Learn VBA & Macros in 1 Week!

PHP - How Good Or Bad Is The Sql Filtering?

Full Excel VBA Course - Beginner to Expert

How Good Or Bad Is The Sql Filtering?	View Content

I have a SQL statement which is difficult to use PDO on, it might not even be possible to do. So I'm filtering it like this:

$search = $_GET['search'];
$search = preg_replace("/[^A-Za-z0-9]/", " ", $search);
$search = $mysqli->real_escape_string($search);

Will this result in an acceptable level of security?
Edited by anderson_catchme, 16 September 2014 - 12:28 PM.

Full Excel VBA Course - Beginner to Expert

Need Help With Filtering

Similar Tutorials

View Content

Filtering

Similar Tutorials

View Content

I have a form and script that is used to collect information from users.
There is one field that is url.
There is one field that is email.

I want to filter out scripts. I also only want to allow url in the url field and email in the email field.

Is there an easy way to filter? I have tried several pieces of code to no avail.

Code: [Select]
<?php
$root = $_SERVER['DOCUMENT_ROOT'];
include('/home/arts/public_html/shows/includes/config.db.php');
if ($link)
{
 foreach ($_POST as $k => $v)
 {
 if (($k == "start_date") || ($k == "end_date") || ($k == "application_dead"))
 {
 $varray = explode("/",$v);
 $v = $varray[2] . "-" . $varray[0] . "-" . $varray[1];
 }

 $v = "'" . addslashes($v) . "'";


 if($k != "captcha_code")
{

$keys[] = $k;
$vals[] = $v;
}
 }

 $fields = implode(",", $keys);
 $values = implode(",", $vals);
 //$fields = "id," . $fields;
 //$values = "null," . $values;

 $sql = "INSERT into craft_shows ($fields) VALUES ($values)";

 $result = mysql_query($sql,$link);
if (!$result) {
 die('There was a problem with your submission. Refresh the page to try again');
}
else
{
 echo "Thank you for your submission. ";
 echo "<a href=\"http://www.artsandcraftsnetwork.com/shows/\">Back to shows</a> ";
 echo "<a href=\"http://www.artsandcraftsnetwork.com/shows/shows_submit.php\">Submit another show</a>";
}


}
?>

Not Filtering Words?

Similar Tutorials

View Content

I'm pretty sure the problem is starring me in the face, but I can't seem to locate it.

function filter($string)
{
//swear words pulled from bannedwordlist.com
$f = fopen('../badwords.txt', 'r');
$bad_words = fread($f, filesize('../badwords.txt'));
$bad_words = explode('\n', $bad_words);

$input = strtolower($string);

foreach($bad_words as $value)
{
$string = str_replace($value, '****', $input);
}

return $string;
}

UPDATED CODE

function filter($string)
{
//swear words pulled from bannedwordlist.com
$f = fopen('../badwords.txt', 'r');
$bad_words = fread($f, filesize('../badwords.txt'));
$bad_words = explode('\n', $bad_words);

$input = strtolower($string);
$string = str_replace($bad_words, '****', $input);

return $string;
}

I've already echoed out $value in the foreeach loop, and it does correctly retrieve the bad words and put them into an array. My only problem is, the returned string is still in strtolower() form, and the words aren't censored. :/

Filtering Files

Similar Tutorials

View Content

Hi all,

I was wondering if i can filter certain log files like using 2 keywords and get all the info inbetween? The log files are like <1 MB.

The other problem i encounter is howto since i looked all over the net but cant seem to find usefull info about it.

Can you help me out here?

Php Data Filtering From Db

Similar Tutorials

View Content

Hi, I have an issue, I cant filter my data from DB. Whats wrong in my code?
<?php
/* Include Files *********************/
//include("banners/database.php");
mysql_connect("host", "user", "pwd") or die("Connection Failed");
mysql_select_db("DB")or die("Connection Failed");
?>
<?php
$memberIndustries =['memberIndustries'];
if (isset($_POST["memberIndustries"])) {
$memberIndustries = mysql_real_escape_string ($_POST["memberIndustries"]);
$sql="SELECT * FROM Members WHERE Industries_Industry_ID='$memberIndustries'";
$result = mysql_query($sql) or die (mysql_error());

while ($myrowe = mysql_fetch_array($result)) {?>
 <? // if new member, label it
 //$todays_date = date("Y-m-d");
 //$dateCompare = $myrowe[Creation_Date]+30;
 //$dateCompare = strtotime(date("Y-m-d", strtotime($myrowe[Creation_Date])) . " +30 days");
 //if(strtotime($todays_date)<=$dateCompare){
 ?>
 <table width="100%">
 <tr>
 <td align="right">
 <img src="/members/new.gif">
 </td>
 </tr>
 </table>
 <? //}?>

 <? if($myrowe[LOGO_lnk]!='') {?>
 <img src="<? echo $myrowe[LOGO_lnk]; ?>">
 <? } ?>
 
 
 <? echo $myrowe[Company_Title];?>
 
 <? if($myrowe[Person_Name_1]!='') {?>
 
 <? echo $myrowe[Person_Name_1];?>
 <? echo $myrowe[Person_Title_1];?>
 <? }
 if($myrowe[Person_Name_2]!='') {?>
 
 <? echo $myrowe[Person_Name_2];?>
 <? echo $myrowe[Person_Title_2];?>
 <? }
 if($myrowe[Person_Name_2]!='') {?>
 
 <? echo $myrowe[Person_Name_3];?>
 <? echo $myrowe[Person_Title_3];?>
 <? }
 if($myrowe[Address_row1]!='') {?>
 
 <? echo $myrowe[Address_row1];?>
 <? }
 if($myrowe[Address_row_2]!='') {?>
 
 <? echo $myrowe[Address_row_2];?>
 <? }
 if($myrowe[Address_row_3]!='') {?>
 
 <? echo $myrowe[Address_row_3];?>
 <? }
 if($myrowe[Phone]!='') {?>
 
 Tel:<? echo $myrowe[Phone];?>
 <? }
 if($myrowe[Fax]!='') {?>
 
 Fax:<? echo $myrowe[Fax];?>
 <? }
 if($myrowe[email]!='') {?>
 
 <a href="mailto:<? echo $myrowe[email];?>">
 <? echo $myrowe[email];?>
 </a>
 <? }
 if($myrowe[web]!='') {?>
 
 <a href="<? echo $myrowe[web];?>"target="_blank">
 <? echo $myrowe[web];?>
 </a>
 <? }
 if($myrowe[Industries_Industry_ID]!=0) {
 $queryInd = "SELECT Industry_Title FROM Industries WHERE Industry_ID=$myrowe[Industries_Industry_ID]";
 $resultInd = mysql_query($queryInd) or die (mysql_error());
 $myroweIND = mysql_fetch_array($resultInd)
 ?>
 
 <? echo $myroweIND[Industry_Title];?>
 <? }
 if($myrowe[Description]!='') {?>
 
 <? echo $myrowe[Description];?>
 <? } ?>
 
<? }
<? }} ?>

Parsing / Filtering Xml

Similar Tutorials

View Content

Hi all,

I am working on a tool to pull data remotely and the data is set to xml format. I want to post items that meet a certain criteria only, essentially there are several layers/tags on the data being brought over. The sStatus is the primary item I am looking for, not only that but only if it has or equals to "Waiting". Any thoughts or suggestions greatly appreciated. Below is the basic code I have in place currently and am working on.

<code>
<?php
$soapclient = new SoapClient("https://secure.logmeinrescue.com/api/api.asmx?wsdl");

$sEmail = "dummy@dum.com";
$sPassword = "dum123";
$iNodeID = "123456";
$eNodeRef = "NODE";
$sAuthCode = "";

$loginparams = array (
'sEmail' => $sEmail,
'sPassword' => $sPassword);

$loginResult = $soapclient->login($loginparams);

$output = array(
'eOutput' => "XML"
);

$outputResponse = $soapclient->setOutput($output);

$sessionparams = array(
'iNodeID' => $iNodeID,
'eNodeRef' => $eNodeRef,
'sAuthCode' => $sAuthCode
);

//get session(s)
$sessionresult = $soapclient->getSession($sessionparams);
$session = $sessionresult->aSessions;
$sessionnodes = $session->SESSION;
$session_status = $sessionnodes[$isessionNodes]->sStatus;

print_r($sessionresult);

?>
</code>

Filtering Array

Similar Tutorials

View Content

Hi there

I have the following array .

Code: [Select]
$products = array( array( Code => "CF1",
Items => "Sand Tray",
Cat => 'Tray',
),
array( Code => "CF2",
Items => "Mobile Computer Table",
Cat => 'Table',
),
array( Code => "CF3",
Items => "General Service Trolley",
Cat => 'Trolley',
),
array( Code => "CF4",
Items => "TV Trolley",
Cat => 'Trolley',
),
array( Code => "CF5",
Items => "Overhead Projector Trolley",
Cat => 'Trolley',
),
array( Code => "CF6",
Items => "Book Trolley",
Cat => 'Tolley',
),
array( Code => "CF7",
Items => "Stacking Chairs",
Cat => 'Chairs',
),
);
What I want to do is select each by 'Cat'. For example I simply want to display all the trolleys.

I was wondering how I do this? What functions would I use in PHP?

Thanks a million

Allow '@' And '.' For Email Filtering

Similar Tutorials

View Content

Hello, Is it possible to allow '@' and '.' while maintaining the rest of this regex?

$email= 'adsfsa@asdf.edu';
$email= preg_replace("/[^A-Za-z0-9]/", " ", $email);
echo $email;

Moved: Filtering

Similar Tutorials

View Content

This topic has been moved to PHP Regex.

http://www.phpfreaks.com/forums/index.php?topic=334433.0

Filtering Gps Points

Similar Tutorials

View Content

hi,

i am trying to filter my gps history points.

i would like to ignore points if they are too close to the previous position.

i can do this like so.

$old_lat = $old_long = "0";

foreach($history['data'] as $record) {

//calculate distance in meters
$distance = distance($record['latitude'], $record['longitude'], $old_lat, $old_long, "V");

if($distance >= 300) {
echo 'add(jQuery(this), number += 1, "' . date("d-m-Y @ h:i:s",$record['timestamp']) . '", "map_post.php?n=' . $name . 'u=' . $history['user'] . '", "' . $history['user'] . '", "' . $record['latitude'] . '", "' . $record['longitude'] . '");';

$old_lat = $record['latitude'];
$old_long = $record['longitude'];
}

the problem with the above is that if i arrive home at 6pm on friday and stay outside my house for 24hours, it will show the latest position as at 6pm on fri.

i would like it to show the 6pm friday position but with a date 'from and to' time like (28/10/11 18:00 - 29/10/11 18:00) rarther than just (28/10/11 18:00) which looks inacurate.

Possible?

Php Filtering Results

Similar Tutorials

View Content

I want to create a feature as you see nn this image, where it says 'filter your results' if a user clicks 'Detached Houses' then only detached houses will be displayed. if a user clicks 'Semi-detached' then only semi detached houses will be shown.
Any help is really appreciated, thank you.
Code: [Select]

<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><div id="filter">Houses
 
Detached Houses<?php
// Make a MySQL Connection
mysql_connect("localhost", "admin", "1admin") or die(mysql_error());
mysql_select_db("test") or die(mysql_error());

// Get a specific result from the "example" table
$result = mysql_query("SELECT * FROM example
WHERE name='Sandy Smith'") or die(mysql_error());

// get the first (and hopefully only) entry from the result
$row = mysql_fetch_array( $result );
// Print out the contents of each row into a table
echo $row['name']." - ".$row['age'];
?>
 
Semi-detached houses
 
Terraced houses
 
 
Flats / Apartments

</div></td>

Filtering Arrays Help

Similar Tutorials

View Content

Hi guys

I was wondering if anyone could point me in the right direction with this.

I am using JSON to return the contents of a directory and then using a foreach loop to print each one to a new row in a table.

Is there anyway to filter the results? Basically I just want to show the files that end in a .jar extension? Currently all sub directories and files are shown, however all the files I need to pull will be in the main directory.

This is what I am using:

Code: [Select]
<?php
foreach ($installedplugins1['success'] as $v)
{
echo "<tr><td>".$v."</td>";
echo "<td><a href='index.php?dp=".$v."'>Disable Plugin</a></td>";

}
?>

Any hints or reading material?

Cheers

Filtering Data

Similar Tutorials

View Content

hey guys i was generally wondering...is it good practice to add_slashes and use mysqli_real_escape_string when entering data into the database? then to strip slashes when extracting rows? is this the right way to go around things...thanks

Utf-8 Filtering/validation

Similar Tutorials

View Content

First off, i have made a validation class using array_diff() to check if there are invalid characters submitted by a user.
Some extracts:
Code: [Select]
$this->chr_alpha_lower=array('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z');
$this->chr_alpha_upper=array('A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z');
$this->chr_numeric=array('0','1','2','3','4','5','6','7','8','9');
$this->chr_symbol=array(' ','!','@','#','$','%','&','(',')','[',']','.',',',':',';','\'','"','/','=','\\','-','_','?');

...

// lets say only alpha and numeric characters are allowed
$allowed_characters=array();
$allowed_characters=array_merge($allowed_characters,$this->chr_alpha_lower,$this->chr_alpha_upper);
$allowed_characters=array_merge($allowed_characters,$this->chr_numeric);

$input_split=str_split($this->input);
$invalid=array_diff($input_split,$allowed_characters);

if(empty($invalid)){
return true;
}
return false;

I have two questions.
First, for acsii characters is this method 'full proof' or is there a way for someone to get around this validation script?

Second, a new site im developing is going to be built with UTF-8 in mind so people can use the site in their own language. How do i validate UTF-8 user input? I know about mb_strings and sanitizing UTF-8 input using this:
Code: [Select]
preg_match_all('/([\x09\x0a\x0d\x20-\x7e]'. // ASCII characters
'|[\xc2-\xdf][\x80-\xbf]'. // 2-byte (except overly longs)
'|\xe0[\xa0-\xbf][\x80-\xbf]'. // 3 byte (except overly longs)
'|[\xe1-\xec\xee\xef][\x80-\xbf]{2}'. // 3 byte (except overly longs)
'|\xed[\x80-\x9f][\x80-\xbf])+/', // 3 byte (except UTF-16 surrogates)
$input, $clean_pieces );

$clean_output = join('?', $clean_pieces[0] );

But how do i know what to filter?

Example:
a field for the user to input first name
English: only alpha characters
Other language: ?????

Help much appreciated.

Filtering By Multiple Categories In The Same Row

Similar Tutorials

View Content

Im struggling with how to filter items that have multiple categorises say if i wanted to search for a shoe that is good for walking and hiking in my database?

Shoe_id
Shoe name
color_id type_id

colors color_id color type type_id type

My problem is what do i do in a situations like this? say a shoe is good for walking and running? aka type 1 and 2

shoe id 1 shoe name nike color id 1 type id 1 and 2

Combinations & Filtering Permutations

Similar Tutorials

View Content

I'm trying to firstly generate all possible 'x' number combinations from an array of 'y' numbers. i.e. combinations of 3 numbers from array(1,2,3,4,5). so... 1,2,3 - 1,2,4 - 1,2,5, 1,3,4 etc
I then want to be able to filter out duplicate permutations. i.e. 1,2,3 is the same as 1,3,2.

I have googled vigorously but not been able to determine a suitable approach.

Any suggestions would be appreciated.

Thanks.

Rookie Needs Help - Filtering Path?

Similar Tutorials

View Content

Perhaps a slight trouble, but I can not solve it: Match only path like: Trainings/1/test.pdf but dont match one more directory like this: Trainings/1/4/other.pdf Any suggestions?

Image Filtering And Text To Url.

Similar Tutorials

View Content

For starters. I'm relatively new to PHP programming. I've had minor VB and I have SOME understanding of programming in general. I was trying to find this solution myself without consulting anyone but with PHP5 and it's deprecated functions. I can't just paste code from the net and it work. Currently I have PHP 5.3.5 installed. I'm running on the newest Apache and MySQL builds.

Now to the part I want to get to work. I'm trying this just because I can. Basically. I would like php to scan a certain path and filter out the images. I have a script that does that fine. What I want to do is take the file names, append my host address and turn it into a clickable link. I also have a script that will turn text into URL's. I will paste the snippets I have. I was initially trying to use eregi_replace() but apparently that's been deprecated and I believe I should now use FileInfo() or something like that. Not quite sure what they do but am really wanting to learn. Thanks for any help you guys can offer.
<?php
$path = 'http://www.krasikart.no-ip.org';
$dir=$_SERVER['DOCUMENT_ROOT']."/htdocs/pics/";
$total = '';
// Retrieve all the images.
$files = glob ("$dir{*.jpg,*.jpeg,*.gif}", GLOB_BRACE);

// Confirm that matches were made.
if (is_array($files)) {

// Loop through the array.

foreach ($files as $image) {
$total = $path . $image;

print "$total \n";

// The Regular Expression filter
$reg_exUrl = "/(http|https|ftp|ftps)\:\/\/[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,3}(\/\S*)?/";

// The Text you want to filter for urls
$text = "$total";

// Check if there is a url in the text
if(preg_match($reg_exUrl, $text, $url)) {

 // make the urls hyper links
 echo preg_replace($reg_exUrl, '<a href="'.$url[0].'" rel="nofollow">'.$url[0].'</a>', $text);

} else {

 // if no urls in the text just return the text


}

}

} else {

echo 'No files matched the search pattern!';
}

?>

Filtering Weird Characters

Similar Tutorials

View Content

Hi. I made a website to keep track of where I am in various manga. I noticed that sometimes the title I grab looks OK when rendered on the page but in the database it's weird looking

I did a for ($x=0; $x<strlen($title); $x++) loop and dumped $x, char at $ pos and ord of char:

0 = T = 84
1 = h = 104
2 = e = 101
3 =   = 32
4 = D = 68
5 = e = 101
6 = m = 109
7 = o = 111
8 = n = 110
9 =   = 32
10 = K = 75
11 = i = 105
12 = n = 110
13 = g = 103
14 = � = 226
15 = � = 128
16 = � = 153
17 = s = 115
18 =   = 32
19 = D = 68
20 = a = 97

Is there some nifty built in function for converting that weird stuff to a regular apostrophe (and convert any other weird stuff)? I mean, I can write a filter to look for 226/128/153 and replace with ' but I'm sure there must be a proper way to handle that stuff. Thanks!

Filtering Sql Values By Url Parameter

Similar Tutorials

View Content

Hi all

I am building a page to filter SQL values but I'm not sure how to write the code for the query.

My URL looks like this:

stone.php?category=Wood&type=4&colour=1&Submit=Submit

Firstly, can I remove the submit from the URL?

Then I have my code to create the query:

$fetchData=mysql_query("SELECT * FROM `products` WHERE category = "'.$_GET'category.'"");

Can I combine this for the type and colour?

Many thanks
Pete