|
PHP - Safety And Correctness Questions
Hi there,
I've got this BBCode parser and I need to make sure NOTHING can go wrong by injection or anything, as it will affect a part of the main page of a site. I'm a little confused with what happens with code when it gets cleaned, so I'm not sure if it'll work like this. So there's a textarea, and the contents of that textarea should be put in a MySQL database. So I guess this will do: Code: [Select] mysql_real_escape_string(htmlentities($string)) But how do 'enter's' get put in a database? Because the parser code is: Code: [Select] <?php function bbcode_format($str){ $str = htmlentities($str); $format_search = array( '#\[b\](.*?)\[/b\]#is', // Bold ([b]text[/b] '#\[i\](.*?)\[/i\]#is', // Italics ([i]text[/i] '#\[u\](.*?)\[/u\]#is', // Underline ([u]text[/u]) '#\[color=\#?([A-F0-9]{3}|[A-F0-9]{6})\](.*?)\[/color\]#is', // Font color ([color=#00F]text[/color]) '#\[url=((?:ftp|https?)://.*?)\](.*?)\[/url\]#i', // Hyperlink with descriptive text ([url=http://url]text[/url]) '#\[img\](https?://.*?\.(?:jpg|jpeg|gif|png|bmp))\[/img\]#i', // Image ([img]http://url_to_image[/img]) '#\[titel\](.*?)\[/titel\]#is',//titel '#\[inhoud\](.*?)\[/inhoud\]#is' ); $format_replace = array( '<strong>$1</strong>', '<em>$1</em>', '<span style="text-decoration: underline;">$1</span>', '<span style="color: #$1;">$2</span>', '<a href="$1">$2</a>', '<img src="$1" alt="" />', '<span class="mainheader">$1</span>', '<span class="inhoud">$1</span>' ); $str = preg_replace($format_search, $format_replace, $str); $str = nl2br($str); return $str; } ?> Also, is it safe to send all this information through ajax? How should it be 'cleaned' to pass through ajax and php without any trouble? Thanks in advance, arbitter Similar TutorialsIt is possible to use HTML in my input type, so I need the code to make it impossible to destroy the information in my database. I have a file on my server that I will stream to the browser: header( "Content-Description: File Transfer" ); header( "Content-Type: application/force-download"); header( "Content-Length: " . filesize( $filename ) ); header( "Content-Disposition: attachment; filename=$filename"); readfile( $filename ); $filename is going to be in a location that's not publicly available (there's no URL to it, as it's on the server, and not within public_html or subdirectories). Any safety concerns here? Basically, I'm just curious if a user has any way to steal the file or otherwise access the directory. I don't think so, but I'm just tossing this out here as a general discussion. Thanks! I've been coding PHP for some time and would consider myself to be at an intermediate level. I can write code to do what I need but it's probably not the best way to do it. I rarely see any code that I am not able to read, understand, or follow. I've created modifications for everything from vBulletin, WordPress, Kayako Support Suit, Magento, and more. However, I've never really built a strong understanding around OOP. For example, let say you have the following classes: _main - db - admin - - modules - - - dashboard How would you share the db connection with the dashboard class? I've been trying to read up on Dependency Injections and Singletons but I haven't found an article that has explained it on a level that I can understand. I get a feeling that most people who use OOP in PHP have a background in Java or C++ and are much more familiar with everything. Could someone please explain this to me in simple terms or link me to an extremely well explained article that I'd be able to understand without a background in computer science? Thanks Hello everyone, I have been doing web developing for a little while and just recently decided to make the leap to developing standalone applications. I started learning C++ and JAVA for this purpose, but quickly learned that PHP can also be used to this end, and since I am quite familiar with PHP, I thought it would make sense to start with PHP GTK. But before I jump right in, I have a few questions that I would greatly appreciate some answers for: Does PHP have any significant advantages/disadvantages over lower level languages such as C++ ? I would imagine that PHP being originally designed for web programming would be less suited for stand alones. I'm a little confused as to whether the GTK is a graphical user interphase software, the likes of QT and Netbeans, or is it a markup language like HTML, where the widgets are generated with text commands? Please I need a little clarification on that. Also are there any other tools that need to be downloaded to get started besides the GTK? Finally, am I supposed to learn OOP PHP to get going or is traditional procedural PHP sufficient? Answers to any or all of the above questions and any other advice would be highly appreciated. Thanks. Hi. I'll like to ask few questions about PHP, as I think they are related to it.
I've came across some webpages, what I've spotted is that a webpage displays content but each "page" has different argument and there is no filename.
For example:
"http://www.website.com/?home" is home-like webpage, by changing "/?home" to "/?anotherpage" land me on some other webpage on their website and so on. My question is how is it done? Is it done from PHP?
Another question I wanted to ask is.. I went on InvisionPower.Board forum (such as this PHP Freaks ). How to force "folders" to be displayed as "files"?
For example:
"http://forums.phpfre...ks-on-facebook/" which links to a thread.
Thanks in advance
Howdy, I am new to SEO. Could you please help me? 1. I like to post programming tutorials to both my website & various programming forums. Is that going to screw up my website's ranking in Google? 2. My editor of my history website who sometimes posts essays there also posts them in some history forums. Is that bad for SEO? 3. I made a Facebook page for my history website. It says there "Promote your page" basically you pay $5 for around 100 likes. Has anyone tried that? Does it work? Because $5 seems like little money for additional 100 likes which will increase the traffic considerably. Thank you so much for the help! A few questions about mod_rewrites... 1.) If I want to determine if the URL ends with either "list" or "gallery", and then take appropriate action, does the code below look correct?
RewriteRule shop/(.+)/([list|gallery])$ shop/catalog.php?category=$1&view=2 [L]
2.) Is it bad to use mod_rewrites to determine how your website branches? For example...
RewriteRule shop/music/(.*)$ go somewhere [L] RewriteRule shop/movies/(.*)$ go somewhere else [L] RewriteRule shop/books/(.*)$ go yet somewhere else [L]
I basically have a picture uploading system for users. I have two questions: 1) What CHMOD should I use for the folders that are there for uploading files to? Currently it is 755, but I want it to be accessible and safe. 2) When I use the standard mkdir() function to create folders in my main parent folder, the folders don't get created. Is this because my parent folder is CHMOD 755? Thanks This topic has been moved to mod_rewrite. http://www.phpfreaks.com/forums/index.php?topic=348665.0 This topic has been moved to Third Party PHP Scripts. http://www.phpfreaks.com/forums/index.php?topic=348384.0 So I have been slowly working on a custom forum.
I have recently been trying to implement an achievement system.
For the most part achievements would work based on the users
amount of posts
amount of characters in a post
amount of replies on a post
time past from the users join date.
I was hoping to find out how I could put an entry into a database field based on the above.
Any help would be greatly appreciated
Hey guys! im currently learning javascript, PHP and SQL. I have a pretty solid understanding of HTML and CSS. I want to make a site similar to facebook (a good facebook). this is going to be a big project and i plan on moving to a bigger server system in a year or so to keep up with demands.
Heres how the site will function:
1. Basic registration/splash page. I understand that the finished form is sent to a php file on the server side, correct? (ill change my server name files of course)
2. after the registration page, while the user is logged in with their new account, there are 3 pages after that that explain what the website is all about and how to use it. the last page allows the user to setup their profile information, ask friends to join, and asks what type of things they like. After the last page, it sends the user to their main control panel, where social media feed can be seen, friends and online chats, news, advertisements, links, pages and groups (think facebook and linkedin)
3. the user will have the ability to look at their profile (not the control panel), and of course switch back to their control panel. social media, friends, groups and ads will also be on their individual profile page as well.
4. i want the site to have two views: a standard view and an enhanced view. the enhanced view will reposition divs and all that stuff so they can see a background image (either stock or one they uploaded) this image will eventually change to an animated image of a 3d environment.
5. the site is going to be heavily social media based. This means social media feeds, image uploading, a structured comment system, a friend system, search functions and targeted advertising.
This is obviously a lot to ask, but since their is so much to learn related to PHP and SQL, can someone point me to the right tutorials on how to get these things done? I am currently learning javascript, PHP and SQL on lynda.com. Expect me to be on this forum a lot and asking a lot of questions. Thanks for any help.
Edited by PHPlearner32, 10 January 2015 - 11:19 PM. 1. If I start a new project, should I use Laravel 5.0(dev) or 4.2?
2. How easy is it to upgrade from between major version like that?
3. Any design recommendations for daily with authentication and accounts?
Good day, I have 2 questions about that. Here is the context. I have a list of items that i query from a database and insert in a table. The last field of the table is a input box to typpe in the quantity ("qty"). My first question, how can I associate the inputbox to product_id from the database for that item. Code: [Select] //database connecting is working <? while($row = mysql_fetch_array($result)) { echo "<tr><td>" . $row['product_code'] . "</td><td>" . $row['product_name'] . "</td><td><input type='text' maxlength = '3' value='0'></td></tr>"; } And my second question (any tutorial reference) about how to select only the items that the qty is not = 0 and pass it to another page either by sessions or other means. Thank you Hey again, I hope you guys don't get annoyed with my noob questions. I was reading the guide here on the site about OOP, and on the section related to inheritance it makes a "Dog" class, after giving it an attribute and a method it then creates the "Animal" class using "extends" and expands on the methods. Then after that here is the paragraph I'm looking at now. "Class Animal is unaware of the fact that it is being extended; there are no references to Dog whatsoever. Say Animal extended another class called LifeForm, and I instantiated Animal, only methods and properties of Animal and LifeForm would be included in the object." To me, this sounds like if I were to create this "LifeForm" class by further extending the "Animal" class, I would not be able to access any of the attributes and methods that were in "Dog," only the ones that were in Animal and any that I put in LifeForm itself. But, I was playing with the code and I can call an attribute from Dog in LifeForm. So, am I reading the post wrong or am I coding wrong? Code: (php) [Select] <?php //Class Dog// class Dog{ public $hungry = 'Hell yeah!'; public $test = 'Affirmative!'; function eat($food){ $this->hungry = 'not so much.'; } } //Class Animal// class Animal extends Dog{ function eat($food){ if($food === 'cookie'){ $this->hungry = 'not so much'; }else{ echo 'Barf! I only like cookies!'; } } } //Class LifeForm// class LifeForm extends Animal{ function eat($food){ } } //Program Variables// $dog = new Dog; $LifeForm = new LifeForm; //Program Code// echo $LifeForm->test; ?> My assumption was that I am able to call that attribute because of the 'public' in front of it, but all the attributes in the examples are also public. Thanks guys! Hi all, I my hunt for better coding i thought i look at some opensource CMS systems and one thing I saw in the index.php of the joomla cms was this. define('JPATH_BASE', dirname(__FILE__) ); define( 'DS', DIRECTORY_SEPARATOR ); require_once ( JPATH_BASE .DS.'includes'.DS.'defines.php' ); require_once ( JPATH_BASE .DS.'includes'.DS.'framework.php' ); Are they using DS to make it work on any platform instead of using a / or a \ ? Also they define JPATH_BASE, now they use dirname(__FILE__) for this. I read that __FILE__ tells from where the script is running. But in that same guide they gave as example dirname(dirname((__FILE__)) instead of only 1 time dirname() That was this website btw: http://www.phpguru.org/php-application-structure can anyone tell why i would use dirname 2 times and not 1 or 3 or 4? -edit: OK that last question don't needs an answer, i just put loads of dirname() around it and it seems it's moving up in the file system. Leaves my first still open I am trying to create a simple form for inserting to a database table. It seems the data from the form are passed through the "insert" script, but nothing is added to the table. My question is: what is required to insert new data to a table? must all fields have a value for the new data to be added? Hello, I'm fairly new to PHP, and I'm looking to create an online catalog for a furniture/appliance store. I'm wondering the best way to go about this. I'm looking at SQLMaestro's "PHP Generator for MySQL" http://www.sqlmaestro.com/products/mysql/phpgenerator/ ... But, I'm curious if you guys can point me in the right direction. I've never created a database before, and I want to do it the way that makes the most sense... Any advice would be appreciated!! Hello everyone, I am a hobbyist with programming. I have been playing with Php, sql, html for several years. I am building a program to organize my club. I am starting out fairly simple and hope in a year for it to be powerful. If anyone can point in the right direction to find out how I can do several things I can get my first version done this week maybe. Here are the things I am trying to accomplish. 1.) a page that I can view records with a First record, previous Record, next Record, last record buttons. The page will pull the information from a table or tables out of my mysql database. I would like to have an update button so I can update records as I go through them and to be able to search buy typing in first name or last name. I know there are functions that will help me and I have been trying to figure out what classes on php.net 2.) Last question for now. All my pages that deal with mysql I have included all the connection information. I was thinking about making a class and add using a class on the pages to open the connection. Not sure if this would be easy, or the best way. Thanks in advance. I am new and I am not looking for the exact code just place to start. I really want to learn php and sql to be able to build my own applications and fix them. |
|||||||