[PHP-DB] $_SESSION issues - possible security hole?

2008-08-10 Thread Darron Butler
I have built an application where users have to log in (the user data is stored in MySQL). I have 3 levels of rights for users; 1-normal rights, 2-admin rights, and 3-super user rights. When a user logs in, I set the $_SESSION['rights'] variable accordingly so I can reference it thru out the site.

Re: [PHP-DB] $_SESSION issues - possible security hole?

2008-08-10 Thread Evert Lammerts
If it changes the value of $_SESSION['rights'], then how come if ($_SESSION['rights'] != super) on line 14 doesn't exit()? Or does that happen when you hit refresh the second time? Or does the user it changes to also have 'super' rights? Why use extract()? Try commenting it out... apart from it

Re: [PHP-DB] $_SESSION issues - possible security hole?

2008-08-10 Thread Evert Lammerts
Why use extract()? Try commenting it out... apart from it being If you use 'register globals' there's a good chance that a variable $rights exists because it's a key in your $_SESSION array (don't shoot me if I'm wrong, I've never worked with 'register globals'). By using extract() without the

Re: [PHP-DB] $_SESSION issues - possible security hole?

2008-08-10 Thread Darron Butler
Thanks for your thoughts. To answer your first question, I'm using extract() because this is a page where admins and super users can edit the permissions of others for the site. Therefore, I have to query the database to create a listing of all users, and then have the admin/super user select one

Re: [PHP-DB] $_SESSION issues - possible security hole?

2008-08-10 Thread Bastien Koert
On Sun, Aug 10, 2008 at 4:23 PM, Darron Butler [EMAIL PROTECTED] wrote: Thanks for your thoughts. To answer your first question, I'm using extract() because this is a page where admins and super users can edit the permissions of others for the site. Therefore, I have to query the database to

Re: [PHP-DB] $_SESSION issues - possible security hole?

2008-08-10 Thread Micah Gersten
There's your answer. With register_globals on $_SESSION['rights'] becomes $rights and when you do extract($row) you are overwritting the $_SESSION variable. A safer way of using your code would be: while ($row = mysql_fetch_array($result1, MYSQL_ASSOC)) { ? option

Re: [PHP-DB] $_SESSION issues - possible security hole?

2008-08-10 Thread Darron Butler
Thanks! In fact I just updated my code to your exact example below and it works! Its a good thing you all fixed this for me...I have very few hairs left! Thanks again everyone...drb On Sun, Aug 10, 2008 at 4:53 PM, Micah Gersten [EMAIL PROTECTED] wrote: There's your answer. With

[PHP-DB] is this possible in one query?

2006-01-14 Thread Sjef Janssen
Hi there, I have a table that keeps names for different language codes. In a short example: nameId name languageCode 31 House EN 31 Wohnung DE 32 Piece En 32 Stuck De 33 Car EN 33 PKW DE What I would like is to have a query that returns for example: nameId = 31 Names = House - Wohnung Maybe I

Re: [PHP-DB] is this possible in one query?

2006-01-14 Thread RaJeSh VeNkAtA
u can have the query as $query = select * from $table where nameId = 31 ; $result = mysql_query ( $query ) ; $i = 0 ; while ( $row = mysql_fetch_array( $result , MYSQL_NUM ) ) { $array[$i][0] = $row[0] ; $array[$i][1] = $row[1] ; $array[$i][2] = $row[2] ;

[PHP-DB] Is this possible?

2005-01-22 Thread JeRRy
Hi, Is it security safe and possible to use my server to query another server, outside the local zone, and make updates to another server using a PHP page from my server? I'm just wondering. So in other words I'd have a DB setup to hold users domains, db names, db usernames, db passwords etc on

[PHP-DB] Is this possible?

2005-01-22 Thread JeRRy
Hi, Is it security safe and possible to use my server to query another server, outside the local zone, and make updates to another server using a PHP page from my server? I'm just wondering. So in other words I'd have a DB setup to hold users domains, db names, db usernames, db passwords etc on

Re: [PHP-DB] Is it possible to access MySQL table on server A from server B?

2003-10-08 Thread ramki
a mysql_dump (backup). You can write a ftp code in php. get all the source code in the old server and write it in the new server. -ramki - Original Message - From: Trisha [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 08, 2003 12:23 PM Subject: [PHP-DB] Is it possible

[PHP-DB] Is it possible to open a .txt file into a recordset for validation?

2003-09-08 Thread karen97214
Want to allow users to upload .txt file and then loop through it's contents to validate and reject/accept based on results. Is this possible? Got any links, code, etc? Thanks __ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software

Re: [PHP-DB] Is it possible to open a .txt file into a recordset for validation?

2003-09-08 Thread John W. Holmes
[EMAIL PROTECTED] wrote: Want to allow users to upload .txt file and then loop through it's contents to validate and reject/accept based on results. Is this possible? Got any links, code, etc? Yes. http://us2.php.net/manual/en/features.file-upload.php and then

[PHP-DB] is this possible?

2003-01-19 Thread Addison Ellis
hello, i have a page where the user selects a category. they are directed to a page that takes them to subactegory and displays the subcategory according to category id. my question is can i from there direct them to a particular page from a list of a number of different pages according to

Re: [PHP-DB] ODBTP, a possible solution for MS-SQL and other databases

2002-11-02 Thread Rasmus Lerdorf
Sounds interesting. Perhaps toss it into PEAR/PECL and see if anybody is interested in pitching in with maintenance. You never know, someone might pop up and add a bunch of improvements that will benefit you directly. -Rasmus On Sat, 2 Nov 2002, Robert Twitty wrote: Hello I have been using

[PHP-DB] ODBTP, a possible solution for MS-SQL and other databases

2002-11-01 Thread Robert Twitty
Hello I have been using PHP for about 9 months, and have chosen it as my primary scripting language for web applications. I have and still use ASP and JSP. IMHO, PHP is superior and easier to use than those languages except in one area that is important to me, which is the ability to access MS

[PHP-DB] is it possible to upload (binary) files to a mysql database?

2002-06-18 Thread Sander Peters
Hello, Is it possible to upload binary files to a mysql database? I can't figure it out. This is what I did: I made a form like this: FORM ENCTYPE=multipart/form-data ACTION=upload.php METHOD=POST INPUT TYPE=hidden name=MAX_FILE_SIZE value=20 Send this file: INPUT NAME=attachment TYPE=file

Re: [PHP-DB] Is this possible in mysql?

2002-03-08 Thread Andrey Hristov
list($sum)=mysql_fetch_assoc(mysql_query('SELECT SUM(salary') FROM employes;')); Best regards, Andrey Hristov On Friday 08 March 2002 09:17 pm, you wrote: I need to add up the (integer) values of columns, and return the added up value as one column to php. Is this possible? Or is there

[PHP-DB] Is it possible ?

2002-02-16 Thread CK Raju
Is it possible to get the AUTO-INCREMENTed ID's value while doing an INSERT and have the value INSERTed to another table in the same FORM ? Raju ** Message from InterScan E-Mail VirusWall NT ** ** No virus found in attached file noname.htm This is a virus free message scanned by

Re: [PHP-DB] Is it possible ?

2002-02-16 Thread Kodrik
On Saturday 16 February 2002 07:35 pm, you wrote: Is it possible to get the AUTO-INCREMENTed ID's value while doing an INSERT and have the value INSERTed to another table in the same FORM ? Raju mysql_query(insert whatever); $insertid=mysql_last_insert(); Then you use this value for your

[PHP-DB] Is this possible?

2002-02-06 Thread Raymond Lilleodegard
Hi! I have this tricky case, at lest for me : ) I'm trying to get some data out of two tables and listing the data in a product/price site. But. : I have one table with productinfo and one with prices. And it is several columns with the same id in the pricetable, because every product have

RE: [PHP-DB] Is this possible?

2002-02-06 Thread Rick Emery
Yes, you can do that easily. It is easier to answer your question if you show us your table structure. -Original Message- From: Raymond Lilleodegard [mailto:[EMAIL PROTECTED]] Sent: Wednesday, February 06, 2002 11:16 AM To: [EMAIL PROTECTED] Subject: [PHP-DB] Is this possible? Hi! I

Re: [PHP-DB] Is this possible?

2002-02-06 Thread Raymond Lilleødegård
- From: Rick Emery [EMAIL PROTECTED] To: 'Raymond Lilleodegard' [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, February 06, 2002 6:23 PM Subject: RE: [PHP-DB] Is this possible? Yes, you can do that easily. It is easier to answer your question if you show us your table structure

Re: [PHP-DB] Is this possible?

2002-02-06 Thread DL Neil
Hi Raymond, I have this tricky case, at lest for me : ) I'm trying to get some data out of two tables and listing the data in a product/price site. But. : I have one table with productinfo and one with prices. And it is several columns with the same id in the pricetable, because every

Re: [PHP-DB] Is this possible?

2002-02-06 Thread Hugh Bothwell
It looks to me like you should be dividing the data differently; something like (quantity, item, option, price) VALUES (1, '6inch', '', '29), (1, '6inch', 'meny', 51), (1, 'footlong', '', 45), (1, 'footlong', 'meny', 66), and so forth... Raymond lilleødegård [EMAIL PROTECTED] wrote in message

Re: [PHP-DB] Is this possible?

2002-02-06 Thread DL Neil
AND pristabell.type='6inch' AND pristabell.type='footlong' - Original Message - From: Rick Emery [EMAIL PROTECTED] To: 'Raymond Lilleodegard' [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, February 06, 2002 6:23 PM Subject: RE: [PHP-DB] Is this possible? Yes, you can do

RE: [PHP-DB] Is this possible?

2002-02-06 Thread Rick Emery
Lilleødegård [mailto:[EMAIL PROTECTED]] Sent: Wednesday, February 06, 2002 11:33 AM To: Rick Emery; [EMAIL PROTECTED] Subject: Re: [PHP-DB] Is this possible? My table look like this: Pricetable: (varetabell) (varenr, type, pris) VALUES (1, '6inch', 29), (1, '6inch meny', 51

Re: [PHP-DB] Is this possible?

2002-02-06 Thread William Fong
: Wednesday, February 06, 2002 10:00 AM Subject: Re: [PHP-DB] Is this possible? It looks to me like you should be dividing the data differently; something like (quantity, item, option, price) VALUES (1, '6inch', '', '29), (1, '6inch', 'meny', 51), (1, 'footlong', '', 45), (1, 'footlong