PHP - Validate Input Numeric Data
Hey Guys...I am trying to secure my php file and have been reading a lot regarding sql injection.
I still dont understand clearly how to prevent sql injection through numeric data input, since from what I understood mysql_real_escape_string() does nothing about it only prevents attacks on string input. Here's an example: if ($action == "checkId") { //retreive data from flash $user_id=mysql_real_escape_string($_POST['Id']); $result = mysql_query("SELECT user_id from users WHERE user_id = '$user_id'"); if (mysql_num_rows($result) > 0) { echo "status1=exists"; } else { echo "status1=id doesnt exist"; } } I would like to create a function like this: foreach($_POST as $post) { $postvars[$key] = htmlentities($post); //XSS prevention $postvars[$key] = mysql_real_escape_string($post); //Sql String Prevention } But then again...How do I check on the numeric POST's ? how do I validate them through this function? Any suggestions and/or ideas? Thanks a lot in advance! Cheers. Similar TutorialsAnyone know how to cast arabic numeric input to (int) ? Or how to convert arabic numerals to english numerals? I created an auction website, inputting english numbers seems to work. However when I switch languages to Arabic, it doesn't work. By casting any arabic numeral input to (int) It keeps returning 0. ١٢٣٤٥٦٧٨٩ 123456789 Hello
I have a PHP page that sends text entered by a user to our database which we use to display news. This system supports various languages but occasionally we get issues with odd characters being entered...
For example, the premade glyph for ellipsis which is normally represented by 3 .'s broke our system today
How can I check that each character is valid and within range?
These are our character ranges
ExtendedLatin_c_iLowerAlphaChar = 0x00C0;
ExtendedLatin_c_iUpperAlphaChar = 0x01FF;
Arabic_c_iLowerChar = 0x600;
Arabic_c_iUpperChar = 0x6FF;
Arabic_c_iLowerAlphaChar = 0x621;
Arabic_c_iUpperAlphaChar = 0x64A;
Arabic_c_iLowerNumericChar = 0x660;
Arabic_c_iUpperNumericChar = 0x669;
So each character must fall within one of these ranges... but I have no idea how to get the hex value of a character in PHP
Thanks
Hello, i need to validate 200 input fields if they are not empty, i have the following code where i'm stuck and i'm missing something any help is appreciated Code: [Select] if($_SERVER['REQUEST_METHOD'] == 'POST') { //print_r($_POST); foreach ($_POST as $value) { if (empty($value)){ echo 'empty'; } else { echo 'notempty'; } } } Hi People. I am trying to insert data from a form into my database. Now I have the following code to connect to the DB to update a table so I know that I can connect to the DB ok Code: [Select] <?php // this code I got from the new boston, PHP tutorial 25 in selecting a mysql db // opens connection to mysql server $dbc = mysql_connect('localhost', 'VinnyG', 'thepassword'); if (!$dbc) { die("Not Connected:" . mysql_error ()); } // select database $db_selected = mysql_select_db ("sitename",$dbc); if(!$db_selected) { die("can not connect:" . mysql_error ()); } // testing code $query="UPDATE users SET username = 'testing testing' WHERE user_id = '2'"; $result=mysql_query($query); ?> Now here is the code from my form. Code: [Select] </head> <body> <?php //include "connection_file.php" //include "config01.php" $username = "username"; $height_above = "height_above"; $mb_diff = "mb_diff"; $alternative = "alternative"; ?> <form name = 'form1' method = 'post' action='config01.php'> <table width="700" border="1" cellspacing="5" cellpadding="5"> <caption> Submit Your Airfield Details </caption> <tr> <td width="100"> </td> <td width="200">Your Name</td> <td width="200"><input type='text' name='username' maxlength='30'></td> <td width="100"> </td> </tr> <tr> <td> </td> <td>Height Above MSL</td> <td><input type='text' name='height_above'maxlength= '30'></td> <td> </td> </tr> <tr> <td> </td> <td>Mb Difference</td> <td><input type='text' name='mb_diff'maxlength='40'></td> <td> </td> </tr> <tr> <td> </td> <td>Alternative Airfield</td> <td><input type='text' name='alternative' maxlength='30'></td> <td> </td> </tr> <tr> <td> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td><input type='submit' name='submit' value='post' /></td> <td> </td> <td> </td> <td> </td> </tr> </table> </form> <?php $sql01 = "INSERT INTO users SET user_id = '', username = '$username',height_above = '$height_above', mb_diff = $mb_diff, alternative = $alternative"; $result=mysql_query($sql01); ?> </body> </html> here is the config01.php that the form refers to in the 'action' above. Code: [Select] <?php $host = 'localhost'; $username = 'VinnyG'; $password = 'thepassword'; $db_name = 'sitename'; //connect to database mysql_connect ("$host","$username","password")or die ("cannot connect to server"); mysql_select_db ("db_name") or die ("cannot select DB"); ?> Please could someone look at the above code and tell me where I'm going wrong. I can connect to the DB and update using the top script but I can't submit the form for some reason. I get a "cannot connect to server" message. Please someone help. It's been driving me crazy for the past two days. Regards VinceG http://www.microlightforum.com At the moment I collect data from an .XML file and it gets inserted into a database and it works great however the way in which the .xml files work has changed and I need to update my script to accommodate,
before everything was processed by 1x .xml file and i collected data, now its done via 2x .xml files.
So here is my current script;
<?php // INCLUDE DB CONNECTION FILE include("includes/connect.php"); // CHANGE THE VALUES HERE include("includes/config.php"); // URL FOR XML DATA $url = "https://api.eveonline.com/corp/StarbaseList.xml.aspx?keyID=".$keyID."&vCode=".$vCode.""; // RUN XML DATA READY FOR INSERT $xml = simplexml_load_file($url); // Loop Through Names $insertValues = array(); $modifiedTS = date('Y-m-d h:i:s'); foreach ($xml->result->rowset[0] as $value) { //Prepare the values $itemID = $value['itemID']; $typeID = mysql_real_escape_string($value['typeID']); $locationID = $value['locationID']; $moonID = $value['moonID']; $state = mysql_real_escape_string($value['state']); $stateTimestamp = mysql_real_escape_string($value['stateTimestamp']); $onlineTimestamp = $value['onlineTimestamp']; $standingOwnerID = $value['standingOwnerID']; //Create and run ONE INSERT statement (with UPDATE clause) $insert = "INSERT INTO `ecmt_poslist` (itemID,typeID,locationID,moonID,state,stateTimestamp,onlineTimestamp,standingOwnerID,last_modified) VALUES('$itemID','$typeID','$locationID','$moonID','$state','$stateTimestamp','$onlineTimestamp','$standingOwnerID','$modifiedTS') ON DUPLICATE KEY UPDATE state='$state', stateTimestamp='$stateTimestamp', onlineTimestamp='$onlineTimestamp', last_modified = '$modifiedTS'"; mysql_query($insert) or die(mysql_error()); //ERROR CHECKING OPTION ONLY! //echo $insert; //echo "<br><br>"; }; //UPDATE last time this script ran and insert timestamp into Database $timeNow = date('Y-m-d H:i:s', strtotime('-1 hour')); $insertTime = "UPDATE `ecmt_API` SET time=1, time='$timeNow'"; mysql_query($insertTime) or die(mysql_error()); //Run query to delete records that were not just inserted/updated $delete = "DELETE FROM `ecmt_poslist` WHERE last_modified < '$modifiedTS'"; mysql_query($delete) or die(mysql_error()); ?>and here is the wiki page about the .xml file and its data; http://wiki.eve-id.n...tarbaseList_XML i now need it to collect more data from a 2nd .xml file but the url will include the $itemID of the items pulled by the above script; http://wiki.eve-id.n...rbaseDetail_XML now i guess i need to put the code in the above foreach loop so I can say for each $itemID gather data from the second .xml file and input into a seperate table in my database named: `ecmt_poslistdetails` but i have no idea where to start as the rowset and layout of the 2nd .xml file is different, can anyone help me.. i'm not even sure if I wrote out this post to make sense from someone looking in from outside or not. its hard to explain. but hopefully the links provided will help. Ultimately I hope to have 2 tables in my database ecmt_poslist and ecmt_poslistdetails both containing the data from the above 2x .xml files. This has been bothering me for a while, how do I do this? echo (" <form method = 'get' action = 'member.php?action=Search&option=faction&name=NAME'> Faction's Name: <input type='text' name='member' /><br /><br /> <input type='submit' value='Search' /> </form> "); name='member' is supposed to be sent with he member.php?action=Search&option=faction&name=NAME. Obviously replacing NAME with the input. Guys, quick one. Im writing a script for a form to post info into a MySql table. Now rather than just having a single row for input I'd like to have lets say 10 rows, so I can add 10 records to the database. What I'm pondering is 2 things: 1: can i just repeat Code: [Select] <input type="text" name="opponent" size="27" /> over and over, or is it going to need its own name each time for example; Code: [Select] <input type="text" name="opponent2" size="27" /> <input type="text" name="opponent3" size="27" /> 2: when it comes to the processing script is it more economical to have the forms input field named the same over and over (if it IS possible) and if not whats the most econimcal way to code my Code: [Select] $opp= $_POST['opponent']; $query="INSERT INTO fixtures (match_date, season, opponent) VALUES ('$date', '$season', '$opp',)"; Your help and comments are appreciated as always guys Tom I've been poking around online for about a day now trying to find a good way to do the following: I have an "order" I'm reading in from a MySQL database (not completely relevant, but just fyi). And, for this order there are a number of "parts" (automotive parts) that have been ordered. For each part there is data pertaining to the quantity of parts that have been ordered and the number of parts that have been allocated (based on our inventory) and then a third column that has the number of parts still in that order that are still to be allocated at a future date. Basically, I'm displaying this data in a form with each row having a checkbox to the far left. What I want to do is allow the user to check any number of check boxes. If a check box is checked the form should submit all of the input text boxes for that row (the user can update the quantities) that I talked about in the second paragraph for that "part" (each part is displayed in a row and has a checkbox). Unfortunately, most of the examples I found for checkboxes in a form submit a specific value (like a number of a letter). I need the form to submit the values that are in the textboxes. So basically, I'm thinking I need the page to update a PHP object whenever the value of a textbox is changed and then when the user clicks a button it will send the php object for each checked row through GET or POST. But, how would I get it to onchange update a PHP object (the PHP object would need to be a 2-D array where the first index allows you to select the part and the second index allows you to select which quantity you will change). I'm thinking I would need to call a script from the onchange like: onchange="somePHPfunction(partNumberIndex, whichQuantityI'mChanging, currentValueOfThatQuantity)" but of course that would require me to embed some php inside the onchange call since the partNumberIndex and whichQuantity are PHP variables.. Any ideas on how to do this sort of thing? Or any ideas on how to do this differently? I'm trying to avoid javascript because it would place a javascript constraint on the users. But, maybe there's no other way to do this sort of thing? Any help would be greatly appreciated! I have a 'subscribe' form on a website that uses Ajax to validate the input fields, the form is then processed via php. The actual html code resides on a Wordpress page.
I had actually just got the form to work again. The website was static, and I transferred everything over to Wordpress, and the form didnt work. I was able to get it working by specifying the url: in ajax, as an absolute path to my php form. Overnight, something, I'm not sure what, stopped the form from processing. No data is posted to myql, and no email is sent or received. The status message just hangs at "Please wait while we process your information..." This message is in part of my Ajax code, so I am thinking something is wrong with my php script. I have a 'contact' page that uses nearly identical code that the 'subscribe' pages uses to validate the input fields, and it works.
I was able to recover both the ajax and php script from an earlier time when they did work, I uploaded back to my server and nothing, the form still does not process. I also made sure my database credentials were correct with my host, and even tested my connection to mysql which I was able to connect. Next, I made sure I was able to send mail with my host.
I don't know what is causing the form to hang, and I would love to get this solved; any help would be appreciated! As a complete newbie to php and webdesigning i have a following problem.I would like to retrieve the data from database and display it in a drop down menu.Then i should allow the user to select the values from drop down list along with other details,in other words i have to embed the drop down output as the form input for the user and store the form data in another table.I am running a xampp server and i am using php 5.4 version.Please help.My code is as follows.In this case project_name is displayed as the drop down output.but how do i use the same drop down output as a input in the form. <html> <head></head> <body> <?php error_reporting(E_ALL ^ E_DEPRECATED); include 'connect.php' ; $tbl_name="projects"; $sql="SELECT project_name FROM $tbl_name "; $result=mysql_query($sql); if($result === FALSE) { die(mysql_error()); } ?> <form name="resources" action="hourssubmit.php" method="post" > <?php echo "<select name='project_name'>"; while ($row = mysql_fetch_array($result)) { echo "<option value='" . $row['project_name'] ."'>" . $row['project_name'] ."</option>"; } echo "</select>"; ?> </form> </body> </html> Is there any way to disable the "A non-numeric value encountered" warning in the php.ini file? I don't get that warning on my Apache server but I do when I use the same code on my web host's server. I never got the warning until I uploaded a two line php.ini file to my web host so that I could keep my sessions longer than the default 24 minutes. This is the same online program related to my earlier post about too many inputs. I wanted to try sessions for a 24 hr. period but I'm getting tons of errors for any field that is not used which can be in the hundreds. If I delete my php.ini file from my web host & just let things default to whatever they are using then I don't get those errors, I use a simple machines forum and want to combine a table I have and a smf table and I need the dates in a numberic format(like smf uses). Sooo ... how do I get the time in a format like this 1336392447 Thanks Hi, I have a page that lists the names of the Artists in one column, and the title of their song in the next column. I've included a sort section that allows users to view the artist (with the corresponding title) that starts with whatever letter they press. I've now come to a point where I need to add in a check for numbers. (View attached image to understand what we're talking about) So if the artist name starts with any number between 0-9, it will be shown in order on the page once a user clicks on "#". I've tried doing it various ways, but can't seem to get it just right. Here is the code (I took out all my attempts to get the numeric sort working): <?php session_start(); include_once('inc/connect.php'); if (isset($_SESSION['username'])){ $loginstatus = "logout"; } else{ $loginstatus = "login"; } if(!isset($_SESSION['sort_counter'])) {$_SESSION['sort_counter'] = 1;} if(($_SESSION['sort_counter']%2) == 0){ //test even value $sortcount = "DESC"; }else{ //odd value $sortcount = ""; } $result = mysql_query("SELECT * FROM sheets ORDER BY artist"); $sheetscount = mysql_num_rows($result); $sortletteris = $_GET['letter']; $downloadclick = $_GET['downloadclick']; $show = $_GET['show']; $today = date("Y-m-d"); ?> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html lang="en-US" xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml"> <head> <link rel="stylesheet" type="text/css" href="styles/style.css" /> </head> <body bgcolor="#343331"> <!-- Header --> <div id="header"> <div id="headerleft"></div> <div id="headermiddle"><a href="index.php"><img src="img/logo.png"></a></div> <div id="headerright"> </div> </div> <!-- Content Top --> <div id="contenttop"> <div id="links"> <!-- 92x30 --> </div> </div> <!-- Content Middle --> <div id="contentmiddle"> <div id="content"> <div id="sort"> <?php echo "<center>".$sheetscount." Sheets Available<br />"; echo "<a href='newlyadded.php'>New Sheets</a><span> | </span><a href='request.php'>Request a Sheet</a></center>"; $letters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; echo "<center><div id='letters'>"; $i = 0; while ($i<26){ $sortletter = $letters[$i]; echo "<a href='index.php?letter=".$i."'>".$letters[$i]." </a>"; $i += 1; } echo " <a href='index.php'>All</a></div></center>"; if (($sortletteris)!=""){ // The letter that was clicked is set to this variable $mysortletter = $letters[$sortletteris]; //echo $mysortletter; // lname LIKE '$letter%' $result = mysql_query("SELECT * FROM sheets WHERE artist REGEXP '^[$mysortletter]' ORDER BY artist $sortcount"); $_SESSION['sort_counter'] = $_SESSION['sort_counter'] + 1; //increment after every run } elseif (($sortletteris)==""){ $result = mysql_query("SELECT * FROM sheets ORDER BY artist $sortcount"); $_SESSION['sort_counter'] = $_SESSION['sort_counter'] + 1; //increment after every run } $greenboxleft = "greenboxleft"; $greenboxright = "greenboxright"; $grayboxleft = "grayboxleft"; $grayboxright = "grayboxright"; $colorvalue = 0; echo "<br /><table width='600px' align='center' style='border-collapse:separate; border-spacing:0px;'><th style='background-color: #cccccc; border-bottom-style: solid; border-color: #6aa504;'>Artist</th><th style='background-color: #cccccc; border-bottom-style: solid; border-color: #6aa504;'>Title</th>"; while($row = mysql_fetch_array($result)) { if(($colorvalue%2)==0){ $styleleft = $greenboxleft; $styleright = $greenboxright; } else{ $styleleft = $grayboxleft; $styleright = $grayboxright; } echo "<tr>"; echo "<td align='center' width='250' id='$styleleft'><div id='songsboxleft'>". ucwords($row['artist']). "</div></td>"; echo "<td align='center' width='250' id='$styleright'><div id='songsboxright'><a target='_blank' name='downloadclick' href='".$row['url']."'>" .ucwords($row['title']). "</a></div></td>"; echo "</tr>"; $colorvalue++; } echo "</table>"; ?> </div> </div> </div> <!-- Content Bottom --> <div id="contentbottom"> </div> </body> </html> Is there an easy way to find a numeric value in a string if I don't know what the string will contain? For example I want '52' out of: mystring52 Hopefully there is already a simple function to do this? I'm thinking there may not be as the string having more than one group of numbers may confuse matters. I'm just dealing with abcdef123 or similar in this case though. Looking for ideas and advise on this one. I want to take a 10 digit number and 1234567890 and format it like 132-456-7890 what would be my best bet as choice of methods to do this? Hi. I want to build a SQL string based on my form fields so when I have a new field in the db, I can just add a new form field and the sql update will automatically work. For example I have:
<input type=text name=t_something> <input type=text name=d_something> <input type=text name=n_something>(post submission) $data = array(); foreach ($_REQUEST AS $key=>$val) { if (substr($key, 0, 2) == "t_") $data[substr($key, 2, strlen($key)-2)] = $val; if (substr($key, 0, 2) == "n_") $data[substr($key, 2, strlen($key)-2)] = (trim($val)==""?"0":$val); if (substr($key, 0, 2) == "d_") $data[substr($key, 2, strlen($key)-2)] = (trim($val)==""?"NULL":date("Y-m-d", strtotime($val)); } $data["posted"] = "NOW()"; $sql = "INSERT INTO table ("; $cnt = 0; foreach ($data AS $key=>$val) { $cnt++; $sql .= $key . (($cnt < count($data))?", ":""); }
Morning !
I've tried a number of things but not able to sort out the error ..anyone see why I am getting the non well formed numeric error?
TIA
Hi, My errorlog keep spamming the following errormsg: "PHP Notice: A non well formed numeric value encountered on line 365". This is the code it refers to: Code: [Select] for ($yr = $year, $age = -1; mktime(0, 0, 0, $month, $day, (int)$yr) < $today; $yr++, $age++); It's supposed to calculate the owner of the page's age. The full code is: Code: [Select] list($year,$month,$day) = explode("-", $birthday); $tempVar=list($year,$month,$day) = explode("-", $birthday); $today = time(); for ($yr = $year, $age = -1; mktime(0, 0, 0, $month, $day, (int)$yr) < $today; $yr++ |