PHP - Storing And Printing Variables

I am by no means a security expert, but I would like to know if storing MySQL database information in an environment variable would be a good or bad idea. What are your thoughts?

I have 64 rows of players and want each User to be able to choose to bookmark an player, as well as unbookmark it too.

I have a bookmark table set up, and each time a User decides to bookmark(+) or unbookmark(-) an player a row is created in the data table.   (Matching the player ID and User ID) That's working fine.  

A query reads the most recent row for each player to determine if there is a + or - button next to each player.  Testing the query and adding some dummy data, that part of it works too.  However, the issue is the initial state, which I want to be a +.  Once I go live, the table will be empty, nothing for the query to return/produce.

How do I create an initial state of a + with no rows and have it not used or swapped out when Users start clicking + or -?

 

  $query = "SELECT b.id, bookmark,playerID,userID,p.id 
                FROM a_player_bookmark b
                LEFT JOIN a_players p
                ON '". $id ."' = playerID
                WHERE userID = '". $userID ."'&&'". $id ."' = playerID
                ORDER BY b.id desc
                LIMIT 1
                ";

    $results = mysqli_query($con,$query);
    echo mysqli_error($con);
    while($row = mysqli_fetch_assoc($results)) {    

    echo $row['bookmark'];

        if($row['bookmark'] == 0) {
            echo '-'; // this is where a form goes to remove a bookmark
        }       
        else {
            echo '+'; // this is where a form goes to add a bookmark
        }

    }   

I tried to get it with CASE, but I don't think that's the right path.  I also looked at UNION.  I was able to get it to produce an initial state of +, but it still printed the already made up sample data too (so I have three instances of ++ or +-).

 (Players 2, 4 and 4)

 

Here is the what the UNION query looked like:

	$query = "(SELECT b.id, bookmark,playerID,userID,p.id 
				FROM a_player_bookmark b
				LEFT JOIN a_players p
				ON '". $id ."' = playerID
				
				WHERE userID = '". $userID ."'&&'". $id ."' = playerID
				ORDER BY b.id desc
				LIMIT 1)
			UNION
				(SELECT b.id, bookmark,playerID,userID,p.id 
				FROM a_player_bookmark b
				LEFT JOIN a_players p
				ON '". $id ."' = playerID
				
				WHERE userID = '". $userID ."'
				ORDER BY p.id desc
				LIMIT 1) 
				";

 

does anyone know how to decode this XML variable value into string values? I also need to know the oposite way: creating variable values into xml. I've tried several code examples but they did filter the requested data.

Code: [Select]
$xml='<?xml version="1.0" encoding="utf-8"?>
<elements>
<text identifier="ed9cdd4c-ae8b-4ecb-bca7-e12a5153bc02">
  <value/>
</text>
<textarea identifier="a77f06fc-1561-453c-a429-8dd05cdc29f5">
  <value><![CDATA[<p style="text-align: justify;">Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.</p>]]></value>
</textarea>
<textarea identifier="1a85a7a6-2aba-4480-925b-6b97d311ee6c">
  <value><![CDATA[<p style="text-align: justify;">Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy  eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed  diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum.  Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor  sit amet.</p>]]></value>
</textarea>
<image identifier="ffcc1c50-8dbd-4115-b463-b43bdcd44a57">
  <file><![CDATA[images/stories/red/cars/autobedrijf.png]]></file>
  <title/>
  <link/>
  <target/>
  <rel/>
  <lightbox_image/>
  <width><![CDATA[250]]></width>
  <height><![CDATA[187]]></height>
</image>
<text identifier="4339a108-f907-4661-9aab-d6f3f00e736e">
  <value><![CDATA[Kramer 5]]></value>
</text>
<text identifier="ea0666d7-51e3-4e52-8617-25e3ad61f8b8">
  <value><![CDATA[6000 RS]]></value>
</text>
<text identifier="90a18889-884b-4d53-a302-4e6e4595efa0">
  <value><![CDATA[Eindhoven]]></value>
</text>
<text identifier="410d72e0-29b3-4a92-b7d7-f01e828b1586">
  <value><![CDATA[APK Pick up and return]]></value>
</text>
<text identifier="45b86f23-e656-4a81-bb8f-84e5ea76f71f">
  <value><![CDATA[15% korting op grote beurt]]></value>
</text>
<text identifier="3dbbe1c6-15d6-4375-9f2f-f0e7287e29f3">
  <value><![CDATA[Gratis opslag zomerbanden]]></value>
</text>
<text identifier="2e878db0-605d-4d58-9806-8e75bced67a4">
  <value><![CDATA[Gratis abonnement of grote beurt]]></value>
</text>
<text identifier="94e3e08f-e008-487b-9cbd-25d108a9705e">
  <value/>
</text>
<text identifier="73e74b73-f509-4de7-91cf-e919d14bdb0b">
  <value/>
</text>
<text identifier="b870164b-fe78-45b0-b840-8ebceb9b9cb6">
  <value><![CDATA[040 123 45 67]]></value>
</text>
<text identifier="8a91aab2-7862-4a04-bd28-07f1ff4acce5">
  <value/>
</text>
<email identifier="3f15b5e4-0dea-4114-a870-1106b85248de">
  <value/>
  <text/>
  <subject/>
  <body/>
</email>
<link identifier="0b3d983e-b2fa-4728-afa0-a0b640fa34dc">
  <value/>
  <text/>
  <target/>
  <custom_title/>
  <rel/>
</link>
<relateditems identifier="7056f1d2-5253-40b6-8efd-d289b10a8c69"/>
<rating identifier="cf6dd846-5774-47aa-8ca7-c1623c06e130">
  <votes><![CDATA[1]]></votes>
  <value><![CDATA[1.0000]]></value>
</rating>
<googlemaps identifier="160bd40a-3e0e-48de-b6cd-56cdcc9db892">
  <location><![CDATA[50.895711,5.955427]]></location>
</googlemaps>
</elements>';

Hey guys,
What would you recommend to store db values for later?

the only thing I can come up with is doing it this way:

$result = mysql_query("SELECT * FROM users WHERE name='$user'");
while($row = mysql_fetch_array($result))
{
}
  {
and then using the $row['dbvariable'] later

is that the best way?

Hi, when a user logs out, I want to store the last activity in for the user. I have a db table users:

userID  userName  userPassword lastSession     lastActivity
=====  =======  ==========  ========    =======
1            bob            password         2011-08-09   About.html
2            dre             passwords       2011-09-23   Home.php


here is logout script:
===============
Code: [Select]
<?php
//run this script only if the logout button has been clicked
if(array_key_exists('logout', $_POST)) {
        require("connect.inc");
$username=$_POST["username"];
$updateLastSessionQuery=mysql_query("UPDATE users SET lastSession=NOW() WHERE userName='$username'");

// end session and redirect
//empty the $_SESSION array
    $_SESSION = array();

    session_destroy();
header("Location: xmlShredderLogin.php");  
    exit;
}//END IF for when logout submitted
?>

here is Index.php:
=============
Code: [Select]
<?php
session_start();
if(isset($_SESSION["isAuthenticated"])) {
require("logout.inc.php");
$username=$_POST["username"];
//print $username."<br />";
print '
<html>
<head><title>Home</title></head>
<body>
<form id="logoutForm" name="logoutForm" method="post" action="">
<input name="logout" type="submit" id="logout" value="Log out" />
<input type="hidden" name="usernameHidden" value='; print$username; print '/>
</form>';
mysql_connect("localhost","root");
mysql_select_db("someDB");
$getUserInfoQuery=mysql_query("SELECT lastSession,lastActivity FROM users WHERE userName='$userName'");
$getUserInfo=mysql_fetch_assoc($getUserInfoQuery);
print "Last session: ".$getUserInfo["lastSession"]."<br />";
print "Last activity: ".$getUserInfo["lastActivity"]."<br />";


Let's say the last page the user is on is Index.php, so what do I use to track the last page they are on?? I can't user a form b/c if I have to type in the last activity, that's nonsense! So far I have only figured out how to store the current time in last session (but this doesn't work either).

I just want to track the last page and then have a switch such as:
switch(type)
case 1:
$lastActivity="About.html";
case 2:
$lastActivity="somethingelse.php";


Any help much appreciated!

Code: [Select]
<?php $going='';
$name='<span id="name"></span>';
echo "$name";      //results : stevengoh   ---     wanted 
$going=substr($name, 1, 17);
echo "$name";   //results : <span id="going">     ----       don't want
?>
Is it possible to store in php the results of variable id="going" javascript instead of <span id="going"></span>?.

Hi,
I am struggling with a form in php. I am trying to add a form by using the include function. I want to include thsi form on all pages so it would be very useful if I can save the current page name somewhere so that I can use to validate the form.

For example, this is the form I am trying to include.

<?php
if(!empty($errors))
{
if(isset($errors['sendError']))
{
echo '<p><strong class="error">There was a problem with our system please contact us directly.</strong></p>';
}
else
{
echo '<p><strong class="error">Please check the form below for errors.</strong></p>';
}
}
?>
<form action="index.php" method="post" id="form1">
<p>
<label><?php if(isset($errors['name'])) { echo '<span class="error">'; } ?>Name<font color="red">*</font>: <?php if(isset($errors['name'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['name']; ?>" name="name" size="60" align="right" style="background:#EEF5A4" />

<label><?php if(isset($errors['company'])) { echo '<span class="error">'; } ?>Company: <?php if(isset($errors['company'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['company']; ?>" name="company" size="60" align="right" />

<label><?php if(isset($errors['phone'])) { echo '<span class="error">'; } ?>Phone Number: <?php if(isset($errors['phone'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['phone']; ?>" name="phone" size="60" align="right" />

<label><?php if(isset($errors['email'])) { echo '<span class="error">'; } ?>Email<font color="red">*</font>: <?php if(isset($errors['email'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['email']; ?>" name="email" size="60" align="right" style="background:#EEF5A4" />

<label><?php if(isset($errors['enquiry'])) { echo '<span class="error">'; } ?>Enquiry: <?php if(isset($errors['enquiry'])) { echo '</span>'; } ?></label>
<textarea id="search1" id="complete" textarea name="enquiry" rows=4 cols=40 value="<?php echo $form['enquiry']; ?>" name="enquiry" size="60" align="right"></textarea>
</p>
<p>
<input type="submit" class="formbutton" value="Submit" />&nbsp;<input type="reset" class="formbutton" value="Reset" />
</p>
<p><font color="red">*</font> Denotes a required field</p>
</form>

Because I am going to use this form on all pages, I would like it to include whatever the filename is rather than index.php in the first line of the form so that when the user clicks submit, it will stay on the same page but validate the form based on the mandatory fields.

I don't know if the question is clear. I would very much appreciate any help at all.

Thank you very much.

Hi, i would like to know what is the best method to store a picture. Currently what happens, is each user has a different avatar, which when uploaded comes in a folder called Avatar, in my website folder and is also stored as a BLOB in mysql. I would like to know is this ok to store all avatars in one folder or some other step should be used and if so could some one guide me to a good tutorial. As I would also like to make an option, where people could upload their pictures, is it safe to store pictures in the same folder for all users or some how create a different folder for each user.

Can anyone tell me whats wrong with this:

The file uploads fine, the url however does not get posted to the database?
I added a 'or die' but it didn't execute...Do I need to move the query higher up the script?

<?php
include ('base.php');
$id = $_GET['id'];

if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg"))
&& ($_FILES["file"]["size"] < 20000))
  {
  if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "imgs/pictures/" . $_FILES["file"]["name"]);
      echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
      }
    }
  }
else
  {
  echo "Invalid file";
  }
$file = $_FILES["file"]["name"];
 $sql = "UPDATE `chillp_security`.`staff` SET `picture` = \'imgs/pictures/$file\' WHERE `staff`.`id` = $id;";
?>

Im making a application but many users can access it at the same time, also the data that needs to be stored into the database in 3 parts firstly the user will enter some details the comany will fill out the reamining details and the user will then accept or decline the companies proposal. The issue im havign will it be easier to just store all of this information into session variables and then save them into the database at the end when all of the details are ready ?

Thank You

So, on my website, i have added a "last active" feature, so if someone is surfing the site, they can view when another users last page visit was.

so, every second, +1 is added to the $ts variable

what i have now, working and all, shows ONLY "NOW!", or ONLY "1 second", ONLY "___ seconds ago"... and so on

I have tred over, and over, and over to fix this to my liking, with more instances available, as an example, my current script will show somebody who is 13 months and 26 days inactive, just as "1 year", i want to see the "1 year, 1 month, and 26 days inactive"... or even simpler, just so it displays days/minutes/seconds/NOW!


function howlongtil($ts) {
   $ts=$ts - time();
   if ($ts<1)
       // <1 second
       return " NOW";
   elseif ($ts==1)
       // <1 second
       return $ts." second";
   elseif ($ts<60)
       // <1 minute
       return $ts." seconds";
    elseif ($ts<120)
       // 1 minute
      return "1 minute";
   
    elseif ($ts<60*60)
       // <1 hour
       return floor($ts/60)." minutes";
   elseif ($ts<60*60*2)
       // <2 hour
       return "1 hour";
     elseif ($ts<60*60*24)
       // <24 hours = 1 day
       return floor($ts/(60*60))." hours";
     elseif ($ts<60*60*24*2)
       // <2 days
       return "1 day";
     elseif ($ts<(60*60*24*7))
       // <7 days = 1 week
         return floor($ts/(60*60*24))." days";
   elseif ($ts<60*60*24*30.5)
       // <30.5 days ~  1 month
       return floor($ts/(60*60*24*7))." weeks";
     elseif ($ts<60*60*24*365)
       // <365 days = 1 year
       return floor($ts/(60*60*24*30.5))." months";
   else
       // more than 1 year
       return floor($ts/(60*60*24*365))." years";
};


anyone know how?

Alright, the register/login system is fully working with sql injection, BUUUT now I want to store their IP Address. WHOLE new function that I've never dealt with before. So I need some help. Am I doing something wrong?

I have the IPadd in the database as INT(10) and then I went down to another drop down list and hit unsigned.
I feel like I'm doing something wrong with the field in the database..

{
$_SERVER['REMOTE_ADDR'] = $IPadd;
$sql = "INSERT INTO Member (username,createDate,password,firstName,email,IPadd) VALUES ('$username',NOW(),md5('$password'),'$firstName','$email',inet_aton('$IPadd'))";
mysqli_query($cxn,$sql);
$_SESSION['auth']="yes";
$_SESSION['username'] = $username;
header("Location: testing.php");
}

Let's see if I can explain this ok.. Basically I have a site and the page product categories use dynamically created URL's. I want to use these URL's to put on my products so I can list all the categories each product is in. But, as these URL's are not stored anywhere I'm not sure how to go about calling them. Is the best way going to be to modify the site to store the page URL's in MySQL? Or could they be stored within variables in PHP? A little guidance would be great! Thanks in advance 

Hi Guys.

I need your help. Is it possible to store results from sql query as a variable. I am basically doing a few joins to get this result and I wanted to know if this was possible.

Hi guys, hoping for some help here.

I've a database created with a website. I recently got help here off Muddy Funster who was a MASSIVE help to me on this thread - http://www.phpfreaks.com/forums/index.php?topic=357580.new;topicseen#new

I've another slight problem with what I am trying to do. At the moment the user can search for an ID and it brings up the relevant information.

What I am doing now is that the user has entered the ID, their taken to the results where they can be viewed. What I have added is a form at the bottom of the results page, which has to be filled in and saved. I thought this would be relatively easy. I have the form storing in the database, but there is one problem, its being added as another document! So instead of clicking save and the information being added to the ID that is already associated with it, it is incrementing the ID in the database and being stored separately to the ID that was searched.

Could anyone give any help as to why this might be happening? I have on the button 'Save' click, it goes to another php file and inserts the data to the relevant fields, I'm not sure why it is incrementing the ID separately instead of just saving to the ID that it is associated with 

I don't no if I'm making it clear enough but what I wanted to do was save the form they filled out with the ID that was searched if you get me?

Thanks for any help