PHP - My Php Assesment - Need Experienced Advice/critique

Hi, I hope this is still a relevant topic here. I don't have a lot of coding experience and haven't studied it a college -- I'm just self taught hobbyist. I was wondering what your opinion is of the way I have structured my code and solved what I needed to do.

Any tips or feedback is greatly appreciated. Thanks.

Code: [Select]
<?php
$form_submission=$_POST["query"];
$lines = file('eo_dic.txt', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES); 
preg_match_all('/[\w\'\&#349;\&#265;\&#309;\&#365;\&#293;\&#348;\&#264;\&#308;\&#364;\&#292;]+|[,.;!"?-\s\\(\\)]/', $form_submission, $matches);

foreach ($matches[0] as $value){ 
  // Check if $value is a word or something else.
  if ($value == " " || $value == "," || $value == "." || $value == "(" || $value ==  ")" || $value == "!" || $value == "?" || $value == "-" || $value == ";" || $value == '"'){
    echo $value;
  }
  else { // $value is a word.
    $titleText = array(); // store results in array.
    foreach ($lines as $line){
      list($field1, $field2) = explode('=', $line);
      if (strcasecmp($field1, $value) == 0 || strcasecmp($field2, $value) == 0){ // Found string in DB.
        array_push($titleText, "$field1 = $field2"); // Store all finds in array before outputting.
      }
    }
    if (empty($titleText)) { // $value was not found -- array is empty.
      echo '<a name="translated" class="translated" title="Not found.">' . $value . '</a>';
    }
    else {
      $arrayOut = implode(" / ", $titleText); // output the results found in the search.
      echo '<a name="translated" class="translated" title="' . $arrayOut . '">' . $value . '</a>';
    }
  }
}
unset($value);
?>

I am in the process of building my own MVC framework (just to learn the concepts) and I decided to throw some libraries and helpers in the mix to make things more convenient. Below is my email helper in which I want to be able to use an array as the "to" part of the mail() function. I was wondering what everyone thought of my class and if I can improve upon it. Thanks!

Code: [Select]
<?php 
/**
 * To use this email class in it's most basic form:
 * 
 *  $to must be an array even if you are sending to only one recipient.
 *  You declare it like so:
 *  $to = array('recipient');
 *  or
 *  $to = array('one', 'two', 'three');
 * $sendMail = new Email($to, 'subject', 'message');
 *  if ($sendMail->send()) {
 *  // success
 *  } else {
 *  // failure
 *  }
 * 
 * To add various features (declare these before using $sendMail-send()):
 *  To add a CC address:
 *  $sendMail->setCC('email address');
 *  To add a BCC address:
 *  $sendMail->setBCC('email address');
 *  To set the from name:
 *  $sendMail->setFromName('name of sender');
 *  To set the from email:
 *  $sendMail->setFromEmail('email of sender');
 *  To set a content type (default is text/html):
 *  $sendMail->setContentType('content type');
 *  To set a charset (default is iso-8859-1):
 *  $sendMail->setCharset('charset');
 */

class Email
{

public $to = array();
public $subject;
public $message;
public $fromName;
public $fromEmail;
public $cc;
public $bcc;
public $contentType;
public $charset;
private $_headers;

public function __construct($to, $subject, $message) {
if (!is_null($to) && !is_array($to)) {
throw new Exception('The recipient names must be an array, even if there is only one recipient.');
}
if (is_null($to) || is_null($subject) || is_null($message)) {
throw new Exception('There must be at least one recipient, a subject, and a message.');
}
$this->to = $to;
$this->subject = $subject;
$this->message = $message;
}

public function setCC($cc = NULL) {
$this->cc = $cc;
}

public function setBCC($bcc = NULL) {
$this->bcc = $bcc;
}

public function setFromName($fromName = 'Website Name') {
$this->fromName = $fromName;
}

public function setFromEmail($fromEmail = 'admin@website.com') {
$this->fromEmail = $fromEmail;
}

public function setContentType($contentType = 'text/html') {
$this->contentType = $contentType;
}

public function setCharset($charset = 'iso-8859-1') {
$this->charset = $charset;
}

private function _setHeaders() {
$this->_headers = "Content-type: " . $this->contentType . "charset=" . $this->charset . "\r\n";
$this->_headers .= "From: " . $this->fromName . "<" . $this->fromEmail . "> \r\n";
if ($this->cc != NULL) {
$this->_headers .= "CC: " . $this->cc . "\r\n";
}
if ($this->bcc != NULL) {
$this->_headers .= "BCC: " . $this->bcc . "\r\n";
}
}

public function send() {
$this->_setHeaders();
$this->setFromName();
$this->setFromName();
$sent = FALSE;
foreach ($this->to as $recipient) {
if (mail($recipient, $this->subject, $this->message, $this->_headers)) {
$sent = TRUE;
continue;
}
}
if ($sent = TRUE) {
return TRUE;
} else {
return FALSE;
}
}

}

I am fairly comfortable with procedural PHP but when it comes to classes and OO I am learning.

I have written a small class to get all of the information from the URL. I am sure I have added my own style and broken about a million rules. I have already found places to improve this but I thought I would bounce it off everyone here before I started to make changes and started expanding it. I am also aware that there are classes that I can download that do this much better but I am trying to better understand how they work so I think this is a good start.

Can you just look it over and point out things that I have done wrong and give me some general pointers on how to improve it.
class uri extends mainframe{

private $path = null;

private $pathParse = array();

private $component = null;

private $view = null;

private $host = null;

private $dirDepth = null;

public  $queryString = array();

function __construct() {

$this->getHost();

$this->getPath();

$this->getView();

$this->getQueryString();
       

}

/*

 * Check to see if we are in the base folder

 */

function dirDepth($base) {

$this->dirDepth = config::DDEPTH + $base;

return $this->dirDepth;

}

/*

 * return the host address

 */

function getHost() {

$this->host = $_SERVER['HTTP_HOST'];

return $this->host;

}

/*

 * return the path information

 */

function getPath() {

$this->path = $_SERVER['REQUEST_URI'];

return $this->path;

}

/*

 * returns the query string in an array

 * 

 * I am sure this isn't the right way to do this

 * but it is working.

 */

function getQueryString() {

$this->getPath();

preg_match('/\?(.*)/', $this->path, $queryString);

if ($queryString == true) {

$queryPairs = array();

$queryString = (isset($queryString['1']) ? $queryString['1'] : null);

$queryPairs = explode('&', $queryString);

$queryStrings = array();

$pairs = array();

foreach ($queryPairs as $queryPairs) {

preg_match('/(.*)=(.*)/', $queryPairs, $pairs);

array_push($queryStrings, $pairs);

}

$key = array();

$value = array();

foreach ($queryStrings as $queryStrings) {

array_push($value, (isset($queryStrings['2']) ? $queryStrings['2'] : null));

array_push($key, (isset($queryStrings['1']) ? $queryStrings['1'] : null));

}

$this->queryString = array_combine($key, $value);

return $this->queryString;

}else{

unset($this->queryString);

}

}

/*

 * returns the path in an array and removes the query string

 */

function pathParse() {

self::getPath();

$this->pathParse = explode('/', $this->path);

$endCheck = preg_replace('/\?(.*)/','', array_pop($this->pathParse));

array_push($this->pathParse, $endCheck);

$this->pathParse = array_filter($this->pathParse);

if(!empty($this->pathParse)) {

return $this->pathParse;

}else{

unset($this->pathParse);

}

}

/*

 * returns the first part of the path

 */

function getComponent() {

self::pathParse();

self::dirDepth('1');

if(!empty($this->pathParse[$this->dirDepth])) {

$this->component = $this->pathParse[$this->dirDepth];

return $this->component;

}else{

unset($this->component);

}

}

/*

 * returns the second part of the path

 */

function getView() {

self::pathParse();

self::dirDepth('2');

if(!empty($this->pathParse[$this->dirDepth])) {

$this->view = $this->pathParse[$this->dirDepth];

return $this->view;

}else{

unset($this->view);

}

}

/*

 * Ummmmm need some help here for sure.

 */

function __destruct() {

}
}

$uri = new uri();

Thank you in advance for your help!

I'm developing my own CMS with a few functions and wanted to know how things are looking right now because I can't find a board for strickly CODING CRITIQUE so I put it in this board. There isn't a whole lot to go through. I know there is something wrong with my issets line but other than that just a general critique of how its shaping up?

manager.php

<?php
        session_start();

        require "dbconfig.php";
        require "functions.php";

        if ((isset($_POST['username'])) && (isset($_POST['password'])))
        {
                $username = $_POST{'username'};
                $password = SHA1($_POST{'password'});
                validate($username, $password);
        }
        elseif ((!(isset('username'))) && (!(isset('password'))))
        {
                require_once "login.php";
        }
        
        $username = stripslashes($username);
        $password = stripslashes($password);
        $username = mysql_real_escape_string($username);
        $password = mysql_real_escape_string($password);
        
        $sql="SELECT * FROM dbusers WHERE username='$username' and password='$password'";
        $result = mysql_query($sql);
?>




functions.php

<?php

// This page defines functions used by the login/logout process

function validate($username, $password)
{
    
}

?>


login.php

<?php
include_once ("globals.php");
?>

<html>
<head>
<title><?php echo $shortsitename; ?> EW Manager</title>
<link rel="stylesheet" type="text/css" href="<?php echo "$stylesheet"; ?>" />
</head>
<body>

<p id="backtosite"><a href="#" title="Are you lost?">&larr;&nbsp;Back to <?php echo $fedname ?></a></p>

<div id="login">
    <h1><?php echo $shortsitename; ?> Manager</h1>
    <form id="loginform" action="" method="POST">
        <p><label>Username<br /><input type="text" name="username" id="user_login" class="input" size="15"  /></label></p>
        <p><label>Password<br /><input type="password" name="password" id="user_pass" class="input" size="15" /></label></p>
        <p class="forgetmenot"><label><input name="rememberme" type="checkbox" id="rememberme" />&nbsp;Remember Me</label></p>
        <p class="submit">
        <input type="submit" value="Login" class="button-primary" />
        </p>
    </form>
</div>

</body></html>

Hello,
My script below IS finally working, but I was hoping for some aggressive, anal comments for critique.

Keep in mind, I am developing for a php4 platform otherwise I would have used a newer php5 validation function.

<?php
  if (isset($_POST['btnSubmit'])) {
      $first_name = mysql_real_escape_string($_POST['fname']);
      $last_name = mysql_real_escape_string($_POST['lname']);
      $title = mysql_real_escape_string($_POST['title']);
      $company = mysql_real_escape_string($_POST['company']);
      $address1 = mysql_real_escape_string($_POST['address1']);
      $address2 = mysql_real_escape_string($_POST['address2']);
      $city = mysql_real_escape_string($_POST['city']);
      $zip = mysql_real_escape_string($_POST['zip']);
      $phone = mysql_real_escape_string($_POST['phone']);
      $fax = mysql_real_escape_string($_POST['fax']);
      $email = mysql_real_escape_string($_POST['email']);
      
      if (!preg_match("/^[A-Za-z' -]{1,75}$/", $first_name)) {
          $error[] = "Please enter a valid first name.";
      }
      
      if (!preg_match("/^[A-Za-z' -]{1,75}$/", $last_name)) {
          $error[] = "Please enter a valid last name.";
      }
  
  if ($first_name === $last_name && $first_name != "") {
          $error[] = "First Name and Last Name cannot be the same.";
      }
      
      if (!preg_match("/^[A-Za-z' -]{1,150}$/", $company)) {
          $error[] = "Please enter a valid company name.";
      }
      
      if (!preg_match("/^[A-Za-z' -.]{1,150}$/", $title)) {
          $error[] = "Please enter a valid Title.";
      }
      
      if (!preg_match("/^[A-Za-z0-9' - . ]{1,150}$/", $address1)) {
          $error[] = "Please enter a valid mailing address.";
      }
  
  if (!preg_match("/^[A-Za-z0-9' - . ]{1,150}$/", $city)) {
          $error[] = "Please enter a valid city.";
      }
  
  if (!preg_match("/^[0-9' - . ( ) ]{1,150}$/", $phone)) {
          $error[] = "Please enter a valid phone number.";
      }
  
  if (!preg_match("/^[0-9' - . ( ) ]{1,150}$/", $fax)) {
          $error[] = "Please enter a valid fax number.";
      }
      
      if (!preg_match("/([a-z][a-z0-9_.-\/]*@[^\s\"\)\?<>]+\.[a-z]{2,6})/i", $email)) {
          $error[] = "Please enter a valid email address in the format: start@middle.end.";
      }
      
      if (is_array($error)) {
          echo "<div id='errorWrapper'><h2>There are errors in your input. Please correct the following fields:</h2>";
          foreach ($error as $err_message) {
              echo "<span class='errorText'> >> $err_message" . "</span><br />";
          }
          echo "</div>";
          
          include('../includes/attendee_registration_form.php'); // this is the form
          exit();
      }
      
      else {
          include('../includes/attendee_registration_mailer.php'); // this send the email and populates the table
      }
  } else {
      include('../includes/attendee_registration_form.php'); // this is the form
      exit();
  }
?>

All criticism/suggestions/improvements appreciated

Registration.php
Code: [Select]
<?php
$con = mysql_connect("localhost","","") or die(mysql_error());
mysql_select_db('Users');

if(isset($_COOKIE['ID_my_site'])) {
$cookie_username = mysql_real_escape_string(filter_input(INPUT_COOKIE, 'ID_', FILTER_SANITIZE_FULL_SPECIAL_CHARS));
$cookie_password = sha1($_COOKIE['Key_']);
$cookie_check = mysql_query("SELECT * FROM Users WHERE username = '$cookie_username'") or die(mysql_error());
$cookie_results = mysql_fetch_array($cookie_check);

if ($cookie_password == $cookie_results['Password']) {
echo "<div id=\"login_msg\">You are already logged on. Redirecting...</div><br />" && header("location:/index.php");
}
}

if(isset($_POST['submit'])) {
$Username = mysql_real_escape_string(filter_input(INPUT_POST, 'Username', FILTER_SANITIZE_FULL_SPECIAL_CHARS));
$Email = mysql_real_escape_string(filter_input(INPUT_POST, 'Email', FILTER_SANITIZE_FULL_SPECIAL_CHARS));
$Password = sha1($_POST['Password']);
$Password2 = sha1($_POST['Password2']);

if (!$Username | !$Email | !$Password | !$Passord2) {
echo "<div id=\"error_msg\">You did not complete all of the required fields, please try again.</div><br />";
}

if ($Password != $Password2) {
echo "<div id=\"error_msg\">Your passwords do not match, please try again.</div><br />";
}

$check_username = mysql_query("SELECT * FROM Users WHERE (Username = $Username)");
$result_username = mysql_fetch_row($check_username);
$check_email = mysql_query("SELECT * FROM Users WHERE (Email = $Email)");
$result_email = mysql_fetch_row($check_email);

if ($result_username == true) {
echo "<div id=\"error_msg\">The Username: '$Username', already exists. Please enter another username.</div><br />";
}

if ($result_email == true) {
echo "<div id=\"error_msg\">The Email Adress: '$Email', is already in our Database.</div><br />";
}

$sql = "INSERT INTO Users (Id, Username, Email, Password) VALUES ('', '$Username','$Email','$Password')";
$add_member = mysql_query($sql) or die(mysql_error());

if (mysql_query($add_member)) {
$week = time() + 604800; 
setcookie(ID_, $_POST['Username'], $week); 
setcookie(Key_, $_POST['Password'], $week);
echo "<div id=\"login_msg\">Successfully added to our Database.</div><br />"  &&  header ("location:/Login.php"); 
}

else {
echo "<div id=\"error_msg\">Invalid input.</div><br />"; 
}
}
?>

Login.php
Code: [Select]
<?php
include("db.php");

if(isset($_COOKIE['ID_my_site'])) {
$cookie_username = mysql_real_escape_string(filter_input(INPUT_COOKIE, 'ID_', FILTER_SANITIZE_FULL_SPECIAL_CHARS));
$cookie_password = sha1($_COOKIE['Key_']);
$cookie_check = mysql_query("SELECT * FROM Users WHERE username = '$cookie_username'") or die(mysql_error());
$cookie_results = mysql_fetch_array($cookie_check);

if ($cookie_password == $cookie_results['Password']) {
echo "<div id=\"login_msg\">You are already logged on. Redirecting...</div><br />" && header("location:/index.php");
}
}

if(isset($_POST['submit'])) { 
$Username = mysql_real_escape_string(filter_input(INPUT_POST, 'Username', FILTER_SANITIZE_FULL_SPECIAL_CHARS));
$Password = sha1($_POST['Password']);

if (!$Username | !$Password) {
echo "<div id=\"error_msg\">You did not complete all of the required fields, please try again.</div><br />";
}

$sql = "SELECT * FROM Users WHERE (Username, Password) = ('$Username', '$Password')";
$db_check = mysql_num_rows($sql) or die(mysql_error());

if (mysql_query($db_check)) {
$week = time() + 604800; 
setcookie(ID_, $cookie_username, $week); 
setcookie(Key_, $cookie_password, $week);
echo "<div id=\"login_msg\">Successfully Logged In.</div><br />"  &&  header ("location:/index.php");
}

elseif (($Username | $Password) != $db_check) {
echo "<div id=\"error_msg\">Invalid username or password, please try again.</div><br />";
}
}
?>

Logout.php
Code: [Select]
<?php
include("db.php");

if(isset($_COOKIE['ID_my_site'])) {
$cookie_username = mysql_real_escape_string(filter_input(INPUT_COOKIE, 'ID_', FILTER_SANITIZE_FULL_SPECIAL_CHARS));
$cookie_password = sha1($_COOKIE['Key_']);
$cookie_check = mysql_query("SELECT * FROM Users WHERE username = '$cookie_username'") or die(mysql_error());
$cookie_results = mysql_fetch_array($cookie_check);

if ($cookie_password != $cookie_results['Password']) {
header("location:/login.php");
}
else {
$past = time() - 604800; 
setcookie(ID_, gone, $past); 
setcookie(Key_, gone, $past); 
echo "<div id=\"error_msg\">Sucessfully logged out. Good Bye!</div><br />" && header ("location:/login.php");
}
} 

?>

Hi, basically i have data in my database i want to represent as cash, i currently put the dollar sign infront of each echo which is fine, but how would i go about adding , to the php code itself as you cannot do this from the sql database..

Hi all,

I am looking as a pet project to develop a review site, with the info stored in a database by id and the information grabbed bet get id and then displayed on a dynamic page, eg review.php?id=1

My question is this, if i throw keywords into the mix for each review, will search engines cache a review like this? Or would I need static pages for google etc to find the info?

Thanks

In short i want to use the following code below, when someone selects there option and submits it, it would bring up details from the database on this user from the selected table, can you explain what it would be called doing this so i can look it up, Sorry to be a pain, Cheers.

Code: [Select]
<select name="target2" id="target2">

    <option value=""></option>

  <?php

  $sql = "SELECT player_id, friend_id, name, is_active FROM contacts as c JOIN players as p ON c.friend_id = p.id WHERE c.player_id = $playerID AND is_active = 1 ORDER BY name ASC";

  $que = mysql_query($sql) or die(mysql_error());

  while($list = mysql_fetch_array($que)) {

  ?>

  <option value="<?php echo $list['friend_id'] ?>"><?php echo $list['name'] ?></option>

  <?php } ?>

  </select>

for those of you who don't know i am creating a piece of forum software called ASF. Ive done it by myself so far but as it grows i find it harder to write the code and keep organised. my code is a mess and things arent done the way they should be. So if anyone can give me advice or wants to help i could post some of the files for download. Even if you just want to have a look and let me know waht you think.

Thanks
Carl

http://www.thevault.cz.cc

So here's my problem I'm not sure how to approach this:

I have a table with user_items which are stored together separated by commas.
Code: [Select]
13,12,11,9,27,15,16,22,21,23,24,26,29,30,31,32,33
Now, I have a script where the user is in a trade and I want to verify the item they are trying to trade, but is there an alternative other than grabbing all of that users' items and checking that one item with all of the records?

I've tried using
Code: [Select]
SELECT * FROM MYTABLE WHERE user_item_id IN(33)
As an example to see if it will pull the rows with that ID.  It didn't seem to work, am I doing it wrong? if so, forgive me. Any suggestions/help? The main problem is I don't want to have to explode that data and use a foreach to check that one item against all of that users items, as they could have well over 500.

Right now I have a SESSION so when users flip though pages they carry their info with them, what I'm trying to do now is that userhome.php can't be accesses unless the user just was succesful in cracking there system.. game I'm creating for those of you helping and following me while I do this! it's a virutal hacking simulation and where I'm now is that the user's passwordcracker was compared to the target systems 'systemkey' and either granted him access or didn't, if it did it displayed a progress bar then fowarded to userhome.php where the target users info will lay, right now though if I just type in userhome.php i get there without haveing the crack it.... any ideas?

Hello, can someone please advice me on what scripts I will need to accomplish the following.

I want users to be able to login to their personal page, on there will be items such as pdf files, jpeg files etc, that they will be able to download.

Are there any free scripts out there that can do this, that anyone knows of? I don't mind paying if its a cheapish script for one of you to make for me, but money is a bit tight at the moment so a free script would be my 1st choice...

Thanks for all your help

Was wondering if anyone had any thoughts on how im running settings on my text base game.

I currently have like 60 settings stored in the data base. These are only admin control settings. They set what things cost in the game and such.

I was thinking today that would it be better instead of running a query on every page to grab the settings that page uses. I just simply  do one huge select ALL query for the settings when a user logs in and turn all the setting into super global $_SESSION.

Also this way any function i made i can simply use the SESSION instead of grabing settings out side the function or creating a query for it with in the function.

So i was thinking doing this would extremly speed up my game wouldnt it?
wondering if anyone has any thoughts on this

I've been trying to find a good, up-to-date source on how to secure the authentication credentials for my db connection. I've done some PHP coding and would like to learn more. There's plenty information available, but I often find books inevitably have typos in the code. Also most of the online tutorials are either at least several years old or deal more with user login security.

User authentication is one thing, but what are the best ways to secure the connection to the database itself? Obviously your basic newbie method of unencrypted host, username, password, and database stored in a connectvar file is just open invitation--or maybe not since it doesn't present a challenge to a hacker. Some say to encrypt the credentials with something like MD5 and store them in .htaccess. Other sources say not to use MD5. Any advice on where to find some good resources on this?

Cheers!