PHP - Question On Converting Existing Site From Mysql_* To Pdo
Hey y'all. Hopefully quick question on something I've not come across before.
I am doing a quick and dirty update on an existing site that is using the mysql_* functions to use PDO, and I'm wondering how much of a corollary there is between the mysq_real_escape_string() function and PDO::quote() method. We had a sanitization method that returned the submitted string after running mysql_real_escape_string() on it, and I've updated it to return the string after passing it through quote(). What I'm noticing in phpMyAdmin, though, is that new records inserted using the quote() sanitize don't encode quotes or add slashes or evidence any of the things that apparently mysql_real_escape_string() used to do (I always used a different scrub method in the past so I'm really not familiar with how it works under the hood).
Is using quote() going to offer an equivalent level of protection against injection?
Hopefully I'll get the go-ahead to take the time and revamp all the queries to use prepared statements, but right now that's not in the cards. At least the old site did abstract database interaction so I'm not chasing mysql_* functions all over the site...
Any opinions and thoughts are very much welcome and thanks in advance!
Similar TutorialsHello and good day to all of you I have passed my midterms project(Online Shopping) with a score of 94 in PHP ( Click here to see file ) ( Sorry if the design is too ugly, I'm just new in programming XD ) Now our finals project will be a PHP site again but now with a database in it.. So instead of making a new project/design for a site, why not just add a database to my existing midterms? I would like to ask for some help here in helping me on connecting to the database, adding a database/tables and anything that would be of help like suggesting Databases would be like, - Users ( Admin and Members ) - Upper Clothing ( Shirts, Jackets, Long Sleeves, Raglan and etc ) - Lower Clothing ( Pants, Shorts, Boxers and etc ) - Stock on a current item - Single member's Transaction History - All user's Transaction History Is there a way that I could add those database named above to my project? Thank you in advance! I am curious if it is true that mysql_ extension is being depreciated in the next upcoming versions of php? Has anyone heard about if that is actually going to happen? Hey all.
Obviously, the mysql_* functions are deprecated and have been for quite some time now, and will be removed soon. As of 5.5, using them should result in an E_DEPRECATED error, so it looks like we're getting closer to that happening. My question is - has anybody read or heard a reliable statement as to which future version will officially remove even legacy support for the functions? Like 5.x, 7.0, etc?
A Google search isn't returning anything official so far as I can see, and I was curious.
This topic has been moved to Miscellaneous. http://www.phpfreaks.com/forums/index.php?topic=323879.0 How should i input language file into db and then output it with user selected language?
$username = 'KELLY'; $offerName = 'Crowd Flower'; $amount = '30'; $currency = 'points'; $lang['text']['a_001'] = '%a has just completed the %b offer worth %c %d.';// ENGLISH // $input = str_replace(array('%a','%b','%c','%d'), array($username, $offerName, $amount, $currency), $lang['text']['a_001']); print $input; Edited by davidolson, 14 November 2014 - 11:04 AM. This topic has been moved to Application Design. http://www.phpfreaks.com/forums/index.php?topic=353404.0 What is the best practice for using site-wide constants in a class? E.g. COMPANY_NAME is set in a config file and used on many pages. How would it be best to use this in a class. I'm guessing just calling COMPANY_NAME anywhere in the class would not be considered best practice. Thanks. In one of my pages I have a section which contains a hidden line of text. When the user clicks a button the box containing the text will expand showing the line more clearly. I want this to happen live i.e. no page refresh/reload. I've seen such things done on other sites but my question is, is this done using a php function or is JavaScript required to achieve this? I assume that in order for any php functions to take place there must be a page refresh to reload the data/parameters/variables that are required? The site I'm referring to is this one:- http://www.vouchercodes.co.uk/featured-voucher-codes.html If you click on the "Get code and open site" buttons there for any of the vouchers the area expands live and the voucher is revealed however as I say there is no page refresh and it is done live. Is this effect done in JavaScript and not php or is there some way of using php alone to do something similar? Obviously including JScript in a site is more risky as if a user does not have it installed/activated then they may not be able to use such elements hence the reason I want to know how it is done. I wrote this basic script yesterday to process and generate a Google Site Map. And it works! BUT I want to advance this script to accommodate for something else and I don't know the correct path to take from here, but I will tell you what I've found out so far.. Current Situation: 1 - Currently my below script generates urls in the site map like: http://abcdefg.com/index.php?dispatch=products.view&product_id=29826 2 - I have .htaccess configured to rewrite the urls to the products name data like: http://abcdefg.com/pennies/wheat-pennies/lincoln-wheat-penny-cent.html (just an example) and these urls are ONLY active if clicking on the site links themselves - meaning if I enter: http://abcdefg.com/index.php?dispatch=products.view&product_id=29826 directly into the url, the url does not resolve to this natural friendly url name. What Id like to achieve (which I don't know what direction I should be looking!): - I'd like my xml output urls (as current) to be written in the natural format (as in #2 above). FYI here is a current example output item in my sitemap: Code: [Select] <url> <loc>http://abcdefg.com/index.php?dispatch=products.view&product_id=29803</loc> <changefreq>weekly</changefreq> <lastmod>2010-09-24T08:00:00+04:00</lastmod> </url> Can anyone give me some guidance on what method might work for this? Do you think it's more a mod_rewrite issue? Or can this be handled easier with straight up modifications to my below? I'm just a bit confused on what direction I should be looking.. Thanks for any input. <?php header("Content-Type: text/xml;charset=iso-8859-1"); echo '<?xml version="1.0" encoding="UTF-8"?> <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">'; //include('config.local.php'); $cxn = mysqli_connect($config['db_host'], $config['db_user'], $config['db_password'], $config['db_name']); $query = "SELECT cscart_product_descriptions.product_id, cscart_products.product_id, cscart_products.timestamp FROM cscart_product_descriptions JOIN cscart_products ON cscart_product_descriptions.product_id = cscart_products.product_id WHERE cscart_products.status='A' LIMIT 10000"; $result = mysqli_query($cxn, $query); $row = mysqli_fetch_array($result); while ($row = mysqli_fetch_array($result)) { $formatedTime = $row['timestamp']; echo '<url> <loc>http://abcdefg.com/index.php?dispatch=products.view&product_id=' . $row['product_id'] . '</loc> <changefreq>weekly</changefreq> <lastmod>'. date('c',$formatedTime) .'</lastmod> </url>'; } //while ($row = mysqli_fetch_array($result)) echo '</urlset>'; ?> Is there a way to instantiate a PDO object using an already existing database connection? Or does PDO detect an already opened connection and use it? The existing connection is a persistant connection. I spent some time "Googling" today but all I found was how to create PDFs on the fly. What I wonder is if it is possible to print text on an existing PDF. And if so, could I get some pointer where to obtain this knowledge? Simply put. I have a PDF form that is not yet filled out. I would like to be able to look up an address and other information in a database, and use that information to print on the existing PDF file. Any help is much appreciated. Can anyone help me please, I am trying to place a PHP calendar into an existing DIV tag that used to hold a flash slideshow application, but we want to replace that with a calendar. Here is my code: Code: [Select] echo '<div class="grid_9"> <div class="box"> <h2>'.$titleone.'</h2> <div class="block">'; if (!defined('BLOCK_FILE')) { Header('Location: ../index.php'); die(); } $modName = 'GCalendar'; $blockConfig = array('maxTitle' => 21, 'eventPrefix' => '• ', 'maxEvents' => 10, 'lookahead' => 2, 'twoColumn' => false, 'excludeCats' => array(), 'force_center' => false, ); require_once 'modules/' . $modName . '/language.php'; gcalGetLang($modName); require_once 'modules/' . $modName . '/gcal.inc.php'; require_once 'modules/' . $modName . '/common.inc.php'; require_once 'modules/' . $modName . '/getMonthlyEvents.php'; require_once 'modules/' . $modName . '/gcalBlock.php'; $config = getConfig(); list($year, $month, $today) = explode(',', date('Y,n,j')); $block = new GCalBlock($year, $month, $today, $config, $blockConfig); $content = $block->calendar(); $content .= '<br />'; $content .= $block->upcomingEvents(); echo '</div> </div> </div>'; When I try this above, I just get an 'Too many page loads' error, so I'm not sure what I've done wrong. Any help appreciated. Regards, Tree Hi all, I have PDF file online i want to edit dynamic footer and page no. at the end of page. Can anyone help me ? thanks in Advance. Manoj I would like to support UTF-8 on my website but am unsure - and quite fearful - whether it will break my existing code or not?! I looked at http://us3.php.net/mbstring(), but worry that I'm going to miss something. Here is some sample code where I think things could easily break... // Trim all Form data. $trimmed = array_map('trim', $_POST); // ************************ // Validate Form Data. * // ************************ // Validate First Name. if (empty($trimmed['firstName'])){ // No First Name. $errors['firstName'] = 'Enter your First Name.'; }else{ // First Name Exists. if (preg_match('#^[A-Z \'.-]{2,30}$#i', $trimmed['firstName'])){ // Valid First Name. $firstName = $trimmed['firstName']; }else{ // Invalid First Name. $errors['firstName'] = 'First Name must be 2-30 characters (A-Z \' . -)'; } }//End of VALIDATE FIRST NAME // Validate Username. if (empty($trimmed['username'])){ // No Username. $errors['username'] = 'Enter your Username.'; }else{ // Username Exists. if (preg_match('~(?x) # Comments Mode ^ # Beginning of String Anchor (?=.{8,30}$) # Ensure Length is 8-30 Characters .* # Match Anything $ # End of String Anchor ~i', $trimmed['username'])){ // Valid Username. // ****************************** // Check Username Availability. * // ****************************** // Build query. $q1 = 'SELECT id FROM member WHERE username=?'; // Prepare statement. $stmt1 = mysqli_prepare($dbc, $q1); // Bind variable to query. mysqli_stmt_bind_param($stmt1, 's', $trimmed['username']); // Execute query. mysqli_stmt_execute($stmt1); // Store results. mysqli_stmt_store_result($stmt1); // Check # of Records Returned. if (mysqli_stmt_num_rows($stmt1)>0){ // Duplicate Username. $errors['username'] = 'This Username is taken. Try again.'; }else{ // Unique Username. $username = $trimmed['username']; } }else{ // Invalid Username. $errors['username'] = 'Username must be 8-30 characters.'; } }//End of VALIDATE USERNAME Three possible areas where I could run into trouble are with... 1.) array_map 2.) preg_match 3.) Prepared Statements For #2, I see there is mb_ereg_match but I am not sure if I just replace my current Regex function with that one, or if there is more involved. I'm not sure if any problems would arise with #1 or #3 or elsewhere, and would really appreciate a second set of eyes on this code!! requinix said switching is a good idea, but I'm pretty freaked out that I'm going to break things and create a big security hole?! Any help would be appreciated!! Thanks, Debbie index.php <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" > <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8" /> <meta http-equiv="Content-language" content="en" /> <link type="text/css" rel="stylesheet" href="css/reset.css" /> <link type="text/css" rel="stylesheet" href="css/960.css" /> <link type="text/css" rel="stylesheet" href="css/custom.css" /> <title>BAY AREA REMOTE CONTROL SOCIETY</title> </head> <body> <div id="wrapper" class="container_12"> <div id="header" class="grid_12"> <div id="left-header" class="grid_5 alpha"></div> <div id="newsflash" class="grid_7 omega"><?php include('content/newsflash.php'); ?></div> </div> <div id="leftmenu" class="grid_3"><?php include('content/menu.php'); ?></div> <div id="maincontent" class="grid_9"><?php include('content/maincontent.php'); ?></div> <div id ="footer" class="grid_12"><?php include('content/footer.php'); ?></div> </div><!-- end wrapper --> </body> </html> menu.php <?php ?> <div class="content"> <ul id="menu"> <li><a href="index.php?page=testpage"><span>Home</span></a></li> <li><a href="index.php?page=about"><span>About us</span></a></li> <li><a href="index.php?page=schedule"><span>Schedule</span></a></li> <li><a href="index.php?page=media"><span>Media</span></a></li> <li><a href="index.php?page=products"><span>Products</span></a></li> <li><a href="index.php?page=misc"><span>Miscellaneous</span></a></li> </ul> </div> When I click HOME on the Menu program it works fine but it does not clear the content of maincontent.php. How do I do that? Okay so I have a time in the format yyyy-mm-dd that is pulled from a MySQL array row and I need to add one month to it then echo that out. I assume it has something to do with the strtotime() and date() functions but I have tried every combination and cannot figure it out. Can I get some assistance please and thank you? Very very very new to php. Here is what I have lol; Code: [Select] $row=mysql_fetch_array($result); $ddaterow=$row['donation_date']; Like I said the date will always be in the format yyyy-mm-dd <?php if(!isset($_SESSION)) { session_start(); } // UNCOMMENT NEXT LINE TO PRINT THE $_SESSION ARRAY TO THE SCREEN . . . // echo '<pre>'; print_r($_SESSION); echo '</PRE>'; if(empty($_SESSION['userID']) || $_SESSION['authorized'] != true ) { header("Location: login.php"); exit; } ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="EN" dir="ltr" xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content-type" content="text/xml; charset=utf-8" /> <meta http-equiv="refresh" content="5;url=editprofile.php"> <title>Saving Profile</title> </head> <body> <?php require_once ("dbconn.php"); ?> <?php $userID = $_SESSION['userID']; $insert_query = 'insert into users WHERE userID='$userID'( aim, msn, yim, psnID, xblGamertag, otherContact ) values ( "' . $_POST['aim'] . '", "' . $_POST['msn'] . '", "' . $_POST['yim'] . '", "' . $_POST['psnID'] . '", "' . $_POST['xblGamertag'] . '", "' . $_POST['otherContact'] . '" )'; mysql_query($insert_query); ?> Your profile has been saved! You will now be redirected from where you came from. <br /><a href="editprofile.php" title="Click here if you don't want to wait">Click here if you don't want to wait.</a> </body> </html> It creates a new record but I want it to update an existing one. It's an editprofile script. Hey, I have just started using cookies and have got the basic idea of creating and accessing the simple cookies but now I am wanting to be able to check if a cookie already exists on the users computer before overwriting the current one. Code: [Select] <?php if(!isset($_COOKIE['testCookie'])){ setcookie("TestCookie", "username", time() + (24 * 60) ) } ?> <html>....</html> At the moment my page just doesn't get past this piece of code any ideas? Cheers Hi guys, using the code below within an admin panel to create a drop down allowing the user to select the profiles they wish to assign to the record they're creating, problem we have is that once a record is created, if they need to edit it for what ever reason the selected profile option isn't sticking. I've played around with lots of variants of if existing_record to try and get it add selected="selected" into the code but failed at every attempt, any advice gratefully received. Code: [Select] <?php // List only breeder profiles in the database echo '<select name="profile" class="textinput noborder">'; echo '<option value="any">Any</option>'; $qryGetDistinctProfile = "SELECT * FROM profiles ORDER BY title ASC"; $resGetDistinctProfile = mysql_query($qryGetDistinctProfile,$connection) or die(mysql_error()); if(mysql_num_rows($resGetDistinctProfile) > 0){ $id = mysql_result($resProfile, 0, "id"); while ($row = mysql_fetch_assoc($resGetDistinctProfile)){ echo '<option value="'.$row['id'].'" >'.$row['title'].'</option>'; } } echo '</select>'; ?> |