PHP - Storing Variables

I am by no means a security expert, but I would like to know if storing MySQL database information in an environment variable would be a good or bad idea. What are your thoughts?

does anyone know how to decode this XML variable value into string values? I also need to know the oposite way: creating variable values into xml. I've tried several code examples but they did filter the requested data.

Code: [Select]
$xml='<?xml version="1.0" encoding="utf-8"?>
<elements>
<text identifier="ed9cdd4c-ae8b-4ecb-bca7-e12a5153bc02">
  <value/>
</text>
<textarea identifier="a77f06fc-1561-453c-a429-8dd05cdc29f5">
  <value><![CDATA[<p style="text-align: justify;">Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.</p>]]></value>
</textarea>
<textarea identifier="1a85a7a6-2aba-4480-925b-6b97d311ee6c">
  <value><![CDATA[<p style="text-align: justify;">Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy  eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed  diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum.  Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor  sit amet.</p>]]></value>
</textarea>
<image identifier="ffcc1c50-8dbd-4115-b463-b43bdcd44a57">
  <file><![CDATA[images/stories/red/cars/autobedrijf.png]]></file>
  <title/>
  <link/>
  <target/>
  <rel/>
  <lightbox_image/>
  <width><![CDATA[250]]></width>
  <height><![CDATA[187]]></height>
</image>
<text identifier="4339a108-f907-4661-9aab-d6f3f00e736e">
  <value><![CDATA[Kramer 5]]></value>
</text>
<text identifier="ea0666d7-51e3-4e52-8617-25e3ad61f8b8">
  <value><![CDATA[6000 RS]]></value>
</text>
<text identifier="90a18889-884b-4d53-a302-4e6e4595efa0">
  <value><![CDATA[Eindhoven]]></value>
</text>
<text identifier="410d72e0-29b3-4a92-b7d7-f01e828b1586">
  <value><![CDATA[APK Pick up and return]]></value>
</text>
<text identifier="45b86f23-e656-4a81-bb8f-84e5ea76f71f">
  <value><![CDATA[15% korting op grote beurt]]></value>
</text>
<text identifier="3dbbe1c6-15d6-4375-9f2f-f0e7287e29f3">
  <value><![CDATA[Gratis opslag zomerbanden]]></value>
</text>
<text identifier="2e878db0-605d-4d58-9806-8e75bced67a4">
  <value><![CDATA[Gratis abonnement of grote beurt]]></value>
</text>
<text identifier="94e3e08f-e008-487b-9cbd-25d108a9705e">
  <value/>
</text>
<text identifier="73e74b73-f509-4de7-91cf-e919d14bdb0b">
  <value/>
</text>
<text identifier="b870164b-fe78-45b0-b840-8ebceb9b9cb6">
  <value><![CDATA[040 123 45 67]]></value>
</text>
<text identifier="8a91aab2-7862-4a04-bd28-07f1ff4acce5">
  <value/>
</text>
<email identifier="3f15b5e4-0dea-4114-a870-1106b85248de">
  <value/>
  <text/>
  <subject/>
  <body/>
</email>
<link identifier="0b3d983e-b2fa-4728-afa0-a0b640fa34dc">
  <value/>
  <text/>
  <target/>
  <custom_title/>
  <rel/>
</link>
<relateditems identifier="7056f1d2-5253-40b6-8efd-d289b10a8c69"/>
<rating identifier="cf6dd846-5774-47aa-8ca7-c1623c06e130">
  <votes><![CDATA[1]]></votes>
  <value><![CDATA[1.0000]]></value>
</rating>
<googlemaps identifier="160bd40a-3e0e-48de-b6cd-56cdcc9db892">
  <location><![CDATA[50.895711,5.955427]]></location>
</googlemaps>
</elements>';

Can anyone tell me whats wrong with this:

The file uploads fine, the url however does not get posted to the database?
I added a 'or die' but it didn't execute...Do I need to move the query higher up the script?

<?php
include ('base.php');
$id = $_GET['id'];

if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg"))
&& ($_FILES["file"]["size"] < 20000))
  {
  if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "imgs/pictures/" . $_FILES["file"]["name"]);
      echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
      }
    }
  }
else
  {
  echo "Invalid file";
  }
$file = $_FILES["file"]["name"];
 $sql = "UPDATE `chillp_security`.`staff` SET `picture` = \'imgs/pictures/$file\' WHERE `staff`.`id` = $id;";
?>

Code: [Select]
<?php $going='';
$name='<span id="name"></span>';
echo "$name";      //results : stevengoh   ---     wanted 
$going=substr($name, 1, 17);
echo "$name";   //results : <span id="going">     ----       don't want
?>
Is it possible to store in php the results of variable id="going" javascript instead of <span id="going"></span>?.

Hi,
I am struggling with a form in php. I am trying to add a form by using the include function. I want to include thsi form on all pages so it would be very useful if I can save the current page name somewhere so that I can use to validate the form.

For example, this is the form I am trying to include.

<?php
if(!empty($errors))
{
if(isset($errors['sendError']))
{
echo '<p><strong class="error">There was a problem with our system please contact us directly.</strong></p>';
}
else
{
echo '<p><strong class="error">Please check the form below for errors.</strong></p>';
}
}
?>
<form action="index.php" method="post" id="form1">
<p>
<label><?php if(isset($errors['name'])) { echo '<span class="error">'; } ?>Name<font color="red">*</font>: <?php if(isset($errors['name'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['name']; ?>" name="name" size="60" align="right" style="background:#EEF5A4" />

<label><?php if(isset($errors['company'])) { echo '<span class="error">'; } ?>Company: <?php if(isset($errors['company'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['company']; ?>" name="company" size="60" align="right" />

<label><?php if(isset($errors['phone'])) { echo '<span class="error">'; } ?>Phone Number: <?php if(isset($errors['phone'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['phone']; ?>" name="phone" size="60" align="right" />

<label><?php if(isset($errors['email'])) { echo '<span class="error">'; } ?>Email<font color="red">*</font>: <?php if(isset($errors['email'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['email']; ?>" name="email" size="60" align="right" style="background:#EEF5A4" />

<label><?php if(isset($errors['enquiry'])) { echo '<span class="error">'; } ?>Enquiry: <?php if(isset($errors['enquiry'])) { echo '</span>'; } ?></label>
<textarea id="search1" id="complete" textarea name="enquiry" rows=4 cols=40 value="<?php echo $form['enquiry']; ?>" name="enquiry" size="60" align="right"></textarea>
</p>
<p>
<input type="submit" class="formbutton" value="Submit" />&nbsp;<input type="reset" class="formbutton" value="Reset" />
</p>
<p><font color="red">*</font> Denotes a required field</p>
</form>

Because I am going to use this form on all pages, I would like it to include whatever the filename is rather than index.php in the first line of the form so that when the user clicks submit, it will stay on the same page but validate the form based on the mandatory fields.

I don't know if the question is clear. I would very much appreciate any help at all.

Thank you very much.

Alright, the register/login system is fully working with sql injection, BUUUT now I want to store their IP Address. WHOLE new function that I've never dealt with before. So I need some help. Am I doing something wrong?

I have the IPadd in the database as INT(10) and then I went down to another drop down list and hit unsigned.
I feel like I'm doing something wrong with the field in the database..

{
$_SERVER['REMOTE_ADDR'] = $IPadd;
$sql = "INSERT INTO Member (username,createDate,password,firstName,email,IPadd) VALUES ('$username',NOW(),md5('$password'),'$firstName','$email',inet_aton('$IPadd'))";
mysqli_query($cxn,$sql);
$_SESSION['auth']="yes";
$_SESSION['username'] = $username;
header("Location: testing.php");
}

Hi, i would like to know what is the best method to store a picture. Currently what happens, is each user has a different avatar, which when uploaded comes in a folder called Avatar, in my website folder and is also stored as a BLOB in mysql. I would like to know is this ok to store all avatars in one folder or some other step should be used and if so could some one guide me to a good tutorial. As I would also like to make an option, where people could upload their pictures, is it safe to store pictures in the same folder for all users or some how create a different folder for each user.

So, on my website, i have added a "last active" feature, so if someone is surfing the site, they can view when another users last page visit was.

so, every second, +1 is added to the $ts variable

what i have now, working and all, shows ONLY "NOW!", or ONLY "1 second", ONLY "___ seconds ago"... and so on

I have tred over, and over, and over to fix this to my liking, with more instances available, as an example, my current script will show somebody who is 13 months and 26 days inactive, just as "1 year", i want to see the "1 year, 1 month, and 26 days inactive"... or even simpler, just so it displays days/minutes/seconds/NOW!


function howlongtil($ts) {
   $ts=$ts - time();
   if ($ts<1)
       // <1 second
       return " NOW";
   elseif ($ts==1)
       // <1 second
       return $ts." second";
   elseif ($ts<60)
       // <1 minute
       return $ts." seconds";
    elseif ($ts<120)
       // 1 minute
      return "1 minute";
   
    elseif ($ts<60*60)
       // <1 hour
       return floor($ts/60)." minutes";
   elseif ($ts<60*60*2)
       // <2 hour
       return "1 hour";
     elseif ($ts<60*60*24)
       // <24 hours = 1 day
       return floor($ts/(60*60))." hours";
     elseif ($ts<60*60*24*2)
       // <2 days
       return "1 day";
     elseif ($ts<(60*60*24*7))
       // <7 days = 1 week
         return floor($ts/(60*60*24))." days";
   elseif ($ts<60*60*24*30.5)
       // <30.5 days ~  1 month
       return floor($ts/(60*60*24*7))." weeks";
     elseif ($ts<60*60*24*365)
       // <365 days = 1 year
       return floor($ts/(60*60*24*30.5))." months";
   else
       // more than 1 year
       return floor($ts/(60*60*24*365))." years";
};


anyone know how?

Hey guys,
What would you recommend to store db values for later?

the only thing I can come up with is doing it this way:

$result = mysql_query("SELECT * FROM users WHERE name='$user'");
while($row = mysql_fetch_array($result))
{
}
  {
and then using the $row['dbvariable'] later

is that the best way?

Hi, when a user logs out, I want to store the last activity in for the user. I have a db table users:

userID  userName  userPassword lastSession     lastActivity
=====  =======  ==========  ========    =======
1            bob            password         2011-08-09   About.html
2            dre             passwords       2011-09-23   Home.php


here is logout script:
===============
Code: [Select]
<?php
//run this script only if the logout button has been clicked
if(array_key_exists('logout', $_POST)) {
        require("connect.inc");
$username=$_POST["username"];
$updateLastSessionQuery=mysql_query("UPDATE users SET lastSession=NOW() WHERE userName='$username'");

// end session and redirect
//empty the $_SESSION array
    $_SESSION = array();

    session_destroy();
header("Location: xmlShredderLogin.php");  
    exit;
}//END IF for when logout submitted
?>

here is Index.php:
=============
Code: [Select]
<?php
session_start();
if(isset($_SESSION["isAuthenticated"])) {
require("logout.inc.php");
$username=$_POST["username"];
//print $username."<br />";
print '
<html>
<head><title>Home</title></head>
<body>
<form id="logoutForm" name="logoutForm" method="post" action="">
<input name="logout" type="submit" id="logout" value="Log out" />
<input type="hidden" name="usernameHidden" value='; print$username; print '/>
</form>';
mysql_connect("localhost","root");
mysql_select_db("someDB");
$getUserInfoQuery=mysql_query("SELECT lastSession,lastActivity FROM users WHERE userName='$userName'");
$getUserInfo=mysql_fetch_assoc($getUserInfoQuery);
print "Last session: ".$getUserInfo["lastSession"]."<br />";
print "Last activity: ".$getUserInfo["lastActivity"]."<br />";


Let's say the last page the user is on is Index.php, so what do I use to track the last page they are on?? I can't user a form b/c if I have to type in the last activity, that's nonsense! So far I have only figured out how to store the current time in last session (but this doesn't work either).

I just want to track the last page and then have a switch such as:
switch(type)
case 1:
$lastActivity="About.html";
case 2:
$lastActivity="somethingelse.php";


Any help much appreciated!

Im making a application but many users can access it at the same time, also the data that needs to be stored into the database in 3 parts firstly the user will enter some details the comany will fill out the reamining details and the user will then accept or decline the companies proposal. The issue im havign will it be easier to just store all of this information into session variables and then save them into the database at the end when all of the details are ready ?

Thank You

Let's see if I can explain this ok.. Basically I have a site and the page product categories use dynamically created URL's. I want to use these URL's to put on my products so I can list all the categories each product is in. But, as these URL's are not stored anywhere I'm not sure how to go about calling them. Is the best way going to be to modify the site to store the page URL's in MySQL? Or could they be stored within variables in PHP? A little guidance would be great! Thanks in advance 

Hey

I am having a small problem with setting and storing data using $_SESSION for a login script to validate that a user is logged in.
The outputted error message I'm getting is;
Notice: Undefined index: userid ...\...\
Notice: Undefined variable: userid in ...\...\

The PHP code I'm using for the validation

Code: [Select]
<?php
session_start(); //must call session_start before using any $_SESSION variables

$username = $_POST['username'];
$password = $_POST['password'];
$userid = $_POST['userid'];

//validating a user
function validateUser()
{
    session_regenerate_id (); //this is a security measure
    $_SESSION['valid'] = 1;
    $_SESSION['userid'] = $userid;
}

Let me know if you need any other bits of code to establish what is happening I really need help with this.
Thanks.

had this working by simply passing the data from one variable to another like so:

Code: [Select]
$CalcsSets = $DisplayCalcs;
without the need to use the if() statement and it inserted the data without quotes but all of a sudden it's stopped working and I'm not sure why (it only started showing last integer), so I went with the more complex code trying to get it to work again as shown below.

Here's the complex code I'm working with:

Code: [Select]
for($i=1; $i<=$CalcSets; $i++){


$calculations = PerformCalc($min, $highest, $OperatorType);

echo 'Calculations performed for '.$SetText[$i];

  foreach ($calculations as $key => $DisplayCalcs) {
      echo $SetCalc[] = $DisplayCalcs.', ';  //stores calculations with ',' in
                                            //array.
}

if($CalcSets == 1){

   for($i=0;$i<$CalcSets;$i++){
      $SetResults = $SetCalc[$i];
      echo '<strong>'.(string)$SetResults.'</strong>';             
   }
        DB_Insert($SetResults);
}
What it's supposed to do is insert values in the following format (1,2,3,4,5,) into the database in a VARCHAR row but now all it shows is the last integer with no comma. I originally wanted to just store the integers and not a comma but I couldn't get it to display on the page with commas after each integer so I went this route as mentioned earlier.

I realize I'm probably going about this the wrong way, but if any of you know a much easier, and shorter, way to do what I want, I'd be extremely appreciative of the help.

Reason I'm doing it this way, is because on the results page, it needs to show in the format mentioned above.

FYI, I did check the DB row and it is still set to VARCHAR with a length of 10 at the moment.

Hey,

I am a bit of a noob at php/mysql and trying to be clever(emphasis on trying).

I want to pull some php/html code from a database in mysql, whilst it does display the html, the php does not.
Can this even be done? Is it going to cause me issues later on?

Code: [Select]
[php]
<?php
    $query = "SELECT * FROM pages";
    $result = mysql_query($query) or die(mysql_error());
while ($row = mysql_fetch_array($result)){
$body = $row["body"];
echo $body;
    }?>
[/php]
Any help would really be appreciated.

Ell