PHP - I Need Major Help With My Website, Please.

I make my share of programming design blunders, as many of you know from helping me debug a few, so I am hesitant to point fingers, but I just had an experience so horrible, with so many errors on a website owned by Snapfish (which should have some programming resources) that I had to write it up.    

Hi, I am having some major issues.
My site provides sheet music available for downloading for free. When a user clicks on a sheet to download, a new window opens up. This user views our sponsor's website for 30 seconds. Once the time is up, they can download the free sheet.

Now for the issues:

I found a download script that I'm putting to the test. When clicking download, it asks where you want to save the file and downloads the file just fine. After some testing, i found that if the user tries to download the sheet again, my entire php/html code displays on the page, as well as a bunch of nonreadable characters (I'm guessing this is from the .pdf file that is supposed to be downloaded).

I need to modify my code to stop this from happening. I've tried to exit() the code or die() after the sheet downloads, but I must be doing it wrong because nothing seems to work. I also tried a redirect to send them to a different page once they download the file. That doesn't work either.

The next issue is the bottom page is supposed to display our sponsor's website, which it does. However, the frame that contains the website is not 100% in height as it is specified to be. Something in my code is causing it to stop extending all the way.

If you would like to see exactly what is happening for yourself, you can go he
http://www.sheetmusichaven.com/download.php?sheet=98%20Degrees-I%20Do%20Cherish%20You-SheetMusicHaven.pdf&artist=98%20Degrees&title=I%20Do%20Cherish%20You

I'm using the latest version of Firefox, PHP 5.

And for the code. I warn you it is ugly ><

<?php
session_start();

include_once('inc/connect.php');

$sheet = $_GET['sheet'];
$artist = stripslashes($_GET['artist']);
$title = stripslashes($_GET['title']);
$hyphen = " - ";
$url = "http://www.youtube.com";
$timetodownload = $_POST['timetodownload'];

$todayquery = mysql_query("SELECT `todayviews` FROM `websites` WHERE `active`='yes'");
$todayresult = mysql_fetch_assoc($todayquery);

$todayviews = $todayresult['todayviews'];

$result = mysql_query("SELECT `url` FROM `websites` WHERE `active`='yes' && `dailyviews`>'$todayviews' && `credits`>0");
$i = 0;
while($row = mysql_fetch_array($result))
  {
    
    while($i<1){
    
    $url = $row['url'];    
    $i++;
    
    }
  
  }


if(strlen($artist)+strlen($title)>80){
    $artist = "";
    $hyphen = "";
}
$ip = $_SERVER['REMOTE_ADDR'];
// Time Goes Here

// $ipcheck = mysql_query("SELECT ip FROM downloading WHERE ip='$ip'");
// $ipcount = mysql_num_rows($ipcheck);

// if ($ipcount!=0)
// {
// $error1 = "<div id='regerror'>Username already taken!</div>";
// }

// $ipquery = "INSERT INTO downloading VALUES ('','$ip','$time')";
// mysql_query($ipquery);

$timesdownloaded = 0;
if(isset($timetodownload)&&$timesdownloaded<1){
###############################################################
# File Download 1.31
###############################################################
# Visit http://www.zubrag.com/scripts/ for updates
###############################################################
# Sample call:
#    download.php?f=phptutorial.zip
#
# Sample call (browser will try to save with new file name):
#    download.php?f=phptutorial.zip&fc=php123tutorial.zip
###############################################################

// Allow direct file download (hotlinking)?
// Empty - allow hotlinking
// If set to nonempty value (Example: example.com) will only allow downloads when referrer contains this text
define('ALLOWED_REFERRER', '');

// Download folder, i.e. folder where you keep all files for download.
// MUST end with slash (i.e. "/" )
define('BASE_DIR','admin/uploads/');

// log downloads?  true/false
define('LOG_DOWNLOADS',true);

// log file name
define('LOG_FILE','downloads.log');

// Allowed extensions list in format 'extension' => 'mime type'
// If myme type is set to empty string then script will try to detect mime type 
// itself, which would only work if you have Mimetype or Fileinfo extensions
// installed on server.
$allowed_ext = array (

  // archives
  'zip' => 'application/zip',

  // documents
  'pdf' => 'application/pdf',
  'doc' => 'application/msword',
  
  // images
  'gif' => 'image/gif',
  'png' => 'image/png',
  'jpg' => 'image/jpeg',
  'jpeg' => 'image/jpeg',
);



####################################################################
###  DO NOT CHANGE BELOW
####################################################################


// If hotlinking not allowed then make hackers think there are some server problems
if (ALLOWED_REFERRER !== ''
&& (!isset($_SERVER['HTTP_REFERER']) || strpos(strtoupper($_SERVER['HTTP_REFERER']),strtoupper(ALLOWED_REFERRER)) === false)
) {
  die("Internal server error. Please contact system administrator.");
}

// Make sure program execution doesn't time out
// Set maximum script execution time in seconds (0 means no limit)
set_time_limit(0);

if (!isset($sheet) || empty($sheet)) {
  die("Please specify file name for download.");
}

// Nullbyte hack fix
if (strpos($sheet, "\0") !== FALSE) die('');

// Get real file name.
// Remove any path info to avoid hacking by adding relative path, etc.
$fname = basename($sheet);

// Check if the file exists
// Check in subfolders too
function find_file ($dirname, $fname, &$file_path) {

  $dir = opendir($dirname);

  while ($file = readdir($dir)) {
    if (empty($file_path) && $file != '.' && $file != '..') {
      if (is_dir($dirname.'/'.$file)) {
        find_file($dirname.'/'.$file, $fname, $file_path);
      }
      else {
        if (file_exists($dirname.'/'.$fname)) {
          $file_path = $dirname.'/'.$fname;
          return;
        }
      }
    }
  }

} // find_file

// get full file path (including subfolders)
$file_path = '';
find_file(BASE_DIR, $fname, $file_path);

if (!is_file($file_path)) {
  die("File does not exist. Make sure you specified correct file name."); 
}

// file size in bytes
$fsize = filesize($file_path); 

// file extension
$fext = strtolower(substr(strrchr($fname,"."),1));

// check if allowed extension
if (!array_key_exists($fext, $allowed_ext)) {
  die("Not allowed file type."); 
}

// get mime type
if ($allowed_ext[$fext] == '') {
  $mtype = '';
  // mime type is not set, get from server settings
  if (function_exists('mime_content_type')) {
    $mtype = mime_content_type($file_path);
  }
  else if (function_exists('finfo_file')) {
    $finfo = finfo_open(FILEINFO_MIME); // return mime type
    $mtype = finfo_file($finfo, $file_path);
    finfo_close($finfo);  
  }
  if ($mtype == '') {
    $mtype = "application/force-download";
  }
}
else {
  // get mime type defined by admin
  $mtype = $allowed_ext[$fext];
}

// Browser will try to save file with this filename, regardless original filename.
// You can override it if needed.

if (!isset($_GET['fc']) || empty($_GET['fc'])) {
  $asfname = $fname;
}
else {
  // remove some bad chars
  $asfname = str_replace(array('"',"'",'\\','/'), '', $_GET['fc']);
  if ($asfname === '') $asfname = 'NoName';
}

// set headers
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: public");
header("Content-Description: File Transfer");
header("Content-Type: $mtype");
header("Content-Disposition: attachment; filename=\"$asfname\"");
header("Content-Transfer-Encoding: binary");
header("Content-Length: " . $fsize);

// download
// @readfile($file_path);
$file = @fopen($file_path,"rb");
if ($file) {
  while(!feof($file)) {
    print(fread($file, 1024*8));
    flush();
    if (connection_status()!=0) {
      @fclose($file);
      
      die();
    }
  }
  @fclose($file);
}

// log downloads
if (!LOG_DOWNLOADS) die();

$f = @fopen(LOG_FILE, 'a+');
if ($f) {
  @fputs($f, date("m.d.Y g:ia")."  ".$_SERVER['REMOTE_ADDR']."  ".$fname."\n");
  @fclose($f);
  
}


    $timesdownloaded++;
    if(isset($timetodownload)==($_POST['timetodownload'])){
    $timetodownload = "";
    echo "<meta http-equiv=\"refresh\" content=\"0;url=index.php?letter=0\">";
    }
    if($timesdownloaded>0){
        header("Location: index.php");
    }
}

?>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en-US" xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="description" content="Free Piano Sheet Music - Sheet Music Haven" />
<meta name="keywords" content="free,piano,sheet,music,download,keyboard,haven,lyrics,notes,chords,score,top,modern,popular,jazz,classical,sheetmusichaven" />
<meta name="author" content="Sheet Music Haven - Free Piano Sheet Music. Download all types of piano sheet music for free. Popular sheets are added often" />
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1" />
<title>Downloading <?php echo $sheet; ?> - Sheet Music Haven</title>
<link rel="stylesheet" type="text/css" href="styles/style.css" />
<style>
iframe {
padding: 0px;
spacing: 0px;
}

body{
    margin: 0px;
    color: #000000;

}
#bggreen{
    width: 99%;
    height: 88%;
    background-color: #6aa504;
    margin-left: auto;
    margin-right: auto;
    text-align: center;
}
#countdown{
    color: #4296ce;
    font-size: 18px;
        
}

.sheetbar a{color: #000000;
         font-family: "Arial", Helvetica, sans-serif;
         }
#logo{
    position: relative;
    width: 320px;
    height: 65px;
    text-align: center;
    float: left;
    top: 19px;
}
#timer{
    position: relative;
    width: 65%;
    height: 59px;
    float: left;
    text-align: center;
    top: 3px;
    background-color: #ececec;
    border-style: solid;
    border-color: #93DB70;
}
</style>
<script type="text/javascript">

var time = 2;

function startCountdown(){
    var t = setTimeout("countdown()", 1000);
}

function countdown(){
var sHeet = "<?php echo $sheet;?>";
var artist = "<?php echo $artist;?>";
var tItle = "<?php echo $title;?>";

    --time;
    if(time == 0){
        document.getElementById("countdown").innerHTML = "<form action='download.php?sheet=<?php echo $sheet; ?>' method='POST'><input type='image' src='img/download.png' alt='Download' name='timetodownload' value='Download'><\/form>";

    }else{
        document.getElementById("countdown").innerHTML = time;
        var t = setTimeout('countdown()', 1000);
    }
}
</script>
</head>
<body onload="startCountdown();" bgcolor="#343331">

<table width="100%" height="100%" cellspacing="0" cellpadding="0" border="0">
<?php

echo "<tr><td style='background:#343331;height:80px;border-bottom:#aaaaaa solid 2px;'>";

echo "<div id='bggreen' class='sheetbar'>
<div id='logo'><a href='index.php'><img src='img/logosmall.png'></a><br />
    <a href='suggestions.php' style='color: #ececec; font-size: 14px;'>Report Errors</a></div>
<div id='timer'>
It is our sponsor's that keep this website running. Please view their website while you wait for:<br />
 <span style='color: #6aa504;'>".ucwords($artist).$hyphen.ucwords($title)."</span>
<br />
<div id='countdown'>2</div>
</div>
</div>".$error;
echo "</td></tr>";
?>

<tr><td>
<iframe src="<?php echo $url;?>" width="100%" height="100%" frameborder="0" marginwidth="0" marginheight="0">
  <p>Your browser does not support iframes.</p>
</iframe>
</td></tr>

</table>

</body>
</html>

Here is my code so far... I can't login using this php, i am new to php and am trying my hardest to figure this out... i have been on this for 4 days and am about to pull all of my hair out... can anyone please help me...


//******** start of login.php ********

<?php
  require_once('connectvars.php');

  // Start the session
  session_start();

  // Clear the error message
 // $error_msg = "";

  // If the user isn't logged in, try to log them in
  if (!isset($_SESSION['user_id'])) {
    if (isset($_POST['submit'])) {
      // Connect to the database
      $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

      if (!$dbc) {
          die('Could not connect: ' . mysqli_error());
      }

         echo 'Connected successfully';

      // Grab the user-entered log-in data
      $user_email = mysqli_real_escape_string($dbc, trim($_POST['email']));
      $user_pass = mysqli_real_escape_string($dbc, trim($_POST['password']));

      if (!empty($user_email) && !empty($user_password)) {
        // Look up the username and password in the database
        $query = "SELECT tb_user_id, tb_user_email FROM tb_users WHERE tb_user_email = '$user_email' AND tb_user_password = SHA('$user_pass')";
      $data = mysqli_query($dbc, $query);
      
        if (mysqli_num_rows($data) == 1) {
         

          // The log-in is OK so set the user ID and username session vars (and cookies), and redirect to the home page
       
          $row = mysqli_fetch_array($data);
        $_SESSION['user_id'] = $row['tb_user_id'];
          $_SESSION['email'] = $row['tb_user_email'];
          setcookie('user_id', $row['tb_user_id'], time() + (60 * 60 * 24 * 30));    // expires in 30 days
          setcookie('email', $row['tb_user_email'], time() + (60 * 60 * 24 * 30));  // expires in 30 days
          $home_url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']) . '/index.php';
          header('Location: ' . $home_url);
        }
        else {
          // The username/password are incorrect so set an error message
        $error_msg = 'Sorry, you must enter a valid username and password to log in1.';
        }
      }
      else {
      //*********** This is the error i keep getting
      // The username/password weren't entered so set an error message
       $error_msg = 'Sorry, you must enter your username and password to log in2.';
      }
    }
  }

  // Insert the page header
  $page_title = 'Log In';
  require_once('header.php');

  // If the session var is empty, show any error message and the log-in form; otherwise confirm the log-in
  if (empty($_SESSION['user_id'])) {
    echo '<p class="error">' . $error_msg . '</p>';
?>

  <form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
    <fieldset>
      <legend>Log In</legend>
      <label for="email">Email Address:</label>
      <input type="text" name="email" value="<?php if (!empty($user_email)) echo $user_email; ?>" /><br />
      <label for="password">Password:</label>
      <input type="password" name="password"/>
    </fieldset>
    <input type="submit" value="Log In" name="submit" />
  </form>

<?php
  }
  else {
    // Confirm the successful log-in
    echo('<p class="login">You are logged in as ' . $_SESSION['email'] . '.</p>');
  }
?>

<?php
  // Insert the page footer
  require_once('footer.php');
?>

I am in the middle of creating an E-Commerce website in PHP (using EasyPHP) and I have run into some problems

I have a file called Logout.php which is designed to log registered database users out of a session. However when I go to view the page, I get this ASP.NET IIS7 message:

HTTP Error 500.24 - Internal Server Error
An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode.

This is obviously a php file I have developed, but I do not understand why it is doing this.

I have attached the entire project to the message (once unzipped, look for "logout.php") to demonstrate what I am doing, help would be very appreciated please.

I have a script that I've given the user some additional options to either get a random proxy from a URL or list that they have supplied. While getting from the URL is no problem. I banging my head against the wall trying to figure out why the program won't get a random proxy from the list. After submitting their query their proxy list gets written to a temporary file. Everything writes fine and the URL where they are written is the exact format that I need.

This works:



//Where the user submits a URL

<?PHP 
$proxypage = file('theirproxyurl.php');
?>


Although the page exists in the exact same format as the above link when I write their proxies to a file within the server - it does not work. For example:



//Where the user submits a list of proxies - they get written to a file

<?PHP 
$proxypage = file('proxieswrittentofile.php');
?>


Even if I paste the LINK (Note: the page exists with the exact same format) directly in the program where the users proxies were written to it still doesn't work. 


<?PHP 
//This doesn't work: 

$proxypage = file('pasted-working-link-in-exact-same-format.php');
?> 

<?PHP 

//I tried the full URL - it doesn't work either

$proxypage = file('http://SUBDOMAIN.fullURLtowrittenproxypage.php');
?>




The only thing that's different is that the file where the proxies are being written is on a sub-domains. Aside from that the pages are absolutely identical down to the <br /> tags. Would sub-domains be an issue for the file function?