PHP - Need Advice Storing Variables

I am by no means a security expert, but I would like to know if storing MySQL database information in an environment variable would be a good or bad idea. What are your thoughts?

does anyone know how to decode this XML variable value into string values? I also need to know the oposite way: creating variable values into xml. I've tried several code examples but they did filter the requested data.

Code: [Select]
$xml='<?xml version="1.0" encoding="utf-8"?>
<elements>
<text identifier="ed9cdd4c-ae8b-4ecb-bca7-e12a5153bc02">
  <value/>
</text>
<textarea identifier="a77f06fc-1561-453c-a429-8dd05cdc29f5">
  <value><![CDATA[<p style="text-align: justify;">Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.</p>]]></value>
</textarea>
<textarea identifier="1a85a7a6-2aba-4480-925b-6b97d311ee6c">
  <value><![CDATA[<p style="text-align: justify;">Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy  eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed  diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum.  Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor  sit amet.</p>]]></value>
</textarea>
<image identifier="ffcc1c50-8dbd-4115-b463-b43bdcd44a57">
  <file><![CDATA[images/stories/red/cars/autobedrijf.png]]></file>
  <title/>
  <link/>
  <target/>
  <rel/>
  <lightbox_image/>
  <width><![CDATA[250]]></width>
  <height><![CDATA[187]]></height>
</image>
<text identifier="4339a108-f907-4661-9aab-d6f3f00e736e">
  <value><![CDATA[Kramer 5]]></value>
</text>
<text identifier="ea0666d7-51e3-4e52-8617-25e3ad61f8b8">
  <value><![CDATA[6000 RS]]></value>
</text>
<text identifier="90a18889-884b-4d53-a302-4e6e4595efa0">
  <value><![CDATA[Eindhoven]]></value>
</text>
<text identifier="410d72e0-29b3-4a92-b7d7-f01e828b1586">
  <value><![CDATA[APK Pick up and return]]></value>
</text>
<text identifier="45b86f23-e656-4a81-bb8f-84e5ea76f71f">
  <value><![CDATA[15% korting op grote beurt]]></value>
</text>
<text identifier="3dbbe1c6-15d6-4375-9f2f-f0e7287e29f3">
  <value><![CDATA[Gratis opslag zomerbanden]]></value>
</text>
<text identifier="2e878db0-605d-4d58-9806-8e75bced67a4">
  <value><![CDATA[Gratis abonnement of grote beurt]]></value>
</text>
<text identifier="94e3e08f-e008-487b-9cbd-25d108a9705e">
  <value/>
</text>
<text identifier="73e74b73-f509-4de7-91cf-e919d14bdb0b">
  <value/>
</text>
<text identifier="b870164b-fe78-45b0-b840-8ebceb9b9cb6">
  <value><![CDATA[040 123 45 67]]></value>
</text>
<text identifier="8a91aab2-7862-4a04-bd28-07f1ff4acce5">
  <value/>
</text>
<email identifier="3f15b5e4-0dea-4114-a870-1106b85248de">
  <value/>
  <text/>
  <subject/>
  <body/>
</email>
<link identifier="0b3d983e-b2fa-4728-afa0-a0b640fa34dc">
  <value/>
  <text/>
  <target/>
  <custom_title/>
  <rel/>
</link>
<relateditems identifier="7056f1d2-5253-40b6-8efd-d289b10a8c69"/>
<rating identifier="cf6dd846-5774-47aa-8ca7-c1623c06e130">
  <votes><![CDATA[1]]></votes>
  <value><![CDATA[1.0000]]></value>
</rating>
<googlemaps identifier="160bd40a-3e0e-48de-b6cd-56cdcc9db892">
  <location><![CDATA[50.895711,5.955427]]></location>
</googlemaps>
</elements>';

Let's see if I can explain this ok.. Basically I have a site and the page product categories use dynamically created URL's. I want to use these URL's to put on my products so I can list all the categories each product is in. But, as these URL's are not stored anywhere I'm not sure how to go about calling them. Is the best way going to be to modify the site to store the page URL's in MySQL? Or could they be stored within variables in PHP? A little guidance would be great! Thanks in advance 

Hi,
I am struggling with a form in php. I am trying to add a form by using the include function. I want to include thsi form on all pages so it would be very useful if I can save the current page name somewhere so that I can use to validate the form.

For example, this is the form I am trying to include.

<?php
if(!empty($errors))
{
if(isset($errors['sendError']))
{
echo '<p><strong class="error">There was a problem with our system please contact us directly.</strong></p>';
}
else
{
echo '<p><strong class="error">Please check the form below for errors.</strong></p>';
}
}
?>
<form action="index.php" method="post" id="form1">
<p>
<label><?php if(isset($errors['name'])) { echo '<span class="error">'; } ?>Name<font color="red">*</font>: <?php if(isset($errors['name'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['name']; ?>" name="name" size="60" align="right" style="background:#EEF5A4" />

<label><?php if(isset($errors['company'])) { echo '<span class="error">'; } ?>Company: <?php if(isset($errors['company'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['company']; ?>" name="company" size="60" align="right" />

<label><?php if(isset($errors['phone'])) { echo '<span class="error">'; } ?>Phone Number: <?php if(isset($errors['phone'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['phone']; ?>" name="phone" size="60" align="right" />

<label><?php if(isset($errors['email'])) { echo '<span class="error">'; } ?>Email<font color="red">*</font>: <?php if(isset($errors['email'])) { echo '</span>'; } ?></label>
<input id="search1" id="complete" type="text" value="<?php echo $form['email']; ?>" name="email" size="60" align="right" style="background:#EEF5A4" />

<label><?php if(isset($errors['enquiry'])) { echo '<span class="error">'; } ?>Enquiry: <?php if(isset($errors['enquiry'])) { echo '</span>'; } ?></label>
<textarea id="search1" id="complete" textarea name="enquiry" rows=4 cols=40 value="<?php echo $form['enquiry']; ?>" name="enquiry" size="60" align="right"></textarea>
</p>
<p>
<input type="submit" class="formbutton" value="Submit" />&nbsp;<input type="reset" class="formbutton" value="Reset" />
</p>
<p><font color="red">*</font> Denotes a required field</p>
</form>

Because I am going to use this form on all pages, I would like it to include whatever the filename is rather than index.php in the first line of the form so that when the user clicks submit, it will stay on the same page but validate the form based on the mandatory fields.

I don't know if the question is clear. I would very much appreciate any help at all.

Thank you very much.

Hi, i would like to know what is the best method to store a picture. Currently what happens, is each user has a different avatar, which when uploaded comes in a folder called Avatar, in my website folder and is also stored as a BLOB in mysql. I would like to know is this ok to store all avatars in one folder or some other step should be used and if so could some one guide me to a good tutorial. As I would also like to make an option, where people could upload their pictures, is it safe to store pictures in the same folder for all users or some how create a different folder for each user.

Hi, when a user logs out, I want to store the last activity in for the user. I have a db table users:

userID  userName  userPassword lastSession     lastActivity
=====  =======  ==========  ========    =======
1            bob            password         2011-08-09   About.html
2            dre             passwords       2011-09-23   Home.php


here is logout script:
===============
Code: [Select]
<?php
//run this script only if the logout button has been clicked
if(array_key_exists('logout', $_POST)) {
        require("connect.inc");
$username=$_POST["username"];
$updateLastSessionQuery=mysql_query("UPDATE users SET lastSession=NOW() WHERE userName='$username'");

// end session and redirect
//empty the $_SESSION array
    $_SESSION = array();

    session_destroy();
header("Location: xmlShredderLogin.php");  
    exit;
}//END IF for when logout submitted
?>

here is Index.php:
=============
Code: [Select]
<?php
session_start();
if(isset($_SESSION["isAuthenticated"])) {
require("logout.inc.php");
$username=$_POST["username"];
//print $username."<br />";
print '
<html>
<head><title>Home</title></head>
<body>
<form id="logoutForm" name="logoutForm" method="post" action="">
<input name="logout" type="submit" id="logout" value="Log out" />
<input type="hidden" name="usernameHidden" value='; print$username; print '/>
</form>';
mysql_connect("localhost","root");
mysql_select_db("someDB");
$getUserInfoQuery=mysql_query("SELECT lastSession,lastActivity FROM users WHERE userName='$userName'");
$getUserInfo=mysql_fetch_assoc($getUserInfoQuery);
print "Last session: ".$getUserInfo["lastSession"]."<br />";
print "Last activity: ".$getUserInfo["lastActivity"]."<br />";


Let's say the last page the user is on is Index.php, so what do I use to track the last page they are on?? I can't user a form b/c if I have to type in the last activity, that's nonsense! So far I have only figured out how to store the current time in last session (but this doesn't work either).

I just want to track the last page and then have a switch such as:
switch(type)
case 1:
$lastActivity="About.html";
case 2:
$lastActivity="somethingelse.php";


Any help much appreciated!

Code: [Select]
<?php $going='';
$name='<span id="name"></span>';
echo "$name";      //results : stevengoh   ---     wanted 
$going=substr($name, 1, 17);
echo "$name";   //results : <span id="going">     ----       don't want
?>
Is it possible to store in php the results of variable id="going" javascript instead of <span id="going"></span>?.

So, on my website, i have added a "last active" feature, so if someone is surfing the site, they can view when another users last page visit was.

so, every second, +1 is added to the $ts variable

what i have now, working and all, shows ONLY "NOW!", or ONLY "1 second", ONLY "___ seconds ago"... and so on

I have tred over, and over, and over to fix this to my liking, with more instances available, as an example, my current script will show somebody who is 13 months and 26 days inactive, just as "1 year", i want to see the "1 year, 1 month, and 26 days inactive"... or even simpler, just so it displays days/minutes/seconds/NOW!


function howlongtil($ts) {
   $ts=$ts - time();
   if ($ts<1)
       // <1 second
       return " NOW";
   elseif ($ts==1)
       // <1 second
       return $ts." second";
   elseif ($ts<60)
       // <1 minute
       return $ts." seconds";
    elseif ($ts<120)
       // 1 minute
      return "1 minute";
   
    elseif ($ts<60*60)
       // <1 hour
       return floor($ts/60)." minutes";
   elseif ($ts<60*60*2)
       // <2 hour
       return "1 hour";
     elseif ($ts<60*60*24)
       // <24 hours = 1 day
       return floor($ts/(60*60))." hours";
     elseif ($ts<60*60*24*2)
       // <2 days
       return "1 day";
     elseif ($ts<(60*60*24*7))
       // <7 days = 1 week
         return floor($ts/(60*60*24))." days";
   elseif ($ts<60*60*24*30.5)
       // <30.5 days ~  1 month
       return floor($ts/(60*60*24*7))." weeks";
     elseif ($ts<60*60*24*365)
       // <365 days = 1 year
       return floor($ts/(60*60*24*30.5))." months";
   else
       // more than 1 year
       return floor($ts/(60*60*24*365))." years";
};


anyone know how?

Im making a application but many users can access it at the same time, also the data that needs to be stored into the database in 3 parts firstly the user will enter some details the comany will fill out the reamining details and the user will then accept or decline the companies proposal. The issue im havign will it be easier to just store all of this information into session variables and then save them into the database at the end when all of the details are ready ?

Thank You

Can anyone tell me whats wrong with this:

The file uploads fine, the url however does not get posted to the database?
I added a 'or die' but it didn't execute...Do I need to move the query higher up the script?

<?php
include ('base.php');
$id = $_GET['id'];

if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg"))
&& ($_FILES["file"]["size"] < 20000))
  {
  if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "imgs/pictures/" . $_FILES["file"]["name"]);
      echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
      }
    }
  }
else
  {
  echo "Invalid file";
  }
$file = $_FILES["file"]["name"];
 $sql = "UPDATE `chillp_security`.`staff` SET `picture` = \'imgs/pictures/$file\' WHERE `staff`.`id` = $id;";
?>

Alright, the register/login system is fully working with sql injection, BUUUT now I want to store their IP Address. WHOLE new function that I've never dealt with before. So I need some help. Am I doing something wrong?

I have the IPadd in the database as INT(10) and then I went down to another drop down list and hit unsigned.
I feel like I'm doing something wrong with the field in the database..

{
$_SERVER['REMOTE_ADDR'] = $IPadd;
$sql = "INSERT INTO Member (username,createDate,password,firstName,email,IPadd) VALUES ('$username',NOW(),md5('$password'),'$firstName','$email',inet_aton('$IPadd'))";
mysqli_query($cxn,$sql);
$_SESSION['auth']="yes";
$_SESSION['username'] = $username;
header("Location: testing.php");
}

Hey guys,
What would you recommend to store db values for later?

the only thing I can come up with is doing it this way:

$result = mysql_query("SELECT * FROM users WHERE name='$user'");
while($row = mysql_fetch_array($result))
{
}
  {
and then using the $row['dbvariable'] later

is that the best way?

Hi Guys.

I need your help. Is it possible to store results from sql query as a variable. I am basically doing a few joins to get this result and I wanted to know if this was possible.

This seems really straight forward but I can't figure out why it's happening.  As a part of an account registration script, I'm randomly generating a password using a function called, generatePassword($length,$strength);
I hash the password (md5) before putting it in the database but I also email the non-hashed version to the user.  My problem is that each time I call the variable, it generates a new password so the one in the database does not match the one received by the user, $user_password_plain = generatePassword($length,$strength);
$user_password = md5($user_password_plain);
Is there a different way to store the variable so that I can access it later in the script and it will be the same?  I tried using a session variable but that didn't seem to work either.  Thanks!

Hi all,

I need to create a table which holds a list of values, for EG

1        PHP
2        MySQL
3        HTML
4        JS

The reason im doing this is so when a user visits X page on my site, they are presented with a list of possible options which they can tick, for instance if you were asked what languages your fluent with you would tick HTML and JS (or w/e applies to you)

What would be the best way of constructing the table?

Thanks