PHP - How To Avoid Overwritting Variable Value

Trying to make my code more secure.

This is what I currently have, which is not secure by any means:

Code: [Select]
$query1 = "SELECT COLUMN_NAME, DATA_TYPE, ORDINAL_POSITION, COLUMN_DEFAULT, CHARACTER_MAXIMUM_LENGTH, IS_NULLABLE
  FROM INFORMATION_SCHEMA.COLUMNS
  WHERE TABLE_NAME='$table'";
 
// Run PRO query

$qresult1 = sqlsrv_query($dbPRO, $query1);
if ($qresult1 === false) {
    exitWithSQLError('Retrieving schema failed.');
}
This is how I changed it,

Code: [Select]
$query1 = "SELECT COLUMN_NAME, DATA_TYPE, ORDINAL_POSITION, COLUMN_DEFAULT, CHARACTER_MAXIMUM_LENGTH, IS_NULLABLE
  FROM INFORMATION_SCHEMA.COLUMNS
  WHERE TABLE_NAME=?";
$params = array(1, $table);
 
// Run PRO query
$qresult1 = sqlsrv_query($dbPRO, $query1, $params);
if ($qresult1 === false) {
    exitWithSQLError('Retrieving schema failed.');
}
but I'm getting this error:

Code: [Select]
SQL-Status: 22018
Code: 245
Message: [Microsoft][SQL Server Native Client 10.0][SQL Server]Conversion failed when converting the nvarchar value 'sysrscols' to data type int
Please notice I am using sqlsrv_query function because my database engine is MS-SQL 2008. That's why I'm a bit confused. Most documentation online is pointed to MySQL.

exitWithSQLError is a customized function of mine, so please ignore. 

Any help or hints is appreciated,

Thanks,

I'm just looking for some tips here. I am developing and selling an eccommerce shopping cart software package, and it has been received very well from the early adopters. There's just one small problem that prevents the software from being a truly out-of-the-box solution: the include path. Not all users have access to their php.ini file, and it's not always a php.ini file anyway. So this is something the installation is unable to set for the customer.

I'm using object-oriented PHP5 stuff, so I have a folder named "classes" with all the relevant stuff in there. I am unable to search for paths to the folder and hard-code those into source files (there are ajax calls and other fun stuff; hard to know the exact relation to the path).

I guess I could use set_include_path on the top of a bunch of files, but that is a small performance hit (and totally inelegant code). I could put the folder path in the database somewhere and query for it (and cache it so it's not a performance hit). None of this stuff seems good. The path seems like the best solution.

Unless you have better ideas....

I'm learning functions and I'm working on a rating script. This is a small test script that works, you can try it out yourself:


<?php

// Rating System

function while_test (){

$a = 1;
$b = 4;
$t_id = 1;

global $likes;

global $dislikes;

global $con_id;

while ($a++ <= $b){

echo "<center>";

echo "<table><tr><td>Table: </td></tr>";

echo "<tr><td>This is a table test </td></tr>"; 

echo "<tr><td><form action='' method='post'>";

echo "<button type='submit' name='likes' value='Y'>likes</button>";

echo "<button type='submit' name='dislikes' value='N'>dislikes</button>";

echo "<input type='hidden' name='hidden_id' value='" . $t_id . "' /></form></td></tr></table>"; 

echo "</center><br /><br />"; 

$t_id++;

$likes = $_POST['likes'];

$dislikes = $_POST['dislikes'];

$con_id = $_POST['hidden_id'];

}

}



while_test();


if ($likes) {

echo "likes it: " . $likes . " con_id: " . $con_id;

} elseif ($dislikes) {

echo "dislikes it: " . $dislikes . " con_id: " . $con_id;

}

?>


I've gotten recommended before not use globals, because the projects would become unmanageable, and I'm wondering how would I be able to avoid using globals in this example?

I'm able to in-ject variables through the parenthesis, but I'm not able to out-ject variables, if that makes sense. (?)
At least it doesn't work for me.

How would I use those three variables $likes, $dislikes and $con_id outside the function without setting them as globals, what would be good practice?

I have a sorting functionality, the code is he


<?php

$select_category = $_REQUEST['sort_category'];

$sort_date_var = $_REQUEST['sort_date'];

$sort_submit = $_POST['sortSubmit'];

// Connect to the database 
$dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

if (($select_category == 'All') || (!isset($select_category)) && (!isset($sort_date_var))) {

// Retrieve the chosen category from MySQL

$query

= "SELECT * FROM con";

$data = mysqli_query($dbc, $query);

//Loop through the array of data

while ($row = mysqli_fetch_array($data)) 

{

echo "<table class='knuffixTable'>";

// Display the score data

echo "<tr><td class='knuffix_name'>";

echo "<strong>" . htmlentities($row['name']) . "</strong><br /></td></tr>";

echo "<tr><td class='knuffix_contribution'><pre>" . $row['contribution'] . "</pre><br /></td></tr>";

echo "<tr><td class='knuffix_categoryDate'>" . $row['category'] . " | " . date('M d, Y', strtotime($row['contributed_date'])) . " </td></tr>";

echo "</table>";

}

mysqli_close($dbc);

} elseif (isset($select_category) && !isset($sort_date_var)) {

// Retrieve the chosen category from MySQL

$query = "SELECT * FROM con WHERE category = '$select_category'";

$data = mysqli_query($dbc, $query) or die (mysqli_error($dbc));

//Loop through the array of data

while ($row = mysqli_fetch_array($data)) 

{

echo "<table class='knuffixTable'>";

// Display the score data

echo "<tr><td class='knuffix_name'>";

echo "<strong>" . htmlentities($row['name']) . "</strong><br /></td></tr>";

echo "<tr><td class='knuffix_contribution'><pre>" . $row['contribution'] . "</pre><br /></td></tr>";

echo "<tr><td class='knuffix_categoryDate'>" . htmlentities($row['category']) . " | " . date('M d, Y', strtotime($row['contributed_date'])) . " </td></tr>";

echo "</table>";

}

mysqli_close($dbc);

} elseif (!isset($select_category) && isset($sort_date_var)) {

// Retrieve the chosen category from MySQL

$query = "SELECT * FROM con ORDER BY contributed_date $sort_date_var";

$data = mysqli_query($dbc, $query) or die (mysqli_error($dbc));

//Loop through the array of data

while ($row = mysqli_fetch_array($data)) 

{

echo "<table class='knuffixTable'>";

// Display the score data

echo "<tr><td class='knuffix_name'>";

echo "<strong>" . htmlentities($row['name']) . "</strong><br /></td></tr>";

echo "<tr><td class='knuffix_contribution'><pre>" . $row['contribution'] . "</pre><br /></td></tr>";

echo "<tr><td class='knuffix_categoryDate'>" . htmlentities($row['category']) . " | " . date('M d, Y', strtotime($row['contributed_date'])) . " </td></tr>";

echo "</table>";

}

mysqli_close($dbc);

} elseif (isset($select_category) && isset($sort_date_var)) {

// Retrieve the chosen category from MySQL

$query = "SELECT * FROM con WHERE category = '$select_category' ORDER BY contributed_date $sort_date_var";

$data = mysqli_query($dbc, $query) or die (mysqli_error($dbc));

//Loop through the array of data

while ($row = mysqli_fetch_array($data)) 

{

echo "<table class='knuffixTable'>";

// Display the score data

echo "<tr><td class='knuffix_name'>";

echo "<strong>" . htmlentities($row['name']) . "</strong><br /></td></tr>";

echo "<tr><td class='knuffix_contribution'><pre>" . $row['contribution'] . "</pre><br /></td></tr>";

echo "<tr><td class='knuffix_categoryDate'>" . htmlentities($row['category']) . " | " . date('M d, Y', strtotime($row['contributed_date'])) . " </td></tr>";

echo "</table>";

}

mysqli_close($dbc);

}

?>



With this code I'm able to:
- showcase every category by DEFAULT when someone comes to the page.
- sort only by category,
- sort only by date,
- sort by category AND date,

The problem is as you can see I have a lot of duplicate code, if I for example want to change the table that is being printed out, I have to change it on all of them. I'd like to ask how I could avoid this duplicate code. Can I for example just have the table ONE TIME at a separate place and then insert the REFERENCE _after_ the query in each if statement?

Like this:


if (($select_category == 'All') || (!isset($select_category)) && (!isset($sort_date_var))) {

// Retrieve the chosen category from MySQL

$query

= "SELECT * FROM con";

$data = mysqli_query($dbc, $query);

table_here();

} elseif (isset($select_category) && !isset($sort_date_var)) {

// Retrieve the chosen category from MySQL

$query = "SELECT * FROM con WHERE category = '$select_category'";

$data = mysqli_query($dbc, $query) or die (mysqli_error($dbc));

table_here();

}



I'm just coding since 2 month so I don't know how do it, maybe I can do it with functions?

I've tried doing it with functions, but I got an error since the function doesn't contain any query statement and only the table because it was trying to fetch.

it looked like this:



function table_here () {

//Loop through the array of data

while ($row = mysqli_fetch_array($data)) 

{

echo "<table class='knuffixTable'>";

// Display the score data

echo "<tr><td class='knuffix_name'>";

echo "<strong>" . htmlentities($row['name']) . "</strong><br /></td></tr>";

echo "<tr><td class='knuffix_contribution'><pre>" . $row['contribution'] . "</pre><br /></td></tr>";

echo "<tr><td class='knuffix_categoryDate'>" . $row['category'] . " | " . date('M d, Y', strtotime($row['contributed_date'])) . " </td></tr>";

echo "</table>";

}

mysqli_close($dbc);

}

Array ( [0] => Virender Sehwag|||http://abc.xyz.com/Virender-Sehwag [1] => Sachin Tendulkar|||http://abc.xyz.com/Sachin-Tendulkar )


foreach($array as $arr) {

                $topics=explode ('|||', $array);


echo '<li>'
                        .'<a rel="nofollow" target="_new" href="'.$topics[1].'"><span class="title">'.html_entity_decode($topics[0], ENT_NOQUOTES, "UTF-8").'</span></a>|</li>';



How to avoid '|' for the last element of any aaray. Also if array contains only 1 element '|' should not appear.

For eample,

In the browser it should display as "Virender Sehwag | Sachin Tendulkar".

If the array contains only 1 element then, In the browser it should display as Virender Sehwag

if array contains 3 elements,

Virender Sehwag | Sachin Tendulkar | someword