PHP - How To Let Users Choose Categories For The Frontpage

I just discovered that I have a major security flaw with my website.
Anyone who logs in to the website can easily access other users information as well as delete and edit other users information just by changing the ID variable in the address bar.
I have user ID Session started on these pages but still people can do anything they like with other users information just by editing the address bar.
For example if your logged in in the address bar of www.mywebsite.com/delete_mystuff.php?id=5 and change the "5" say to a "9" then you will have access to user#9 information.

Every important page that I have has this code:
Code: [Select]
 session_start();

if (!isset($_SESSION['user_id'])) {
// Start defining the URL.
         $url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']);
// Check for a trailing slash.
         if ((substr($url, -1) == '/') OR (substr($url, -1) == '\\') ) {
         $url = substr ($url, 0, -1); // Chop off the slash.
}
// Add the page.
$url .= '/index.php';
ob_end_clean(); // Delete the buffer.
header("Location: $url");
exit(); // Quit the script.
} else {
                //Else If Logged In Run The Script

if((isset($_GET['id'])) && (is_numeric($_GET['id']))) {
         $id = (int) $_GET['id'];
} elseif ((isset($_POST['id'])) && (is_numeric($_POST['id']))) {
         $id = (int) $_POST['id'];
} else {
         echo ' No valid ID found, passed in url or form element';
        
         exit();
}



What am I doing wrong?
Please help if you know how to correct this.

Many thanks in advance.

Code: [Select]
<div id="recent">
<p class="title"><?php echo "Staff Picks"; ?></p>
<div id="gallery">
<?php $i = 0; while($album = mysql_fetch_row($recent)): ?>
<?php if(++$i%4 == 1): ?><div><?php endif; ?>
<?php $image = mysql_fetch_row(mysql_query('SELECT `id`, `extension` FROM `image` WHERE `album_id`='.$album[0].' ORDER BY `id` DESC LIMIT 0,1')); ?>
<a href="<?php echo WEB; ?>a/<?php echo alphaID($album[0]); ?>">
<img src="<?php echo WEB; ?>small/<?php echo alphaID($image[0]); ?>.<?php echo $image[1]; ?>" alt=""/>
</a>
<?php if($i%4 == 0): ?></div><?php endif; ?>
<?php endwhile; ?>
<?php if($i%4 != 0): ?></div><?php endif; ?>
</div>
I have this code, which on my image hosting website, displays a grid of the latest albums of images that users upload. I really have no experience in Php.

I to change this code to simply display a grid of albums that i choose, not the latest. Like 'staff picks' instead of 'most recent'.


Any help would be greatly appreciated.

I need to choose a random number that doesn't currently exist in the database

Basically what I am trying to do is create an upload form so that I may choose what predetermined directory in a drop down to upload the file to. For example if I want to upload 'image.jpg' to the folder 'family' I can then use a drop down, select family and upload the image.

So far I have yet to find a script similar to what I am trying to do. I see regular upload scripts, but nothing so that I can choose a predetermined directory. Any ideas?

I need a simple code like
Code: [Select]
$test1="1";
$test2="2";
$test=$test1|$test2;
echo $test;to randomly catch the value of strings $test1 or $test2; as each time running the code, echo shows randomly one of the strings.

Could you please guide what the third line should be ?

I'm trying to work out if in my form my image field, which currently asks the user to upload from their hard drive, can show the contents of a server folder to select an image or upload a new one. Can this be done??

Hi there,

I'd be ever so greatful if someone could help me please. I'm really trying to get my head around working with arrays and could really do with an example in a context i fully understand.
I have made a test page for this and made a query that will search for appropriate records in my database:
  Code: [Select]
<?php $colname_Class = "3";
$colname_Ships = "-1";
if (isset($_SESSION['MM_Username'])) {
  $colname_Ships = (get_magic_quotes_gpc()) ? $_SESSION['MM_Username'] : addslashes($_SESSION['MM_Username']);
}
mysql_select_db($database_swb, $swb);
$query_Ships = sprintf("SELECT * FROM ships WHERE PlayerName = %s AND Class=%s AND Template='1'", GetSQLValueString($colname_Ships, "text"),
GetSQLValueString($colname_Class, "int"));
$Ships = mysql_query($query_Ships, $swb) or die(mysql_error());
$row_Ships = mysql_fetch_assoc($Ships);
$totalRows_Ships = mysql_num_rows($Ships);



echo $row_Ships['ShipID']; echo ' ';
echo $row_Ships['ShipName']; echo ' ';
echo $row_Ships['Class']; echo ' ';
echo '  ';
echo $totalRows_Ships = mysql_num_rows($Ships); ?>

After i made the query i echo out the ShipID, ShipName and Class from the queey which displays:

5 New Ship 3 1

So you can see the ShipID = 5, the name of the Ship is New Ship, its Class is 3 and there is only 1 record found in the database that matches the search criteria.

Lets say there are 10 records in my database... What i really need to do is  make an array of the outputted results, determine the number of records and then to randomly choose 1 of the results from the array.

Can you help me please?? If i can see an example in this context i feel i'd really learn something here.

If you can help, please do because im well stuck.

Thank you

Tom

Dear everyone,

I am reasonably new to php, so there is a chance that what I am asking for may exceed my grasp.
Nevertheless I'd like to try:

Is it possible to let the user choose (by using a drop down listbox for instance) which table from a database to display on a page?
And/or which database to display on a page?

Background information: I'm working on a website for my chess club. I've already got a working page (html,css) with a table of the standings (mysql, php) of the latest round (with position number, name, points, wins, losses, etc). By clicking on the column header, it sorts the respective column. What I'd finally like to do is let the user choose to display a different round (table), or even a different season (database). I could make a seperate page for each round, but I'd like to know if there's a more elegant way to do this by using only one page and one or more databases.

Thanks in advance for any tips and best wishes from The Netherlands,

Wouter.

I know the title is a bit confusing but I wasn't exactly sure how to describe my issue and none of my numerous searches online and here returned any positive results for a solution.

What I'm trying to do is allow a user to 'choose' one set from multiple sets of numbers for inclusion into the database. The image below should with the visualization of my goal.   As you can see from the above image, there's a "button" to the right that states "keep this set". My goal is to allow the user to click the button and the corresponding set of values is then entered into the database as a string (the values aren't being used in any calculations afterwards just being displayed on screen.)

The following code below works for auto-insertion if there's only one set generated but nothing I've attempted so far works when it comes to allowing the user to choose one set they'd like entered.

    <?php

additional code here...

    echo '<table><tr><td>';

    for($i=1; $i<=$Sets; $i++){
        $Stat_Results = GenStats($uId, $StartSet, $SetOption);

        echo "Stat values for ".$SetGenerated[$i];

       foreach($Stat_Results as $key => $DisplayStats){
              echo $DisplayStats.', ';
       }

       if($Sets == 1){
         $SetResults = implode(',',$Stat_Results);
         DB_Insert($uId, $SetResults, $TimeStamp);    
       }else if($Sets >= 2){
         echo "</td><td> => <input type='button' name='submit' value='keep this set'></td>
         <tr><td>";
       }
    }    
    echo '</td></tr></table>';
    ?>

html below here....

Variables: $sId, $StartSet, $SetOption, $Sets, $uId, and $TimeStamp are all set in a section not shown in this snippet.

I've tried Javascript but too be honest, I'm not all that familiar with it (though I am trying to become more fluid in it) and I've went so far as to try to create the multiple sets as a dropdown box thinking the user could simply select it from there and it be treated as a dynamic form and php would do the rest. But that didn't work either. The form button for submission is the remnant of the <select> list I tried to generate. The form is no longer there. I left the button in to generate the image you see above and has since been removed from the actual code.

I admit, I'm stuck and need some guidance because I can't seem to make this work no matter what I do. I realize $Stat_Results is a multidimensional array and contains all the values of each set in their respective array, but so far, I'm at a stand still on properly retrieving those values for insertion.

Thanks to all who read and attempt to help!
Edited by Cryotech, 01 December 2014 - 03:08 PM.

I have some code where i input data and upload images to a database (working 100% correctly)

However I want to expand on it - what I want is when a user uploads an image of their choice, to assign it to a directory of their choosing.

Then, when input is successful, write the directory of where the image is stored (not just the image) to the database.

Here is the code;

Code: [Select]
<?php

ini_set('display_errors',1);
error_reporting(-1);

require_once ('./includes/config.inc.php');

require_once (MYSQL);

$add_cat_errors = array();

if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
// Check for a name:
if (empty($_POST['product'])) {
$add_cat_errors['product'] = 'Please enter the name!';
}

// Check for a description:
if (empty($_POST['prod_descr'])) {
$add_cat_errors['prod_descr'] = 'Please enter the description!';
}

// Check for a category:
if (!isset($_POST['cat']) || !filter_var($_POST['cat'], FILTER_VALIDATE_INT, array('min_range' => 1))) {
$add_product_errors['cat'] = 'Please select a category!';
}

// Check for a price:
if (empty($_POST['price']) || !filter_var($_POST['price'], FILTER_VALIDATE_FLOAT) || ($_POST['price'] <= 0)) {
$add_cat_errors['price'] = 'Please enter a valid price!';
}

// Check for an image:
if (is_uploaded_file ($_FILES['image']['tmp_name']) && ($_FILES['image']['error'] == UPLOAD_ERR_OK)) {

$file = $_FILES['image'];

$size = ROUND($file['size']/1024);

// Validate the file size:
if ($size > 512) {
$add_cat_errors['image'] = 'The uploaded file was too large.';
} 

// Validate the file type:
$allowed_mime = array ('image/jpeg', 'image/JPG', 'image/jpg');
$allowed_extensions = array ('.jpg', 'jpeg');
$image_info = getimagesize($file['tmp_name']);
$ext = substr($file['name'], -4);
if ( (!in_array($file['type'], $allowed_mime)) 
||   (!in_array($image_info['mime'], $allowed_mime) ) 
||   (!in_array($ext, $allowed_extensions) ) 
) {
$add_cat_errors['image'] = 'The uploaded file was not of the proper type.';
} 

// Move the file over, if no problems:
if (!array_key_exists('image', $add_cat_errors)) {

// Create a new name for the file:
$new_name = (string) sha1($file['name'] . uniqid('',true));

// Add the extension:
$new_name .= ((substr($ext, 0, 1) != '.') ? ".{$ext}" : $ext);

// Move the file to its proper folder but add _tmp, just in case:
$dest =  "../db/images/$new_name";

if (move_uploaded_file($file['tmp_name'], $dest)) {

// Store the data in the session for later use:
$_SESSION['image']['new_name'] = $new_name;
$_SESSION['image']['file_name'] = $file['name'];

// Print a message:
echo '<h4>The file has been uploaded!</h4>';

} else {
trigger_error('The file could not be moved.');
unlink ($file['tmp_name']);
}

} // End of array_key_exists() IF.

} elseif (!isset($_SESSION['image'])) { // No current or previous uploaded file.
switch ($_FILES['image']['error']) {
case 1:
case 2:
$add_cat_errors['image'] = 'The uploaded file was too large.';
break;
case 3:
$add_cat_errors['image'] = 'The file was only partially uploaded.';
break;
case 6:
case 7:
case 8:
$add_cat_errors['image'] = 'The file could not be uploaded due to a system error.';
break;
case 4:
default: 
$add_cat_errors['image'] = 'No file was uploaded.';
break;
} // End of SWITCH.

} // End of $_FILES IF-ELSEIF-ELSE.



// Check for a stock:
if (empty($_POST['stock']) || !filter_var($_POST['stock'], FILTER_VALIDATE_INT, array('min_range' => 1))) {
$add_cat_errors['stock'] = 'Please enter the quantity in stock!';
}

if (empty($add_cat_errors))
{
$query = "INSERT INTO product (product, prod_descr, catID, price, image, stock) VALUES (?, ?, ?, ?, ?, ?)";
// Prepare the statement:
$stmt = mysqli_prepare($dbc, $query);
// For debugging purposes:
// if (!$stmt) echo mysqli_stmt_error($stmt);

// Bind the variables:
mysqli_stmt_bind_param($stmt, 'sssssi', $name, $desc, $_POST['cat'], $_POST['price'], $_SESSION['image']['new_name'], $_POST['stock']);

// Make the extra variable associations:
$name = strip_tags($_POST['product']);
$desc = strip_tags($_POST['prod_descr']);
// Execute the query:
mysqli_stmt_execute($stmt);

if (mysqli_stmt_affected_rows($stmt) == 1) { // If it ran OK.

// Print a message:
echo '<h4>The product has been added!</h4>';

// Clear $_POST:
$_POST = array();

// Clear $_FILES:
$_FILES = array();

// Clear $file and $_SESSION['image']:
unset($file, $_SESSION['image']);

} else { // If it did not run OK.
trigger_error('The product could not be added due to a system error. We apologize for any inconvenience.');
unlink ($dest);
}

} // End of $errors IF.

} else { // Clear out the session on a GET request:
unset($_SESSION['image']);
} // End of the submission IF.

require_once ('./includes/form_functions.inc.php');
?>

<form enctype="multipart/form-data" action="add_product.php" method="post" accept-charset="utf-8">

<input type="hidden" name="MAX_FILE_SIZE" value="524288" />

Product<br /><?php create_form_input('product', 'text', $add_cat_errors); ?>
           
            Description<br /><?php create_form_input('prod_descr', 'textarea', $add_cat_errors); ?>
           
Category<br /><select name="cat"<?php if (array_key_exists('cat', $add_cat_errors)); ?>>
<option>Select One</option>
<?php // Retrieve all the categories and add to the pull-down menu:
$q = 'SELECT catID, cat FROM category ORDER BY cat ASC';
$r = mysqli_query ($dbc, $q);
while ($row = mysqli_fetch_array ($r, MYSQLI_NUM)) {
echo "<option value=\"$row[0]\"";
// Check for stickyness:
if (isset($_POST['cat']) && ($_POST['cat'] == $row[0]) ) echo ' selected="selected"';
echo ">$row[1]</option>\n";
}
?>
</select><?php if (array_key_exists('cat', $add_cat_errors)) echo $add_product_errors['cat']; ?>
           
            Price<br /><?php create_form_input('price', 'text', $add_cat_errors); ?>
           
            Image<br /><?php

// Check for an error:
if (array_key_exists('image', $add_cat_errors)) {

echo $add_cat_errors['image'] . '<br /><input type="file" name="image"/>';

} else { // No error.

echo '<input type="file" name="image" />';

// If the file exists (from a previous form submission but there were other errors),
// store the file info in a session and note its existence:
if (isset($_SESSION['image'])) {
echo "<br />Currently '{$_SESSION['image']['file_name']}'";
}

} // end of errors IF-ELSE.
 ?>
          <br />
<select name="select">
<option value="full_heads">db/images/full_heads</option>
<option value="human_hair">db/images/human_hair</option>
</select>

Stock<br /><?php create_form_input('stock', 'text', $add_cat_errors); ?>


<input type="submit" value="Add This Product" class="button" />


</fieldset>

</form>

How do I achieve this?

I have two tables, one called Categories and one called SubCategories. Each subcategory needs to be displayed under its parent category in a HTML table.

So I have this code, but I don't know how to list each Sub-Category under each Category in a HTML table.

<?php

require ('includes/initialize.php');

require 'classes/database.class.php';


$sql = "SELECT * FROM Categories, SubCategories WHERE Categories.ID = SubCategories.CatID";

$Result = $database->Query($sql);
 
$Data = $database->Fetch($Result);

?>

Hello Everyone,
                      I am a noob at PHP so please forgive me if my code is wrong. I have a strong understanding of HTML and CSS  just for the curious.

Question: Write a program that formats a block of text (to be input by the user) based on preferences chosen by the user. Give your user options for color of text, font choice and size. Display output on a new page. I would greatly appreciate someone's help. The text is showing up but not according to the options selected. I know there is something wrong with the output page.

Here is the Input Page (call it question4.php):

<html>
<head>
<title>
Please Enter Your Text</title>
</head>

<body>



<form method="post" action="question4display.php">

<p>Enter the text you want formatted please:

<input type="text" name="textformat" maxlength="30" size="30" />

<table>
<tr>
   <td><label for="font">Select Font:</label></td>
   <td><select id="font" name="font">
   <option value="Verdana">Verdana</option>
   <option value="Arial">Arial</option>
   <option value="Times New Roman">Times New Roman</option>
</select>
</td>
</tr>

<tr>
   <td><label for ="size">Select Size:</label></td>
   <td><select id="size" name="size">
   <option value="10px">10px</option>
   <option value="12px">12px</option>
   <option value="14px">14px</option>
   <option value="20px">20px</option>
   
</select>
</td>
</tr>
   
<tr>
   <td><label for="color">Select Color:</label></td>
   <td><select id="color" name="color">
   <option value="green">Green</option>
   <option value="blue">Blue</option>
   <option value="red">Red</option>
   </select>
</td>
</tr>
</table>
   
   <input type="submit" name="submit" value="Submit" />
</form>


</body>
</html>




Here is the OUTPUT page (called it:question4display.php):


<?php

session_start();
$_SESSION['textformat'] = $_POST['textformat'];
$_SESSION['font'] = $_POST['font'];
$_SESSION['size'] = $_POST['size'];
$_SESSION['color'] = $_POST['color'];

?>

<html>
<head>
</head>
<body>
<p
<?php
echo ' style="font-family: ' . $_POST['font'] . '; ';
echo 'font-size: ' . $_POST['size'] . '; ';
echo 'color: ' . $_POST['color'] . '; ';
?> >
<?php
echo $_POST['textformat'];
?>
</p>

</body>
</html>

Hi there, I have a piece of code that takes all posts with the category of 'model' and puts it on the models page. It then displays the post as a gallery using fancy box. The problem is I want all posts with the category of 'faces' to go on the faces page, but at the moment they are appearing on both pages. Here is the code I have. Any help will guarantee a donation as I am at my wits end trying to figure this out.

Code: [Select]
<?php
  global $post;

  $args = array(
    'numberposts'     => 8,
    'offset'          => 0,
    'category'        => 'models',
    'orderby'         => 'post_date',
    'order'           => 'DESC',
    'post_type'       => 'post',
    'post_status'     => 'publish' );

  $posts_array = get_posts( $args );
  $x = 1; // track model
  foreach( $posts_array as $post ) {
    setup_postdata($post); ?>
    <div id="model-thumb">
<?php
    $arg2 = array( 'post_type' => 'attachment', 'numberposts' => -1, 'order' => 'ASC', 'post_status' => null, 'post_parent' => $post->ID );
    $attachments = get_posts($arg2);
    if ($attachments) {
        $i = 1; // track images
        foreach ( $attachments as $attachment ) {
            $image_attributes = wp_get_attachment_image_src( $attachment->ID, 'full' );
            if ($i == 1) { // Get thumbnail info to display with second image
                $img1src = $image_attributes[0];
                $img1w = $image_attributes[1];
                $img1h = $image_attributes[2];
            } elseif ($i == 2) { // Display thumbnail with link to second image
?>
           <a class="allModels" rel="gallery<?php echo $x; ?>" href="<?php echo $image_attributes[0]; ?>" 
?><img src="<?php echo $img1src; ?>" width="<?php echo $img1w; ?>" height="<?php echo $img1h; ?>"/></a><br /><p><?php the_content();?></p></div>

<?php
            } else { // Other images
?>
                <div style="display:none;"><a class="allModels" rel="gallery<?php echo $x; ?>" href="<?php echo $image_attributes[0]; ?>"><img src="<?php echo $image_attributes[0]; ?>" width="<?php echo $image_attributes[1]; ?>" height="<?php echo $image_attributes[2]; ?>"/></a></div>

<?php
            }
            $i++; // Increase image count
        }
    }

    $x++; // Increase model count
  }

?>

Hello dear friends,

If i've the following ( categories - gifts )

<?PHP
$sql ="select *  from  categories";
$result= mysql_query($sql);
while($line= mysql_fetch_array($result)){
$qryrow="select * from gifts where gifts='$line[1]'";
}
?>

it means select category and its gifts

now my question how to view it all in table for example if i add

Code: [Select]
<TABLE cellSpacing=1 cellPadding=1 width="100%">
<TBODY>
<TR>
<TD>
<?php echo "". $line[1].""; ?>
</TD>
</TR>
</TBODY>
</TABLE>
it will show me like this
 

How can i make it like this



my problem how to make table like this and where to put the php variable  .. 

thanks