PHP - Should One Have To Fully Comply With W3c Validator?

Hello All,   I'm having trouble trying to "wrap my head around" how I can make the query in my code below more efficient, elegant, and certainly immune to a SQL-injection attack   So, I have a form (which can be seen in the attached screenshot) which has the user first select a search-type via a dropdown listbox. The two choices pertain to two columns in the underlying table i.e. store_name and item_description. Once that selection is completed the user is expected to enter a search-term (which is typically in relation to the choice selected in the first prompt).   Now, what I would like to happen is that the query be created based on both, the value in the search-type prompt, as well as the value in search-term textbox, and of course, the query must be a parameterized prepared statement (to minimize the possiblity of a SQL-inection attach).   Essentially I would like to get rid of the following code (which I believe is potentially redundant, and contains a hard-coded column name between the WHERE and LIKE), to make things less complicated and more elegant/flexible

if ($searchtype == "store_name")
   {
       $sql = "SELECT * FROM `shoplist` WHERE store_name LIKE :searchterm ORDER BY store_name ASC";
   }
else if ($searchtype == "item_description")
   {
       $sql = "SELECT * FROM `shoplist` WHERE item_description LIKE :searchterm ORDER BY store_name ASC";
   }

Here's what I tried:

// Tried this first but it didn't work...gave some kind of error pertaining to the parameter 2    
// Prepare the query ONCE
$query = "SELECT * FROM `shoplist` WHERE ? LIKE ? ORDER BY ? ASC";

$searchterm = '%' . $searchterm . '%';

$statement = $conn->prepare($query);
$statement->bindValue(1, $searchtype);                                                        
$statement->bindParam(2, $searchterm);
$statement->bindValue(3, $searchtype);
$statement->execute();

// ----------------------------------------------------------------------------------------------------------- //

// Tried this as well, but was getting unexpected results (mostly all rows being returned, regardless of input)
// Prepare the query ONCE
$query = "SELECT * FROM `shoplist` WHERE :searchtype LIKE :searchterm ORDER BY :searchtype ASC";

$searchterm = '%' . $searchterm . '%';

$statement = $conn->prepare($query);
$statement->bindValue(':searchtype', $searchtype);
$statement->bindValue(':searchterm', '%' . $searchterm . '%');
$statement->execute();

Here's the complete code (pertaining to the problem/request):

// create short variable names
if(isset($_POST['searchtype']))
    {                                            
        $searchtype=$_POST['searchtype'];
    }
if(isset($_POST['searchterm']))
    {                            
        $searchterm=trim($_POST['searchterm']);
    }

if(isset($_POST['searchtype']) && isset($_POST['searchterm']))
    {
        if (!get_magic_quotes_gpc())
            {
                $searchtype = addslashes($searchtype);
                $searchterm = addslashes($searchterm);
            }
    }

if(isset($_POST['searchtype']) && isset($_POST['searchterm']))
    {
        // ****** Setup customized query ******
        if ($searchtype == "store_name")
            {
                // The following statement is potentially open to SQL-inection attack and has therefore been REM(arked)
                // $sql = "SELECT * FROM `shoplist` WHERE " . $searchtype . " LIKE :searchterm ORDER BY store_name ASC";

                // The following may not be open to SQL-injection attack, but has the column name hard-coded in-between the WHERE and LIKE clauses
                // I would like the the column name to be set based on the value chosen by the user in the form dropdown listbox for "searchtype"
                $sql = "SELECT * FROM `shoplist` WHERE store_name LIKE :searchterm ORDER BY store_name ASC";
            }
        else if ($searchtype == "item_description")
            {
                // The following statement is potentially open to SQL-inection attack and has therefore been REM(arked)
                // $sql = "SELECT * FROM `shoplist` WHERE " . $searchtype . " LIKE :searchterm ORDER BY item_description ASC";

                // The following may not be open to SQL-injection attack, but has the column name hard-coded in-between the WHERE and LIKE clauses
                // I would like the the column name to be set based on the value chosen by the user in the form dropdown listbox for "searchtype"
                $sql = "SELECT * FROM `shoplist` WHERE item_description LIKE :searchterm ORDER BY item_description ASC";
            }

        $statement = $conn->prepare($sql);
        $statement->bindValue(':searchterm', '%' . $searchterm . '%');
        $statement->execute();
        ...
        ...
        ...
    }

Thanks guys!     Attached Files  Search-Screen-SS.png   21.31KB   0 downloads

This topic has been moved to JavaScript Help.

http://www.phpfreaks.com/forums/index.php?topic=358359.0

Greetings. I'm working on a Wordpress site utilizing a fully-responsive theme ( www.ailimconsulting.com ). One of the features that was requested was the integration of a special menu hover effect found at GitHub that creates a shadow below the menu item being moused over ( you can see this effect by visiting the link above ). As part of the fully responsive nature of the theme, when the browser collapses to a certain point or the site is viewed on mobile devices the menu itself collapses to a single-tabbed system. The problem is that the class that controls the shadow float causes this collapsed menu to look like crap. So, we want to remove the directives of this class from all the mobile viewing settings ( the @media controls ).    The effect is added to the menu via the Appearance / Menus in the CSS Classes field in each menu item with the class name of .float-shadow.     The effect works perfectly in full browser mode but needs t be removed from all the @media sections of the CSS that control the fully-responsive nature of the theme in various devices dimensions. For example, these are the @media directives:   /*-------------------[320px]------------------*/

Hi, I modified the php.net's xml validate function slightly to just print "Valid XML" or else print all the errors, but it is not working. It keeps outputting "Valid XML" even though I intentionally appended "SS" to the closing message tag.

Here is the script:
Code: [Select]
$dom_=<<<START
<?xml version="1.0" encoding="ISO-8859-1" ?>
<email>
<message>
<to>
<toFirstName type="common">Bob</toFirstName>
<toLastName kind="swag">Smith</toLastName>
</to>
<from>
<fromFirstName>Steve</fromFirstName>
<fromLastName>Yzerman</fromLastName>
</from>
</messageSS>
</email>
START;

//validate($dom_);

//FCN SOURCE:php.net in section on libxml_get_errors
libxml_use_internal_errors(true);

$xml = explode("\n", $dom_);

$errors = libxml_get_errors();

if(empty($errors))
    print "Valid XML";
else {
    foreach ($errors as $error) {
        echo display_xml_error($error, $xml);
    }
    libxml_clear_errors();
}

function display_xml_error($error, $xml)
{
    $return  = $xml[$error->line - 1] . "\n";
    $return .= str_repeat('-', $error->column) . "^\n";

    switch ($error->level) {
        case LIBXML_ERR_WARNING:
            $return .= "Warning $error->code: ";
            break;
         case LIBXML_ERR_ERROR:
            $return .= "Error $error->code: ";
            break;
        case LIBXML_ERR_FATAL:
            $return .= "Fatal Error $error->code: ";
            break;
    }

    $return .= trim($error->message) .
               "\n  Line: $error->line" .
               "\n  Column: $error->column";

    if ($error->file) {
        $return .= "\n  File: $error->file";
    }

    return "$return\n\n--------------------------------------------\n\n";
}

Any help is much appreciated, thanks.

Hi, I found this very good tutorial at IBM's site:

http://www.ibm.com/developerworks/xml/library/x-validxphp/

BUT my question is, what if any arbitrary XML file is passed passed to this xml validator function as parameter (that I will soon write), so meaning there may not be an xml schema created, so how would I validate it then b/c the link above assumes there a schema is made to use to validate.

Any help much appreicated!

Hello,

the below validator keeps saying invalid email, can you notice any issues:

<form name="input" action="check.php" method="post">
Username: <input type="text" id="email" name="email" />
<input type="submit" value="Submit" />
</form> 

Check.php
<?php
 if (isset($_REQUEST['email']))
{
$email = trim($_POST['email']);  
if(!checkEmail($email)) { 
echo 'Invalid email address!';
}
else 
{
 echo 'Email address is valid';
}
}

function checkEmail($email) {
if(preg_match("/^( [a-zA-Z0-9] )+( [a-zA-Z0-9\._-] )*@( [a-zA-Z0-9_-] )+( [a-zA-Z0-9\._-] +)+$/" , $email)) {
list($username,$domain)=split('@',$email);
if(!checkdnsrr($domain, 'MX')) {
return false;
}
if(!fsockopen($domain,25,$errno,$errstr,30)) {
return false;
}
return true;
}
return false;
}

?>

Many thanks

Ok, so I used to be very good in HTML, PHP, and JS, but it's been a long time since I used it. been trying to make just a simple order form for a friends business. Though I wanted it to do server side validation and emailing... But it doesn't do anything.... on submit I get no errors when there are and with no errors I get no email to my inbox..

What it is supposed to do is gather what pictures they checked and their sizes as well as a person info and email it to an email address. Though I want it to check for required areas and correct input (like email has @ and a .com in it, zip is digits only, etc... But yeah my code shows the order form and looks nice, but does nothing....
Code: [Select]
<?php
require_once "formvalidator.php";
  $error_hash = 'no';
  $show_form = true;
class MyValidator extends CustomValidator
{
function DoValidate(&$formars,&$error_hash)
{
        if(stristr($formars['comments'],'http://'))
        {
            $error_hash['comments']="No URLs allowed in comments";
            return false;
        }
return true;
}
}

  if (isset($_REQUEST['Submit'])) 
{
      $validator = new FormValidator();
      $validator->addValidation("email", "email", "<B>Email address is invalid.</B>");
      $validator->addValidation("first", "req", "<B>Please provide your first name for invoice.</B>");
      $validator->addValidation("addr", "req", "<B>Please provide your address for invoice.</B>");
      $validator->addValidation("city", "req", "<B>Please provide your city name for invoice.</B>");
      $validator->addValidation("zip", "req", "<B>Please provide your zipcode for invoice.</B>");
      $validator->addValidation("last", "req", "<B>Please provide your last name for invoice.</B>");
      $validator->addValidation("zip", "num", "<B>Numbers only in Zipcode.</B>");
      $validator->addValidation("phone", "num", "<B>Numbers only in phone number.</B>");
      if ($validator->ValidateForm()) {
          $show_form = false;
      } else {
          echo "<center><font color='#CC0000'><B>Validation Errors:</B></font></center>";
          $error_hash = $validator->GetErrors();
          foreach ($error_hash as $inpname => $inp_err) {
              echo "<center><p>$inpname : $inp_err</p></center>\n";
              $show_form = true;
          }
      }
          if ($show_form === false){
          // Grab the form vars
  $Pic = $_REQUEST['pic[]'] ;
  $Size = $_REQUEST['size[]'] ;
          $Email = $_REQUEST['email'];
          $Name = $_REQUEST['first'. 'last'];
          $Addr = $_REQUEST['addr'];
          $City = $_REQUEST['city'];
          $State = $_REQUEST['state'];
          $Zip = $_REQUEST['zip'];
  $comments = $_REQUEST['comments'] ;
 
if(empty($pic)) 
  {
    echo "<center><font color='#CC0000'><B>Please Select a picture.</B></font></center>";
  } 
  else 
  {
    $r = count($pic);
    for($i=0; $i < $r; $i++)
    {
      echo "picture(s) requested $i was: " . $pic[$i] . "\r\n";
    }
  }
if(empty($size)) 
  {
    echo "<center><font color='#CC0000'><B>Please Select a picture size.</B></font></center>"; 
  } 
  else 
  {
    $r = count($size);
    for($i=0; $i < $r; $i++)
    {
      echo "Sizes(s) requested $i was: " . $size[$i] . "\r\n";
    }
  }

        //message body
        $mail_body .= "$Pic"."\r\n";
        $mail_body .= "$Size"."\r\n";
        $mail_body .= "$Email"."\r\n";
        $mail_body .= "$Name"."\r\n";
        $mail_body .= "$Addr"."\r\n";
        $mail_body .= "$City,". " $State". " $Zip"."\r\n";
        $mail_body .= "$Comments"."\r\n";
        //sending to
        $recipient = "hakarune@gmail.com";
        $subject = "Order Form";
        //Headerfields
        $header = "From: " . $Email . " <" . $Email . ">\r\n";
        //mail command
        mail($recipient, $subject, $mail_body, $header);
                                   }
          echo "<div style='width:400px; margin:0 auto; border:1px solid #1e1e1e'>Your order has been sent successfully. <br>An Invoice will be either emailed or mailed to you, thank you for your order.<br>You will be redirected to the home page in a few moments...</div>";
                        //page redirect to home
                                         echo "<meta http-equiv=\"refresh\" content=\"4;url=";
                          echo "http://lmtl-linux/credit\" />";
}
  if (true == $show_form) {
?>

<form name="ordering" action="" method="GET" enctype="text/plain">
<img src="1.jpg" />
<input type="checkbox" name="pic[]" value="1">
<br />
<select name="Type" size="1" name="size[]" Value="1">
  <option value="">Select Type</option>
  <option value="Original">Original $Price</option>
  <option value="Print Small">300x500 Print $Price</option>
 <option value="Print Medium">800x600 Print $Price</option>
 <option value="Print Large">1200x1280 Print $Price</option>
 <option value="Print XLarge">1282x1400 Print $Price</option>
</select>
<br />
<img src="2.jpg" />
<input type="checkbox" name="pic[]" value="2">
<br />
<select name="Type" size="1" name="size[]" Value="2">
  <option value="">Select Type</option>
  <option value="Original">Original $Price</option>
  <option value="Print Small">300x500 Print $Price</option>
 <option value="Print Medium">800x600 Print $Price</option>
 <option value="Print Large">1200x1280 Print $Price</option>
 <option value="Print XLarge">1282x1400 Print $Price</option>
</select>
<br />
<img src="3.jpg" />
<input type="checkbox" name="size[]" Value="3">
<br />
<select name="Type" size="1" name="size3">
  <option value="">Select Type</option>
  <option value="Original">Original $Price</option>
  <option value="Print Small">300x500 Print $Price</option>
 <option value="Print Medium">800x600 Print $Price</option>
 <option value="Print Large">1200x1280 Print $Price</option>
 <option value="Print XLarge">1282x1400 Print $Price</option>
</select>
<br />
<img src="4.jpg" />
<input type="checkbox" name="pic[]" value="4">
<br />
<select name="Type" size="1" name="size[]" Value="4">
  <option value="">Select Type</option>
  <option value="Original">Original $Price</option>
  <option value="Print Small">300x500 Print $Price</option>
 <option value="Print Medium">800x600 Print $Price</option>
 <option value="Print Large">1200x1280 Print $Price</option>
 <option value="Print XLarge">1282x1400 Print $Price</option>
</select>
<br />
<img src="5.jpg" />
<input type="checkbox" name="pic[]" value="5">
<br />
<select name="Type" size="1" name="size[]" Value="5">
  <option value="">Select Type</option>
  <option value="Original">Original $Price</option>
  <option value="Print Small">300x500 Print $Price</option>
 <option value="Print Medium">800x600 Print $Price</option>
 <option value="Print Large">1200x1280 Print $Price</option>
 <option value="Print XLarge">1282x1400 Print $Price</option>
</select>
<br />
<br />
<br />
Information For Invoice: <font color="red">(Required Info = *)</font>
<br />
<input type="text" name="first" Value="First Name" size="25" onfocus="value=''"><font

color="red">*</font>
<input type="text" name="last" Value="Last Name" size="25" onfocus="value=''"><font

color="red">*</font>
<br />
<input type="text" name="phone" Value="Phone Number" size="25" onfocus="value=''">
<br />
<input type="text" name="email" Value="E-mail" size="30" onfocus="value=''">
<br />
<input type="text" name="addr" Value="Street Address" size="50" onfocus="value=''"><font

color="red">*</font>
<br />
<input type="text" name="city" Value="city" size="30" onfocus="value=''"><font

color="red">*</font>
<br />
<select name="state" size="1">
<option value="">Select State</option>
<option value="AK">AK</option>
<option value="AL">AL</option>
<option value="AR">AR</option>
<option value="AZ">AZ</option>
<option value="CA">CA</option>
<option value="CO">CO</option>
<option value="CT">CT</option>
<option value="DC">DC</option>
<option value="DE">DE</option>
<option value="FL">FL</option>
<option value="GA">GA</option>
<option value="HI">HI</option>
<option value="IA">IA</option>
<option value="ID">ID</option>
<option value="IL">IL</option>
<option value="IN">IN</option>
<option value="KS">KS</option>
<option value="KY">KY</option>
<option value="LA">LA</option>
<option value="MA">MA</option>
<option value="MD">MD</option>
<option value="ME">ME</option>
<option value="MI">MI</option>
<option value="MN">MN</option>
<option value="MO">MO</option>
<option value="MS">MS</option>
<option value="MT">MT</option>
<option value="NC">NC</option>
<option value="ND">ND</option>
<option value="NE">NE</option>
<option value="NH">NH</option>
<option value="NJ">NJ</option>
<option value="NM">NM</option>
<option value="NV">NV</option>
<option value="NY">NY</option>
<option value="OH">OH</option>
<option value="OK">OK</option>
<option value="OR">OR</option>
<option value="PA">PA</option>
<option value="RI">RI</option>
<option value="SC">SC</option>
<option value="SD">SD</option>
<option value="TN">TN</option>
<option value="TX">TX</option>
<option value="UT">UT</option>
<option value="VA">VA</option>
<option value="VT">VT</option>
<option value="WA">WA</option>
<option value="WI">WI</option>
<option value="WV">WV</option>
<option value="WY">WY</option>
</select>
<br />
<input type="text" name="zip" Value="Zipcode" size="5" onfocus="value=''"><font

color="red">*</font>
<br />
<textarea name="comments" rows="15" cols="40" value="comments" onfocus="value=''">
  </textarea>
<br />
<input type=button value="Submit">
<input type="reset" value="Clear Form">
</form>
<?php
      }//true == $show_form
?>

Hello,

I'm currently using this code to check for blank fields:

if(isset($_POST['submit']))
{
$emailconfirm = $_POST['emailconfirm'];
$user_message = $_POST['message'];
$name = $_POST['name'];
$visitor_email = $_POST['email'];
if(empty($name)|| empty($visitor_email)|| empty($user_message))
{
$errors .= "<div id='contact_form_errorloc' class='err1'>Some of the above fields have not been filled in.</div><br>";
}

This however, does not check for valid emails, I've found this code:

function is_valid_email($email) {
  $result = TRUE;
  if(!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,4})$", $email)) {
    $result = FALSE;
  }
  return $result;
}

My question was if the above is possible aswell as incorporating the blank field checks.

Many thanks!

Ubuntu
PHP
Mysql

So I got this form validator script online and I applied the validator part of it to my own form. My form requires a NAME and a SERIAL to be inputted and the SERIAL must be all numbers. I tested the validator by leaving NAME blank in my form and SERIAL all letters. The dispalyed resutls show the correct error messages: "Name : Please fill in a name for this computer." and "Serial : Please fill in a serial number for this computer." But the entry is still submitted with the errors and all.

Here is my validator script. It begins by calling the script I got online which is from this website: http://www.html-form-guide.com/php-form/php-form-validation.html
<?PHP
require_once "formvalidator.php";

    $validator = new FormValidator();
    $validator->addValidation("Name","req","Please fill in a name for this computer."):
    $validator->addValidation("Serial","req","Please fill in a serial number for this computer");
    $validator->addValidation("Serial","num","Serial number must be only numeric values");
    if($validator->ValidateForm())
    {
        echo "<h2>Validation Success!</h2>";
    }
    else
    {
        echo "<B>Validation Errors:</B>";

        $error_hash = $validator->GetErrors();
        foreach($error_hash as $inpname => $inp_err)
        {
            echo "<p>$inpname : $inp_err</p>\n";
        }       
    }
}
?>

This topic has been moved to JavaScript Help.

http://www.phpfreaks.com/forums/index.php?topic=330364.0

Hello all,   I am an absolute beginner when it comes to PHP and Javascript but wanted a simple contact form for my website. I used the PHP code from one source and the Javascript validator code from another source and all is working fine except for one very annoying bug: I have to press the Submit button twice in order for the form to send the email. I've found that if the validator is already triggered, however, I only need to press the button once for it to submit. I have scoured the internet for a solution to this problem but am realizing this must be a hangup in the particular code I'm using and I'm just not experienced enough to troubleshoot it.   A little help is greatly appreciated. Thank you for your time.   Here's the client side code (truncated to only show relevant parts):

<html>
<head>
<script src="js/gen_validatorv4.js" type="text/javascript"></script> 
</head>
 
<body>
<form method="post" action="contact.php" name="contactform">
    <div class="row collapse-at-2 half">
<div class="6u">
<input name="name" placeholder="Name" type="text" />
</div>
<div class="6u">
<input name="email" placeholder="Email" type="text" />
</div>
</div>
<div class="row half">
<div class="12u">
<textarea name="message" placeholder="Message"></textarea>
</div>
</div>
<div class="row half">
<div class="12u">
<ul class="actions">
<li><input type="submit" value="Send Message" /></li>
<li><input type="reset" value="Clear form" /></li>
</ul>
</div>
</div>
</form>
<script type="text/javascript">
var myformValidator = new Validator("contactform");
myformValidator.addValidation("name","req",
        "Please provide your name.");
myformValidator.addValidation("email","req",
        "Please provide your email.");
myformValidator.addValidation("message","req",
        "Please enter your message.");
myformValidator.addValidation("email","email",
        "Please enter a valid email address.");
</script>
</body>
</html>

 

I have posted this problem in the PHP section but someone suggested I take it here because the hangup is likely in the JS. I have tried removing the JS validator with varying results; sometimes the form still requires double-clicking and sometimes it works fine. Please see my original post below: