey all, it is possible to parse capcha's in php? I'm not asking how
to do it, nor have I any need, it's just something that I was
discussing with a friend. My stand was that ImageMagik could crack
them. She says no way. What are your opinions?
Thanks.
Dotan Cohen
http://what-is-what.com
--- End Message ---
--- Begin Message ---
Using ImageMagick, ray tracing algorithms, an OCR library, and fourier
transforms, I bet that you could parse Capchas.
Dan
-----Original Message-----
From: Dotan Cohen [mailto:[EMAIL PROTECTED]
Sent: Thursday, May 11, 2006 12:29 AM
To: PHP General (E-mail)
Subject: [PHP] Parsing images
Hey all, it is possible to parse capcha's in php? I'm not asking how to do
it, nor have I any need, it's just something that I was discussing with a
friend. My stand was that ImageMagik could crack them. She says no way. What
are your opinions?
Thanks.
Dotan Cohen
http://what-is-what.com
--- End Message ---
--- Begin Message ---
There are often easier solutions due to poor design.
Seen many sites setting the value in cookies, or hidden form elements, etc.
Sites made by people who can't do their jobs in other words :)
Regards,
Peter Hoskin
Dan Harrington wrote:
> Using ImageMagick, ray tracing algorithms, an OCR library, and fourier
> transforms, I bet that you could parse Capchas.
>
> Dan
>
> -----Original Message-----
> From: Dotan Cohen [mailto:[EMAIL PROTECTED]
> Sent: Thursday, May 11, 2006 12:29 AM
> To: PHP General (E-mail)
> Subject: [PHP] Parsing images
>
> Hey all, it is possible to parse capcha's in php? I'm not asking how to do
> it, nor have I any need, it's just something that I was discussing with a
> friend. My stand was that ImageMagik could crack them. She says no way. What
> are your opinions?
>
> Thanks.
>
> Dotan Cohen
> http://what-is-what.com
>
>
--- End Message ---
