PHP - Is There A Way To Clean Up An If Statement With Many Conditions?

Hey guys

 I have a lot of inputs from my form. Is there a way I can do like a for each or something instead of of having to write

$myusername = stripslashes($_POST['name');
$mypassword = stripslashes($_POST['pass']);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

.... for all 16 fields?

thanks

I have created a form in wich a user inputs until 5 ranges of numbers
<tr>
<td width='270' align='right'>Εύρος1__Από: </td>
<td><input type='text' name='fromNum' size='20' /></td>
<td width='270' align='right'>Εως: </td>
<td><input type='text' name='toNum' size='20'/></td>
</tr>
<tr>
<td width='270' align='right'>Εύρος2__Από: </td>
<td><input type='text' name='fromNum2' size='20' /></td>
<td width='270' align='right'>Εως: </td>
<td><input type='text' name='toNum2' size='20'/></td>
</tr>
<tr> the same and for ranges 3,4,5

i put a constraint for the ranges
$regExpNum = '/^[0-9]{6}$/';
$regExpNum2 = '/^[0-9]{6}$/';
$regExpNum3 = '/^[0-9]{6}$/';
$regExpNum4 = '/^[0-9]{6}$/';
$regExpNum5 = '/^[0-9]{6}$/';

$validfromNum = preg_match($regExpNum,$_POST['fromNum'],$matchesfrom);
$validtoNum = preg_match($regExpNum,$_POST['toNum'],$matchesto);
$validfromNum2 = preg_match($regExpNum2,$_POST['fromNum2'],$matchesfrom2);
$validtoNum2 = preg_match($regExpNum2,$_POST['toNum2'],$matchesto2);
$validfromNum3 = preg_match($regExpNum3,$_POST['fromNum3'],$matchesfrom3);
$validtoNum3 = preg_match($regExpNum3,$_POST['toNum3'],$matchesto3);
$validfromNum4 = preg_match($regExpNum4,$_POST['fromNum4'],$matchesfrom4);
$validtoNum4 = preg_match($regExpNum4,$_POST['toNum4'],$matchesto4);
$validfromNum5 = preg_match($regExpNum5,$_POST['fromNum5'],$matchesfrom5);
$validtoNum5 = preg_match($regExpNum5,$_POST['toNum5'],$matchesto5);

i want to wright a combination of contitions for the five ranges.
for one range here is the code, but could you please help me to write a code for all of them?


$regExpNum = '/^[0-9]{6}$/';
$validfromNum = reg_match($regExpNum,$_POST['fromNum'],$matchesfrom);
$validtoNum = preg_match($regExpNum,$_POST['toNum'],$matchesto);

$errorMsg='';

if (!$validfromNum || !$validtoNum) {
if (!$_POST['fromNum'] && !$_POST['toNum']) {
$errorMsg="μήνυμα";
$htmlData['errorMsg']= $errorMsg;
$this->loadPage($htmlData);
return false;
} else if ($validtoNum && !$_POST['fromNum']) {
set_time_limit(240);
$data = $this->R100WorkOrder->GetWoRangeData($_POST['toNum'], $_POST['toNum']);
} else if ($validfromNum && !$_POST['toNum']) {
set_time_limit(240);
$data = $this->R100WorkOrder->GetWoRangeData($_POST['fromNum'], $_POST['fromNum']);

} else {
$errorMsg="μήνυμα";
$htmlData['errorMsg']= $errorMsg;
$this->loadPage($htmlData);
return false;
}
} else {
####################################################### Form Validation ################################################# End
if ($_POST['fromNum'] > $_POST['toNum']) {
$errorMsg="μήνυμα ";
$htmlData['errorMsg']= $errorMsg;
$this->loadPage($htmlData);
return false;
} else if ($_POST['toNum'] - $_POST['fromNum'] > 100 ) {
$errorMsg="μήνυμα";
$htmlData['errorMsg']= $errorMsg;
$this->loadPage($htmlData);
return false;
} else {
set_time_limit(240);
$data = $this->R100WorkOrder->GetWoRangeData($_POST['fromNum'], $_POST['toNum']);
}
}

Hey guys, Been playing about here and I'm completely stuck! I've created a button with a form field that the user can put a number into and submit it. This works out a few things and removes "resources" from the users account in the database depending on the unit and the cost of that unit. (I've done this the only way I could work out how).

But the next step I need to do an If I think, to find out of the user has enough resources on the account to build X amount, at current it just makes the resources go into the - numbers.

One of the units in unit.php:
Code: [Select]
<?php


        $result = mysql_query("SELECT * FROM userdb WHERE username='$_SESSION[user]'") 
                or die(mysql_error());  


echo "<table border='1' cellpadding='10'>";
echo "<th colspan='6'>Offence</th>";
               echo "<tr> 
<th>Unit Name</th> 
<th>Number</th> 
<th>Wood Cost</th>
<th>Iron Cost</th>
<th>TP Cost</th>
<th>Create</th>
</tr>";

while($row = mysql_fetch_array( $result )) {                


                echo "<tr>";

                echo '<td>Unit 1</td>';
                echo '<td>' . $row['ounit1'] . '</td>';
echo '<td>'. $ounit1w . '</td>';
echo '<td>'. $ounit1i . '</td>';
echo '<td>'. $ounit1tp . '</td>';
echo '<td> <form action="create.php" method="post"> 
<input type="text" name="number" value="" size="5">
<input type="hidden" name="memberid" value="' . $row['memberid'] . '">
<input type="hidden" name="unit" value="ounit1">
<input type="hidden" name="res1cost" value="'. $ounit1w . '">
<input type="hidden" name="res2cost" value="'. $ounit1i . '">
<input type="hidden" name="tpcost" value="'. $ounit1tp . '">
<input type="submit" name="submit" value="Create">
</form>
  </td>';
                echo "</tr>"; 

continues x12 for offence and defence so wont copy it all here.

create.php:

Code: [Select]
<?php include ('mysql.php'); ?>

<?php

//unit costs

$ounit1w = 1000;
$ounit1i = 1000;
$ounit1tp = 100;


?>



<?php


$memberid = mysql_real_escape_string($_POST['memberid']); 
$number = $_POST['number'];
$unit = $_POST['unit'];
$unitres1 = $_POST['res1cost'];
$unitres2 = $_POST['res2cost'];
$unittp = $_POST['tpcost'];


    $result = mysql_query("SELECT * FROM userdb WHERE memberid='$memberid'")                 
        or die(mysql_error());       
        while($row = mysql_fetch_array( $result )) {   
            $unitstart = $row[$unit];
$res1 = $row['res1'];
$res2 = $row['res2'];
$tp = $row['trainpoints'];
        }



$unitnumber = $unitstart + $number;

$resneeded1 = $number * $unitres1;
$resneeded2 = $number * $unitres2;
$tpneeded = $number * $unittp;

$newres1 = $res1 - $resneeded1;
$newres2 = $res2 - $resneeded2;
$newtp = $tp - $tpneeded;


if (isset($_POST['memberid']))
   {



$query=("UPDATE userdb SET $unit = '$unitnumber' WHERE memberid='$memberid'"); 
$query2= ("UPDATE userdb SET res1 = '$newres1' WHERE memberid='$memberid'"); 
$query3= ("UPDATE userdb SET res2 = '$newres2' WHERE memberid='$memberid'"); 
$query4= ("UPDATE userdb SET trainpoints = '$newtp' WHERE memberid='$memberid'"); 

mysql_query($query); 
mysql_query($query2); 
mysql_query($query3); 
mysql_query($query4); 



header('Location: ' . $_SERVER['HTTP_REFERER']);
  }
 ?>
This works, but I've got no idea how to check if $row['res1'] has $resneeded1 and to stop if it doesn't. Could anyone point me in the right direction or show me an example?

Thanks

I am trying to get  6 usernames and passwords from a local database via a file I created called database_log.inc.
note 2 columns and 6 rows
How can get each password & username with the current code?

here is the code for the log on:

<?php
function clean($data)
{
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}

$user = clean($_POST['username']);
$pass = clean($_POST['password']);
include 'database_log.inc';                              //info from the database separate file
if ($user == "shane" && $pass == "shane")   //password and user name not in the database

{
  session_start();
  $_SESSION['username'] = $user;
  $_SESSION['password'] = $pass;
  $_SESSION['ON']="TRUE";
  $lifetime=600;
  setcookie(session_name(),session_id(),time()+$lifetime);
  header( 'Location: inner.php' ) ;
  exit();
}


else
{
   header( 'Location: index.php' );
   session_destroy();
   exit();
}

?>

Hi

Im trying to write a script to clean up my image directory which has quite a lot of unused images that have built up over time.
In order to do this I am doing the following.

First Create a database table called 'image_clean' Then I'm searching through 3 tables and collecting all the image file names and dumping the names in the table 'image_clean'

Can do that no problem. So now I have all the images I need in this one table 'image_clean' I now want to go through my directory 'image_uploads' and delete anything thats not in the 'image_clean' table.

I know how to delete the files using unlink Im just unsure how to search through the directory file by file and check the file against the database. Im asumming I need to put them in an array. Could anyone give be a clue or two to get me started.

I have no problem checking a database against a directory but when its the other way round 'checking a directory against a database I'm lost. What I might do is pop the files to delete in a new database called 'image_delete' so that I can then check the images to delete before I write the unlink script. But I'm just not sure how to pick up each file and compare it to the table.

Thanks in advance.

Hi,

I am creating a website but am having trouble with the following:

I have an include file(db.inc) which contains the following:

function clean($input, $maxlength)
{
$input = substr($input, 0, $maxlength);
$input = EscapeShellCmd($input);
return ($input);
}

The file I am having the problem with is my view.php file. I get the following error:

Notice: Undefined variable: file in C:\wamp\www\fermpix\view.php on line 4

Line 4 contains the following:

$file = clean($file, 4);

My view.php does have the line:

include 'db.inc';


Does anybody have any idea what the issue might be?

Cheers
Paul

I've been messing around with clean urls in php and I've been having some trouble. I'm working on a private messaging system and when I go to "sitename.com/mail/view.php?page=inbox" it correctly displays the users inbox messages but when I put "sitename.com/mail/view/inbox/" it just displays the page like the GET value isn't set. Why is that?

this is the HTACCESS file for clean url

RewriteEngine on

RewriteCond %{REQUEST_FILENAME} !-d

RewriteCond %{REQUEST_FILENAME}\.php -f

RewriteRule ^view/([a-z]) view.php?page=$1 [NC,L]

 

I have a rule of conditions for access into an area of my site. The problem is, that when the wrong password is given, its still giving access to the area of the site. It is happening because I am using conditions wrong, and ask if someone could help me out by pointing out the correct way to do it.

When I say "conditions", I am referring to things such as && and ||


if ($row['laybypassword'] == $_POST['lay-bypassword'] && $row['status'] == "A" || $row['status'] == "B" || $row['status'] == "C")


So, if the correct password is given, and the row status equals A, B, or C, then do foobar.

<?php
require_once('upper.php');
if(isset($_COOKIE['AdminCookie'])){
if(isset($_POST['submit'])){
require_once('database.php');
$ActivityName =$_POST['ActivityName'];
$EventName =$_POST['EventName'];
$BloodGroup =$_POST['BloodGroup'];
$Location =$_POST['Location'];
$Age =$_POST['Age'];
//$Sex =$_POST['Sex'];
echo $ActivityName;
$query="select * from registration WHERE  Flag='A' AND BloodGroup= '$BloodGroup' AND Age ='$Age'";
//$query="select * from registration WHERE  Flag='A'  AND Address like '%$Location%'";

$result=mysqli_query($dbc,$query) or die('Not Connected');
while($row=mysqli_fetch_array($result))
{
echo $row['Name'];
}


/*if(isset($_POST['ActivityName']))
{
require_once('database.php');
$Search=$_POST['Search'];
$query="select * from registration where Flag='A' AND Activity like '%,$Search,%'";
$result=mysqli_query($dbc,$query) or die('Not Connected');
while($row=mysqli_fetch_array($result))
{
echo "<table border='2'><tr><td> Name--".$row['Name']."</td>
<td>Contact Number--".$row['ContactNumber']."</td>
<td>Email--".$row['Email']."</td>
<td>Address--".$row['Address']."</td></tr></table>";
}
}

elseif(isset($_POST['EventId'])){
require_once('database.php');
$Search=$_POST['Search'];
$query="SELECT * FROM registration r JOIN participation p ON r.LoginId = p.LoginId WHERE r.Flag='A' AND p.EventId ='$Search'";
$result=mysqli_query($dbc,$query) or die('Not Connected');
while($row=mysqli_fetch_array($result)){
echo "<table border='2'><tr><td> Name--".$row['Name']."</td>
<td>Contact Number--".$row['ContactNumber']."</td>
<td>Email--".$row['Email']."</td>
<td>Address--".$row['Address']."</td></tr></table>";
}}

elseif(isset($_POST['Location']))
{
require_once('database.php');
$Search=$_POST['Search'];
$query="select * from registration where Flag='A' AND Address like '%$Search%'";
$result=mysqli_query($dbc,$query) or die('Not Connected');
while($row=mysqli_fetch_array($result))
{
echo "<table border='2'><tr><td> Name--".$row['Name']."</td>
<td>Contact Number--".$row['ContactNumber']."</td>
<td>Email--".$row['Email']."</td>
<td>Address--".$row['Address']."</td></tr></table>";
}
}

elseif(isset($_POST['BloodGroup']))
{
require_once('database.php');
$Search=$_POST['Search'];
$query="select * from registration where Flag='A' AND BloodGroup ='$Search'";
$result=mysqli_query($dbc,$query) or die('Not Connected');
while($row=mysqli_fetch_array($result))
{
echo "<table border='2'><tr><td> Name--".$row['Name']."</td>
<td>Contact Number--".$row['ContactNumber']."</td>
<td>Email--".$row['Email']."</td>
<td>Address--".$row['Address']."</td></tr></table>";
}*/
}
?>
<html><body><form action='<?php echo $_SERVER['PHP_SELF']?>' method="post">
<?php 
require_once('database.php');
$result=mysqli_query($dbc,"select * from Activity");
echo "Select Activity &nbsp&nbsp
<select name='ActivityName'>
<option></option>";
while($row=mysqli_fetch_array($result)){
echo "
<option>".$row['Title']."</option>";
}
echo "</select><br>";



$result=mysqli_query($dbc,"select * from events");
echo "Select Events &nbsp&nbsp
<select name='EventName'>
<option></option>";
while($row=mysqli_fetch_array($result)){
echo "
<option>".$row[Title]."</option>";
}
echo "</select><br>";


$result=mysqli_query($dbc,"select * from registration");
echo "Select Blood Group &nbsp&nbsp
<select name='BloodGroup'>
<option></option>";
while($row=mysqli_fetch_array($result)){
echo "
<option>".$row[BloodGroup]."</option>";
}
echo "</select><br>";


echo" Enter Location &nbsp&nbsp 
<input type='text' name='Location'><br>";
echo"Enter Age &nbsp&nbsp
<input type='text' name='Age'><br>";


echo "Enter Sex &nbsp&nbsp 
<select>
<option></option>
<option>Male</option>
<option>Female</option>
</select><br>";

echo "<input type='submit' name='submit' value='Search'><br>";
echo"</form></body></html>";


echo "<a href='log_out.php'>Admin Log out</a><br>";
echo "<a href='AdminHome.php'>Back to Admin Home</a>";
}
else{echo 'Restricted Page'."<br><br>".'Access Denied';}

require_once('lower.php');?>
Hi frds..........
I want to search by "Age" and "Blood Group" first.On combobox when I select both Age and Blood Group it gives the rihgt result but when I select only one field and other remain blank it not works.............
I want when I select only one field, query executes for one condition only....
It means when I select only Blood Group and leave Age field blank it displays all Name have required Blood Group without any age condition.

I am trying to select text to display on condition of the current date.
I've set a Unix timestamp for the current date:
<?php
$todays_date = date("Y-m-d"); 
$today = strtotime($todays_date); 
?>
Next I test for the first condition. I want the text to appear for 2 weeks then terminate:
<?php
$exp_date = "2011-05-09"; 
$expiration_date = strtotime($exp_date); 
$start_date = strtotime("-14 days", $expiration_date);
if ($start_date < $today && $expiration_date > $today) { 
echo "<h2>Special Event #1</h2>";
} elseif {

At this point, I want to set the exp_date for the next event and test again, but I don't know how to do it. The techniques I've tried appear to evaluate as false and display the default text which follows the final "else":
} else {
echo "<h2>Default Text</h2>";
}
?>

I forgot how to write multiple conditions with if().

if (A == B || C == D) {foobar;}
I know the above is if any of the conditions is true, then do foobar, but what is it again so they both have to be true? I have forgotten, but I'm guessing either

if (A == B && C == D) {foobar;}
if (A == B ++ C == D) {foobar;}

?

if any body copy and paste anything from word to editor some unwanted css also coming with that pasting. when we request the data same css also coming with that. so how to clean data  when we request
$desc =$_request['contents'];


how to solve this issue. please help me.

I'm new to OOP and trying to write tiny classes to get practice.

The next class I want to create will be used to clean HTTP data from when a form gets submitted.

I'm embarrassed to say, but I'm scratching my head trying to figure out what types of things I should do as far as "sterilizing" POST and GET data?!   

Can someone get me started here?

Thanks,


TomTees

I currently use the following function to clean form inputs to prevent MySql injection,

Does this function do enough to prevent MySql injection? is there anything i have missed?

 
<?php

//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
$str = @trim($str);
if(get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
}

?>

I created a new homepage for my network of sites I run. I tried to go for a simple and clean look. The pages themselves function how I'd like, but I'm unsure if the menu system is easy to understand or not.   I even added a time limited message on the front page of the site indicating that the logo was clickable, but purposely left it off of other sub-pages to try and keep the design as clean as possible.   Check it out, let me know what you think.   http://ctenetwork.com