PHP - Reliable Web Host Versus Diy Hosting

When sending data via $_POST for example, I've seen the data get filtered with both mysql_real_escape_string or htmlspecialchars

When should you use one or the other?

I initially set up a few VAR items to learn some JS coding.   Then it became apparent that altering the group and entering them into an array would be more effective.   However, my limited knowledge is confusing the situation.   Is there a simple comparison (with proper code and formatting) that someone can provide?   Example:  student in the school info desired: name, age, hair color, eye color   As separate VAR listings I cannot sort by age, so I create an array, but how can I name them student 1, 2, 3 etc.  (or do I not want to??).

Is there anything different between a response and a responder?  My thought is maybe a response is something that one application gives to another, and a responder is used only by a single application to create a response.

interface TrendInterface
{
    public function getResponse($blabla):TrendResponse;
    public function getResponder($blabla):TrendResponder;
}

 

Hi, I found a tutorial online for a form which used PHP/MySQL and JQuery to submit data. I am making some modifications and the form no-longer submits the data. The problem I have is no errors display so I am not sure where the problem lies. I need to be able to display a success or failure message on the form itself, but this is either not there or not working. The code is below.

Code: [Select]
<form id="ContactForm" action="">
                <p>
                    <label>First Name</label>
                    <input id="FirstName" name="FirstName" class="inplaceError" maxlength="120" type="text" autocomplete="off"/>
<span class="error" style="display:none;"></span>
                </p>
                <p>
                    <label>Last Name</label>
                    <input id="LastName" name="LastName" class="inplaceError" maxlength="120" type="text" autocomplete="off"/>
<span class="error" style="display:none;"></span>
                </p>
                <p>
                    <label>User Name</label>
                    <input id="UserName" name="UserName" class="inplaceError" maxlength="120" type="text" autocomplete="off"/>
<span class="error" style="display:none;"></span>
                </p>
                <p>
                    <label>Email</label>
                    <input id="email" name="email" class="inplaceError" maxlength="120" type="text" autocomplete="off"/>
<span class="error" style="display:none;"></span>
                </p>
                <p>
                    <label>Website<span>(optional)</span></label>
                    <input id="website" name="website" class="inplaceError" maxlength="120" type="text" autocomplete="off"/>
                </p>
                <p>
                    <label>Your message<br /> <span>300 characters allowed</span></label>
                    <textarea id="message" name="message" class="inplaceError" cols="6" rows="5" autocomplete="off"></textarea>
<span class="error" style="display:none;"></span>
                </p>
                <p class="submit">
                    <input id="send" type="button" value="Submit"/>
                    <span id="loader" class="loader" style="display:none;"></span>
<span id="success_message" class="success"></span>
                </p>
<input id="newcontact" name="newcontact" type="hidden" value="1"></input>
            </form>


<?php
require_once("config.php"); /* Configuration File */

class DB{

private $link;

public function __construct(){
$this->link = mysqli_connect(DB_SERVER, DB_USER, DB_PASS,DB_NAME);
if (mysqli_connect_errno())
    exit();
}

public function __destruct() {
mysqli_close($this->link);
}

public function dbNewMessage($email,$FirstName,$LastName,$website,$message){
$email    = mysqli_real_escape_string($this->link,$email);
$FirstName  = mysqli_real_escape_string($this->link,$FirstName);
$LastName  = mysqli_real_escape_string($this->link,$LastName);
$UserName  = mysqli_real_escape_string($this->link,$UserName);
$website  = mysqli_real_escape_string($this->link,$website);
$message  = mysqli_real_escape_string($this->link,$message);

mysqli_autocommit($this->link,FALSE);

$query = "INSERT INTO contact_me(pk_contact,FirstName,LastName,UserName,email,website,message) 
  VALUES('NULL','$FirstName','$LastName','$UserName','$email','$website','$message')";
mysqli_query($this->link,$query);

if(mysqli_errno($this->link))
return -1;
else{
mysqli_commit($this->link);
return 1;
}
}   
};
?>





<?php
require_once("db.php"); /* Database Class */
require_once('utils/is_email.php'); /* Email Validation Script */

/* Handle Ajax Request */
if(isset($_POST['newcontact'])){
$contact = new Contact();
unset($contact);
}
else{
header('Location: /');
}

/* Class Contact */
class Contact{

private $db;  /* the database obj */

private $errors  = array();  /* holds error messages */
private $num_errors;    /* number of errors in submitted form */

public function __construct(){
$this->db = new DB();
if(isset($_POST['newcontact']))
$this->processNewMessage();
else
header("Location: /");
}

public function processNewMessage(){

$email = $_POST['email'];
$FirstName = $_POST['FirstName'];
$LastName = $_POST['LastName'];
$UserName = $_POST['UserName'];
$website = $_POST['website'];
$message = $_POST['message'];

/* Server Side Data Validation */

/* Email Validation */
if(!$email || mb_strlen($email = trim($email)) == 0)
$this->setError('email','required field');
else{
if(!is_email($email))
$this->setError('email', 'invalid email');
else if(mb_strlen($email) > 120)
$this->setError('email', 'too long! 120');
}

/* FirstName Validation */
if(!$FirstName || mb_strlen($FirstName = trim($FirstName)) == 0)
$this->setError('FirstName', 'required field');
else if(mb_strlen(trim($FirstName)) > 120)
$this->setError('FirstName', 'too long! 120 characters');

/* LastName Validation */
if(!$LastName || mb_strlen($LastName = trim($LastName)) == 0)
$this->setError('LastName', 'required field');
else if(mb_strlen(trim($LastName)) > 120)
$this->setError('LastName', 'too long! 120 characters');

/* UserName Validation */
if(!$UserName || mb_strlen($UserName = trim($UserName)) == 0)
$this->setError('UserName', 'required field');
else if(mb_strlen(trim($UserName)) > 120)
$this->setError('UserName', 'too long! 120 characters');

/* Website Validation */
if(!mb_eregi("^[a-zA-Z0-9-#_.+!*'(),/&:;=?@]*$", $website))
$this->setError('website', 'invalid website');
elseif(mb_strlen(trim($website)) > 120)
$this->setError('website', 'too long! 120 characters');

/* Message Validation */
$message = trim($message);
if(!$message || mb_strlen($message = trim($message)) == 0)
$this->setError('message','required field');
elseif(mb_strlen($message) > 300)
$this->setError('message', 'too long! 300 characters');

/* Errors exist */
if($this->countErrors() > 0){
$json = array(
'result' => -1, 
'errors' => array(
array('name' => 'email' ,'value' => $this->error_value('email')),
array('name' => 'FirstName' ,'value' => $this->error_value('FirstName')),
array('name' => 'LastName' ,'value' => $this->error_value('LastName')),
array('name' => 'UserName' ,'value' => $this->error_value('UserName')),
array('name' => 'website' ,'value' => $this->error_value('website')),
array('name' => 'message' ,'value' => $this->error_value('message'))
)
);
$encoded = json_encode($json);
echo $encoded;
unset($encoded);
}
/* No errors, insert in db*/
else{
if(($ret = $this->db->dbNewMessage($email, $FirstName, $LastName,$UserName, $website, $message)) > 0){
$json = array('result'  => 1); 
if(SEND_EMAIL)
$this->sendEmail($email,$name,$website,$message);
}
else
$json = array('result'  => -2); /* something went wrong in database insertion  */
$encoded = json_encode($json);
echo $encoded;
unset($encoded);
}
}

public function sendEmail($email,$name,$website,$message){
/* Just format the email text the way you want ... */
$message_body = "Hi, ".$name."(".$email." - ".$website.") sent you a message from yoursite.com\n"
."email: ".$email."\n"
."message: "."\n"
.$message; 
$headers = "From: ".EMAIL_FROM_NAME." <".EMAIL_FROM_ADDR.">";

return mail(EMAIL_TO,MESSAGE_SUBJECT,$message_body,$headers);
}

public function setError($field, $errmsg){
$this->errors[$field]  = $errmsg;
$this->num_errors  = count($this->errors);
}

public function error_value($field){
if(array_key_exists($field,$this->errors))
return $this->errors[$field];
else
return '';
}

public function countErrors(){
return $this->num_errors;
}
};
?>


and the JQuery
Code: [Select]
$(document).ready(function() {
contact.initEventHandlers();
});
var contact = {
initEventHandlers : function() {
/* clicking the submit form */
$('#send').bind('click',function(event){
$('#loader').show();
setTimeout('contact.ContactFormSubmit()',500);
});
/* remove messages when user wants to correct (focus on the input) */
$('.inplaceError',$('#ContactForm')).bind('focus',function(){
var $this = $(this);
var $error_elem = $this.next();
if($error_elem.length)
$error_elem.fadeOut(function(){$(this).empty()});
$('#success_message').empty();
});
/* user presses enter - submits form */
$('#ContactForm input,#ContactForm textarea').keypress(function (e) {
if ((e.which && e.which == 13) || (e.keyCode && e.keyCode == 13)) { 
$("#send").click();
return false; 
}
else 
return true; 
});
},
ContactFormSubmit : function() {
$.ajax({
   type : 'POST',
   url : 'php/contact.php?ts='+new Date().getTime(),
   dataType : 'json',
   data : $('#ContactForm').serialize(),
   success : function(data,textStatus){
  //hide the ajax loader
  $('#loader').hide();
  if(data.result == '1'){
      //show success message
  $('#success_message').empty().html('Message sent');
  //reset all form fields
  $('#ContactForm')[0].reset();
  //envelope animation
  $('#envelope').stop().show().animate({'marginTop':'-175px','marginLeft':'-246px','width':'492px','height':'350px','opacity':'0'},function(){
      $(this).css({'width':'246px','height':'175px','margin-left':'-123px','margin-top':'-88px','opacity':'1','display':'none'});
  });
  }
  else if(data.result == '-1'){
  for(var i=0; i < data.errors.length; ++i ){
      if(data.errors[i].value!='')
          $("#"+data.errors[i].name).next().html('<span>'+data.errors[i].value+'</span>').fadeIn();
  }
  }  
  },
   error : function(data,textStatus){}
});
} 
};

I know that magic __get and __set are invoked automatically when an object is instantiated, but what about stuff like getName() and setName()

Code: [Select]
class NameClass {
private $_name;
public function getName() {
return $this->_name;
    }
public function setName($value) {
$this->_name = $value;
    }
}

$someName = new NameClass();
$someName->setName('Bob');
echo $someName->getName();
1. Could the setName() and getName() just as easily be named something generic like:

hotName()
coldName()

Code: [Select]
class NameClass {
private $_name;
public function hotName() {
return $this->_name;
    }
public function coldName($value) {
$this->_name = $value;
    }
}

$someName = new NameClass();
$someName->coldName('Bob');
echo $someName->hotName();
2. Also, the setName() and getName() methods must be called manually, right? Unless they are manually called, they just sit there, do nothing, am I correct?

Thanks

good day dear community,


this is a big issue. I have to decide: between native PHP DOM Extension or of simple DOM html parser

well i want to parse the site he http://buergerstiftungen.de/cps/rde/xchg/SID-A7DCD0D1-702CE0FA/buergerstiftungen/hs.xsl/db.htm

http://buergerstiftungen.de/cps/rde/xchg/SID-A7DCD0D1-702CE0FA/buergerstiftungen/hs.xsl/db.htm

I will suggest to use the native PHP "DOM" Extension instead of "simple html parser", since it will be much faster and easier

What do you think about this one here...:

Code: [Select]
$doc = new DOMDocument
@$doc->loadHTMLFile('...URL....'); // Using the @ operator to hide parse errors
$contents = $doc->getElementById('content')->nodeValue; // Text contents of #content


look  forward to hear from you

best regards
db1

Hello,  I am new.  I have created a very simple webpage that has content the changes when a link is clicked.  The site works perfectly on my "localhost".  I am running Apache 2.2 and PHP 5.3 on localhost.  When I upload to my GoDaddy shared hosting, ( I beleive Apahe 1.3 and PHP 5.2) my "index.php" displays fine on load. However, when any of the links are clicked the content area where it is supposed to change disapeears. Here is a sample of the code that I am using:


// These are the links in the index.php
html code...
<li><a href="index.php?id='home'" id="home" name="home">Home</a></li>
<li><a href="index.php?id='form'" id="form" name="form">Register</a></li>
<?php
include("form1.php");
                getPage();
                ?>

html....
Then on the form1.php page is the following code...

function getPage()
{
    $linkID = $_GET['id'];
    if ($linkID == NULL)
    {
        changeBool("'home'");
    }
    else
    changeBool($linkID);
}

//end example

The function "changeBool()" has a switch structure that is determined by the $_GET[] var.
I beleive this has something to do with the php.ini settings, possibly the apache settings...any ideas would be greatly appreciated.

Hello - I have usually run my own servers, and always drop my .php files with MYSQL connection strings in a directory like /var, with webroot being /var/www/mysite.

I now find myself in a shared hosting environment for a client and wondering the safety of my connection string .php files.  Unfortunately they are sitting in a folder in the root of my hosting directory right now, and they feel vulnerable.

It seems the only thing I could do would be to put the root of my hosting into a subdirectory, point the site there, and then put my connection strings on directory back.  But seems the problem is they are still in my shared hosting.

What's the best way to secure this type of sensitive info in a shared environment?  I'm also getting ready to explore credit card processing via an API, and wondering if shared hosting is even worth it.

Thanks!!

Hello, we got a site running in to different servers, the other one is a sub domain that will  be use as internal pages and the other one is external. As of that I need to pass session to see if a user details.   Is there a another secure way to pass session data to other server without storing on the database?

Hi;

I had an email from my hosting company which said that my account was hacked and one script in images folder is trying to send thousands of spams(file name : "/public_html/images/sm5vy7.php"). they blocked my account and asked me to check if there is any script or code that may cause this problem.
The only server side page I had was a contact.php file that has mail() function in it. the code is like this;

"if( isset($_POST['submit'])) {
$name=$_POST['name'];
$comment=$_POST['comment'];
$email=$_POST['email'];
$phone=$_POST['phone'];
$to = "sample@gmail.com";
$subject = "sample";
$message = "sample";
$from = "$email";
$headers = "Content-type:text;charset=utf-8" . "\r\n";
$headers .= "From: $from" . "\r\n";
mail($to,$subject,$message,$headers);
}"

My question is "can the code I used cause any security problem that someone be able to create a php file in my images folder or someone has accessed my account?"

Thank you in advance
I'm really in a big trouble

Hey Friends,   I am new to this forum, and does not know anything about programming. And I require very small help from the experts of forum. I have downloaded free image hosting script from web & it is not working fine, it gets stuck at basic.php (one of the file in script). I am sharing the script here also sharing the website. My website : bsm1313.5gbfree.com   Note : I have uploaded a rar file. Kindly change extension to .rar from .php. as it was not allowing me to upload the rar file.   Any kind of help is highly highly appreciated. Thanks a ton in advance.     Attached Files  easyimagehoster_1.32.php   35.46KB   5 downloads

Hello guys, I have created a mini image hosting website. Well, I have successfully coded the file upload, including security to allow certain image extensions and size as a beginner in PHP.

However, only one thing remains is the image link. You can view the website on this address http://mini-image-hosting.99k.org/ where it is currently hosting on a free web hosting account with a free sub-domain.

Right now, only the image can be uploaded and is being stored in a directory. Nevertheless, I want that when the person uploads an image, he gets also the link, for example: http://mini-image-hosting.99k.org/xxx.jpg something like that.

Can you help me for this?

I'm running about 50 domains on a private host that's going out of business, so I need to move providers soon. The Amazon or Google cloud platforms are intriguing. Does anyone have any experience using either for website hosting?   My current solution is a Plesk management interface. So, I'm hoping to install the same wherever I go (because migrating 50 domains manually ...)

Code: [Select]
<div id="recent">
<p class="title"><?php echo "Staff Picks"; ?></p>
<div id="gallery">
<?php $i = 0; while($album = mysql_fetch_row($recent)): ?>
<?php if(++$i%4 == 1): ?><div><?php endif; ?>
<?php $image = mysql_fetch_row(mysql_query('SELECT `id`, `extension` FROM `image` WHERE `album_id`='.$album[0].' ORDER BY `id` DESC LIMIT 0,1')); ?>
<a href="<?php echo WEB; ?>a/<?php echo alphaID($album[0]); ?>">
<img src="<?php echo WEB; ?>small/<?php echo alphaID($image[0]); ?>.<?php echo $image[1]; ?>" alt=""/>
</a>
<?php if($i%4 == 0): ?></div><?php endif; ?>
<?php endwhile; ?>
<?php if($i%4 != 0): ?></div><?php endif; ?>
</div>
I have this code, which on my image hosting website, displays a grid of the latest albums of images that users upload. I really have no experience in Php.

I to change this code to simply display a grid of albums that i choose, not the latest. Like 'staff picks' instead of 'most recent'.


Any help would be greatly appreciated.

I am creating a news updates thing for my website and i have managed to get it working on my home PC (im using XAMPP) but when i upload to my webhost it doesnt appear to work.
I am wondering if it is just my host or whether i have done something wrong and by chance it works on my home PC.

Here is my code:
<?php
include("includes.php");

doConnect();

$get_news = "SELECT title, text, DATE_FORMAT(datetime, '%e %b %Y at %T') AS datetime FROM newsfeed ORDER BY datetime DESC";

$result= mysqli_query($mysqli, $get_news)
or die(mysqli_error($mysqli));

while ($row = mysqli_fetch_array($result)) {
echo '<strong>'. $row['title'] .' </strong><br>'. $row['text'] .'<br>'. $row['datetime'] .'<br><br>';}


?>

My includes file is:
<?php

function doConnect() {
global $mysqli;

//connect to server and select database
$mysqli = mysqli_connect("localhost", "user", "password", "dbname");

//if connection fails, stop script execution
if (mysqli_connect_errno()) {
printf("Connection failed: %s\n", mysqli_connect_error());
exit();
}
}
?>

I think im right in saying it connects properly because i do not see an error.

what i get is:
Code: [Select]
'. $row['title'] .'
'. $row['text'] .'
'. $row['datetime'] .'

';} ?>
Im new to PHP (incase you hadnt guessed!) so not really sure whats happening.
On my home PC i have PHP Version 5.3.1 and on my webhost its 5.2.14. Home PC mySQL version 5.1.41 and on webhost its 5.0.91-community. Could this be the reason?

Thanks