PHP - Getting Related Field As Substitute Using Php Query

Hi,

I am new to the boards and php and mysql.

I have created a database and can add entries via a form. I can query the database with another form and get the results to display in a table.

All good so far as that is what I was hoping to achieve but one of the fields I want to display as a hyperlink but I am having problems with the syntax as I keep getting errors when I try to wrap the variables in  <a href > tag.

Code: [Select]
<tr>
<td><?php echo $fquery['prefix']; echo $fquery['website']; ?><?php echo $fquery['website']; ?></td>
</tr>


now that displays e.g. http://www.example.comwww.example.com.

so I feel I am nearly there I just need advice as to how to construct a hyperlink from the fields queried.

Hi there.  I'm totally new (about a week!) with php and mysql and am encountering a problem that perhaps someone can help me with? I've looked through to see if a similar problem has appeared or been solved, but without success, so apologies if I am repeating something.    In php I am trying to update 7 fields from a form from which a user has edited/modified any of the fields in a chosen record (except id).   Here is the code:   $id=$_GET['id'];

In previous posts you have said that my web site security is no security at all and recommemded standard(?) php programs which utilize the hosts .htaccess folder. I have looked at them and being a beginner at mySQL and php, they are really complicated.

A technical rep at my host says I can do the exact same thing by going into cPanel/Security/Password Protect Directories and setting up a password for the directory. He says then the user will be prompted for the password when they try to access the site. And I do not have to write one single line of code.

Quote

It it is too good to be true it probably is.

If I folllow his advice what kind of security do I have?

Thanks

I created a drop-down menu using a MySQL statement in php for a form.
My drop down menu works fine, but I want to assign a default value to it (normal text) the value will never change,
thus I do not need to extract the default value from the table, I already know the value.

Here is the basic snippet from the script:

<?php
   include("../includes/xxx.php");
   $cxn = mysqli_connect($host,$user,$password,$dbname);
   $query = "SELECT DISTINCT `plant_id` FROM `plant` ORDER BY `plant_id`";
   $result = mysqli_query($cxn,$query);
      while($row = mysqli_fetch_assoc($result))
      {
      extract($row);
      echo "<option value='$plant_id'>$plant_id</option>\n";
      }
?>

I have a form that allows my client to update some products. Now the products are simple just basic info and 1 picture.

I have set this up so they can edit the products and change the information, having done this many times in the past, but now hit a puzzling block that I am baffled.

The client when editing is presented with the form with the information pulled from the database and the form fields loaded with that data ready to edit.

The image can either be left alone or they can choose to upload a new image. They are shown the image they currently have stored in the database.

The problem I have is EVEN if they decide not to upload an image and change other information, when the submit the form it must be sending a blank value for the image somewhere as it is updating the database and removing the image reference as if it has been removed.

I have an if/else statement based on the form to perform 2 different queries for the update in mysql.

Here is the code for the form update, as you can see the image should not update?? Please help??


 if ($_SERVER['REQUEST_METHOD'] =='POST') {

//This stops SQL Injection in POST vars 
 foreach ($_POST as $key => $value) { 
  $_POST[$key] = mysql_real_escape_string($value); 
 }

// **************************** THIS IS FOR NO NEW IMAGE ********************************
 
 if ($_SERVER['REQUEST_METHOD'] =='POST' && empty($_FILES['product_image']['name'])) {

   # setup SQL statement for no new image
  $SQL = " UPDATE products SET product_title = '{$_POST['product_title']}', product_description = '{$_POST['product_description']}', standard_price = '{$_POST['standard_price']}', deluxe_price = '{$_POST['deluxe_price']}' WHERE product_id = '{$_REQUEST['product_id']}' ";
}

// **************************** THIS IS FOR A NEW IMAGE ********************************

 else {

// Check the image type is a jpeg or gif for the image.
 if (($_FILES['product_image']['type'] != "image/gif") && ($_FILES['product_image']['type'] != "image/jpeg") && ($_FILES['product_image']['type'] != "image/pjpeg")) {
  echo "<FONT FACE=\"Verdana\"><SPAN CLASS=\"content\">You have chosen not to upload a <b>Product Image</b>.<BR></SPAN>" ;
 } elseif ($_FILES['product_image']['size'] > 100000) {
  echo "<FONT FACE=\"Verdana\"><SPAN CLASS=\"content\">The file size is bigger than 300kb.<BR></SPAN>" ;
 } else {
  move_uploaded_file($_FILES['product_image']['tmp_name'], "/httpdocs/product_images/".$_FILES['product_image']['name']) ;
 echo "<FONT FACE=\"Verdana\"><SPAN CLASS=\"content\"><B>Your front image has successfully uploaded.</B><BR></SPAN>" ;
  }
}

  # setup SQL statement for update
  $SQL = " UPDATE products SET product_title = '{$_POST['product_title']}', product_description = '{$_POST['product_description']}', standard_price = '{$_POST['standard_price']}', deluxe_price = '{$_POST['deluxe_price']}', product_image = '{$_FILES['product_image']['name']}' WHERE product_id = '{$_REQUEST['product_id']}' ";
}
  
  #execute SQL statement
  $result = mysql_db_query( *****,"$SQL",$connection );

  # check for error
  if (!$result) { echo("ERROR: " . mysql_error() . "\n$SQL\n");    }

I have a MySQL table with a list of albums and there is a field called "views" with the number of views each album has received. I'm looking to generate an array of all the albums in the table and sort the array by the number of views (descending). I have a list of functions defined in a ContentController.php file. I created a new function called build_albumlist, which I've pasted below. The function "get_ip_log" already exists and works, and I used it as a template to create the "build_albumlist" function:





   public function build_albumlist(){
      return $this->select_raw("SELECT * FROM albums WHERE deleted = '0' ORDER BY views DESC",array(),'all');
   }

public function get_ip_log(){
      return $this->select_raw("SELECT * FROM sessions ORDER BY ID DESC",array(),'all');
   }


When I use the function, I get this warning:


Warning: mysql_real_escape_string() expects parameter 1 to be string, array given inC:\xampp\htdocs\Controllers\DBController.php on line 10

[font=cabin, 'trebuchet ms', helvetica, arial, sans-serif]The "select_raw" function that I used in "build_albumlist" is defined in the DBController.php file, and is defined as below:[/font]
private function clean_array($params){
      $final=array();
      foreach($params as $param){
         $final[]=mysql_real_escape_string($param);
      }
      return $final;
   }
   public function select_raw($query,$params,$type=''){
      $query=str_replace("?","'%s'",$query);
      $final_query= call_user_func_array('sprintf', array_merge((array)$query, $this->clean_array($params)));
      if($type==''){
         $result=mysql_query($final_query) or die(mysql_error());
         return mysql_fetch_assoc($result);
      }
      elseif($type=='all'){
         $result=mysql_query($final_query) or die(mysql_error());
         $final=array();
         while($row=mysql_fetch_assoc($result)){
            $final[]=$row;
         }
         return $final;
      }


Does anyone know why the "build_albumlist" function is generating this warning, while the "get_ip_log" is not? Any help would be great, as I am obviously pretty new to this.

Hi all,

I have the following MySQL insert query:
Code: [Select]
$insert= mysql_query   ("INSERT INTO tablename (column1,`".$EXPfields."`) VALUES ('$something','".$EXPvalues."')");
where $EXPfields is an array of table-field-names and $EXPvalues is an array of table-field-values.

Now I want to write an equivalent query, but using UPDATE instead of INSERT INTO, but I don't want to write out all the field names/values separately, but again want to use $EXPfields and $EXPvalues.

So something like this:
Code: [Select]
$update = mysql_query ("UPDATE tablename
                     SET (column1,`".$EXPfields."`) = ('$something','".$EXPvalues."')
                     WHERE ....
                  ");

Is this possible? If so, what is the proper syntax? Thanks!

This is my first real jump into PHP, I created a small script a few years ago but have not touched it since (or any other programming for that matter), so I'm not sure how to start this.

I need a script that I can run once a day through cron and take the date from one table/filed and insert it into a different table/field, converting the human readable date to a Unix date.

Table Name: Ads
Field: endtime_value (human readable date)

to

Table Name: Node
Field: auto_expire (Converted to Unix time)

Both use a field named "nid" as the key field, so the fields should match each nid field from one table to the next.  Following a tutorial I have been able to insert into a field certain data, but I don't know how to do it so the nid's match and how to convert the human readable date to Unix time.  Thanks in advance!.

All other pages on my browser (Google Chrome) work, but whenever I open up register.php, I get this:

Code: [Select]
Error 324 (net::ERR_EMPTY_RESPONSE): Unknown error.

My register.php code:


<?php

include_once('includes/config.php');
include_once('functions.php');

$return_content = AccountRelated(null, null, 3);

?>

<html>
<head>
<link rel="stylesheet" type="text/css" href="style/style.css" />
<title><?php echo $title; ?></title>
</head>
<body>

<div class="logo"><a href="index.php"><img src="style/images/logo.png"></a></div>

<center>

<div class="background">

<div class="container">

<?php echo $return_content; ?>

</div>

</div>
</center>

</body>
</html>


functions.php


<?php

function AccountRelated($username, $password, $query_type)
{

if($query_type == 1)

{

$set_query = mysql_query("SELECT COUNT(d.username), u.date, u.username FROM uploads d, users u WHERE d.username = '$username' AND u.username = '$username' LIMIT 1") or die(mysql_error());

if(mysql_num_rows($set_query) == 0)

{

$content_return = 'Sorry, no information was found';

}

else

{

$grab = mysql_fetch_assoc($set_query);

//login information

if($grab['COUNT(d.username)'] > 0)

{

$welcome_return = "You have uploaded ". $grab['COUNT(d.username)'] ." files. You've registered on ". $grab['u.date'] ."!";

}

else

{

$welcome_return = "You have uploaded 0 files. You've registered on ".$grab['date'] . "!";

}

}

}

elseif($query_type == 2)

{

$set_query = mysql_query("SELECT title,views,downloads,description,username,date FROM uploads LIMIT 20");

if(mysql_num_rows($set_query) == 0)

{

$content_return = "Sorry, there are currently no files uploaded to view.";

}

else

{

while($row = mysql_fetch_assoc($set_query) == 0)

{

echo $row['title']."<br/>";

}

}

}

elseif($query_type == 3)

{

$username = mysql_real_escape_string($_POST['username']);

$password = md5($_POST['password']);

if(!$username || !$password)

{

$return_content = "All fields are required! <table><form action='register.php' method='POST'>

<tr><td>Username</td><td><input type='text' name='username' maxlength='20'></td></tr>

<tr><td>Password</td><td><input type='text' name='password' maxlength='30'</td></tr>

<tr><td><input type='submit' value='Register'></td></tr>

</form></table>";

AccountRelated($_POST['username'], $_POST['password'], 3);

}

else

{

$set_query = mysql_query("SELECT username FROM users WHERE username = '$username' LIMIT 1");

if(mysql_num_rows($set_query) == 0)

{

$return_content = "You have successfully registered the account ". $username ." with the

password ". $password ."!";

}

else

{

$return_content = "An account with this username already exists.";

}

}

return $return_content;

}

else

{

//nothing to process

}
}
?>

Hi:
I'm going crazy trying to do the following:
I'm making a job registration process where the user registers on one php page to the website, must acknowlege and email receipt using an activate php page, then is directed to upload their C.V. (resume) based on the email address they enter in the active page output. I then run an upload page to store the resume in teh MySQL db based on the users email address in the same record.

If I isolate the process of the user registering to the db, it works perfectly.
If I isolate the file upload process into the db, it works perfect.
I simply cannot upload teh file to the existing record based on teh email form field matching the user_email field in the db.
With the processes together, teh user is activated, but teh file is not uploaded.

Maybe I've simply been at this too long today, but am compeled to get through it by end day.
If anyone can help sugest a better way or help me fix this, I will soo greatly appreciate it.

My code is as follows for the 2 pages.

---------activate.php-------
<?php
session_start();
include ('reg_dbc.php');
if (!isset($_GET['usr']) && !isset($_GET['code']) )
{
$msg = "ERROR: The code does not match..";
exit();
}
$rsCode = mysql_query("SELECT activation_code from subscribers where user_email='$_GET[usr]'") or die(mysql_error());
list($acode) = mysql_fetch_array($rsCode);
if ($_GET['code'] == $acode)
{
mysql_query("update subscribers set user_activated=1 where user_email='$_GET[usr]'") or die(mysql_error());
echo "<h3><center>Thank You! This is step 2 of 3. </h3>Your email is confirmed. Please upload your C.V. now to complete step 3.</center>";
} else
{ echo "ERROR: Incorrect activation code... not valid"; }

?>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type" />
<title>Job application activation</title>
</head>
<body>
<center>
<br/><br/><br/>
<p align="center">
        <form name="form1" method="post" action="upload.php" style="padding:5px;">
        <p>Re-enter you Email : <input name="email" type="text" id="email"/></p></form>
          <form enctype="multipart/form-data" action="upload.php" method="POST">
          <input type="hidden" name="MAX_FILE_SIZE" value="4000000">
          Upload your C.V.: <input name="userfile" type="file" id="userfile">
          <input name="upload" type="submit" id="upload" value="Upload your C.V."/></form>
</p>
</center>
</body>

</html>
--------upload.php----------
<?php
session_start();
if (!isset($_GET['usr']) && !isset($_GET['code']) )
{
$msg = "ERROR: The code does not match..";
exit();
}
if(isset($_POST['upload']) && $_FILES['userfile']['size'] > 0)
{
$fileName = $_FILES['userfile']['name'];
$tmpName  = $_FILES['userfile']['tmp_name'];
$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type'];
$email = $_POST['email']['user_email'];

$fp      = fopen($tmpName, 'r');
$content = fread($fp, filesize($tmpName));
$content = addslashes($content);
fclose($fp);

if(!get_magic_quotes_gpc())
{
    $fileName = addslashes($fileName);
}

include 'reg_dbc.php';

$query = "UPDATE subscribers WHERE $email = user_email (name, size, type, content ) ". "VALUES ('$fileName', '$fileSize', '$fileType', '$content')";

mysql_query($query) or die('Error, query failed');
mysql_close($dbname);
}
?>
<center>
<br/>
<br/>
<br/>
<br/>
Thank you for uploading your <?php echo "$fileName"; ?> file, completing your registration, and providing us your C.V. for this position.
<br/>
<br/>
<br/>
We will contact you if your canditature qualifies.
</center>

(Another quite newbie...)
I have already an online booking form. The Form works fine now and I would like to add on one more issue, but the code ignores what I want to check. I have 4 fields: arrival, departure, no. of persons and comments to check.

Scenario 1:

All field mentioned above are emtpty: Workes fine and message appears: "You have not provided any booking details".

Scenario 2:

If arrival (date_start) and departure (date_end) is entered, there should be at least an entry either in the field "comment", or in the field "pax". If not, there should be a message: "You have not provided sufficient booking details".

INSTEAD: The booking request is sent, which should not be the case.

The code is currently:

      # all fields empty : arrival, departure, pax and comments - error

if(empty($data_start) && empty($data_end) && empty($pax)&& empty($comment)){
    exit("You have not specified any booking details to submit to us.
    <br>Please use your browser to go back to the form.
    <br>If you experience problems with this Form, please e-mail us");
    exit;
}
      #If arrival  and departure date is entered, there should be at least an entry

either in the field "comment", or in the field "pax".
      
if(!isset($data_start) && !isset($data_end) && empty($pax) && empty($comment)){
    exit("You have not provided sufficient booking details.
    <br>Please use your browser to go back to the form.
    <br>If you experience problems with this Form, please e-mail us");
    exit;
}

The form can be tested at http://www.phuket-beachvillas.com/contact-own/contact-it.php

Can someone please check and tell me what's wrong with the code ? Thanks to anyone for any hint.

Code: [Select]
$new_array2=array_diff($my_array,$itemIds);

$updatedb = mysql_query("UPDATE content_type_ads SET field_expire_value = '666' WHERE $new_array2 = field_item_id_value");
"$new_array2" has only 12 digit numbers for each item in the array, and I want to match them to the "field_item_id_value" field in the table, updating the "field_expire_value" field for the record where they match.  I know I am close because the UPDATE code works before I add the WHERE statement (it of course adds '666' to EVERY field, but for a noobie it's a start!).

Hello again!

I've been trying out new things (well, new for me) in php again.  This time I decided to try a real challenge and make a forum system.  A friend suggested I use a class for all database functionalities.  i was reluctant at first, but decided if I was going to try using classes for the first time, it might as well be with this.  With some guiding help, I set up the files and gave it a visual once over to check for errors.  Nothing seemed out of place, but when I loaded the page to try it out, I got this error:

Quote

Fatal error: Call to a member function query() on a non-object in /home/ck9/public_html/planning/forumbuild/list.php on line 20



I didn't see anything out of line, so I consulted my friend about it.  He made a few small adjustment suggestions, but nothing fixed the issue.  I then bugged my host about it, and he couldn't find anything wrong either.  Both people are highly experienced in php, so when they say it SHOULD be working I am left rather confused.

Here is list.php:
Code: [Select]
<?php
 include("db.class.php");
 include("db.config.php");

 $db = new databaseConnection($config['user'],$config['pass'],$config['database']);
 $g = $_GET['g'];
 $s = $_GET['s'];
 $t = $_GET['t'];

 function tablestart($a = '1')
  {
   global $db;

   echo "<table border='" . $a . "' cellpadding='10' cellspacing='0' align='center' width='80%' style='color: #C0C0C0'>\n";
  }
 function contents($table, $a, $b = '1', $c = '1')
  {
   global $db;

   $db->query("SELECT * FROM $table");

   while($row = $db->fetch_array())
    {
     if($row['level'] <= $_SESSION['ulevel'])
      {
       echo "<tr><td width='5%'><!--indicator--></td><td width='80%'><a href='index.php?pg=h&g='" . $row['g'];
       if(($a > '1') && ($row['g'] == $b))
        {
         echo "&s=" . $row['s'];
         if(($a > '2') && ($row['s'] == $c))
          {
           echo "&t=" . $row['t'];
          }
        }
      }
     echo "' style='color: #C0C0C0 ; text-decoration: none'><font size='4'>" . $row['name'] . "</font><br /><fpnt size='3'>" . $row['desc'] . "</td><td width='15%'><!--last update--></td></tr>\n";
    }
  }

 if(empty($_SESSION['ulevel']))
  {
   $_SESSION['ulevel'] = '0';
   echo "<font color='#CC0000'><center>You need to register to post in these forums.</center></font><br />\n";
  }

 if(empty($g))
  {
   tablestart();
   contents('group', '1');
   echo "</table>\n";
  }
 elseif(empty($s))
  {
   tablestart();
   contents('section', '2', $g);
   echo "</table>\n";
  }
 elseif(empty($t))
  {
   tablestart('0');
   echo "<tr><td width='80%'></td><td><!--new topic--></td></tr>\n</table>\n";
   tablestart();
   contents('topic', '3', $g, $s);
   echo "</table>\n";
  }
 elseif(!empty($t))
  {
   tablestart('0');
   echo "<tr><td width='80%'></td><td><!--new topic and reply--></td></tr>\n</table>\n";
   $data = file_get_contents('topics/g' . $g . 's' . $s . 't' . $t . '.txt');
   $post = explode("<!--p-->", $data);
   $length = count($post);
   tablestart('1');
   for($z = '0'; $z < $length; $z ++)
    {
     $i = '0';
     $cont = explode("<!--e-->", $post[$pos]);
     echo "<tr><td><b>" . $cont[$i] . "</b><br /><!--future additions--></td><td>\n<table width='100%' style='font-size: xx-small'>\n<tr><td height='3' width='75%'>";
     $i ++;
     echo "Posted on" . $cont[$i] . "</td><td height='3' width='25%'><!--future additions--></td></tr><tr><td width='100%'>";
     $i ++;
     echo $cont[$i] . "</td></tr></table></td></tr>\n";
    }
   echo "</table>\n";
  }
?>
My aim here was to have a single page to display the groups, sections, topics, and posts in order to keep database calls where I could find them easily.

and here is the class file:

Code: [Select]
<?php
class databaseConnection
 {
  protected $link;
  protected $lastResult;
  function databaseConnection($user,$pass,$database)
   {
    $this->link = mysql_connect("localhost",$user,$pass);
    if( !$this->link )
     {
      die('Vital information missing.');
     }
    else
     {
      mysql_select_db($database,$this->link) or die('could not find database: ' . mysql_error());
     }
   }
  function query($query)
   {
    $this->lastresult = mysql_query($query) or die('MySQL error: ' . mysql_error());
    return $this->lastresult;
   }
  function fetch_array($result = false)
   {
    if(!$result)
     {
      return mysql_fetch_array($this->lastresult);
     }
    else
     {
      return mysql_fetch_array($result);
     }
   }
 }
?>
I have tried everything from adjusting the php tags to putting the class directly in the page.

The config file just provides the user, pass, and which database to connect to.  I've checked it's formatting a few times just in case.

This topic has been moved to Miscellaneous.

http://www.phpfreaks.com/forums/index.php?topic=310658.0