Curious If All This PHP Code Is Necessary

PHP Newbie Question:
This attached code was made with DW CS3 php-msql server
behaviors - recordset pull down's....
I'm curious if all this code is necessary? Some of it seems
to make things harder to work with .... For example:
1 - why does DW decide to take GET['xVARx'] form variables
and convert them to $Vars? - why not just use the GET['xVARx'] ?
2 - Why do they use sprintf in the $query_test : rather than
something more direct like:
SELECT * FROM phonebook WHERE firstname LIKE
%$_GET['firstname']% and lastname LIKE %$_GET['lastname']% -
etc....
Just curious why they chose these methods... Any insight
would be appreciated...

.oO(revdave)
>PHP Newbie Question:
>
> This attached code was made with DW CS3 php-msql server
behaviors - recordset
>pull down's....
>
> I'm curious if all this code is necessary? Some of it
seems to make things
>harder to work with .... For example:
>
> 1 - why does DW decide to take GET['xVARx'] form
variables and convert them to
>$Vars? - why not just use the GET['xVARx'] ?
You can't rely on the existance of $_GET['xVARx']. You always
must test
with isset() if the URL parameter is set, before you can use
it or load
it into a local variable. If it doesn't exist, you have to
initialize
the variable with a default value. DW's code does this, so
you can then
safely use $xVARx - it will either contain the value from
$_GET['xVARx']
or a usable default.
> 2 - Why do they use sprintf in the $query_test : rather
than something more
>direct like:
>
> SELECT * FROM phonebook WHERE firstname LIKE
%$_GET['firstname']% and lastname
>LIKE %$_GET['lastname']% - etc....
Such code is much harder to read and maintain and more
error-prone
(watch the quotes for example). When you want to embed
multiple
variables into a string, using sprintf() is the more flexible
way.
You've also missed a little detail. DW doesn't directly use
the given
values in the string, but calls GetSQLValueString() on them
first.
Proper handling of user-submitted values is very important to
prevent
SQL injection. Your example above doesn't prevent this kind
of attack.
HTH
Micha

Similar Messages

  • Would this PHP Code Work?

    Hello there,
    I'm currently designing a website fot myself but need a page
    where people can send me feedback about the site or leave any
    questions. Now I've used some PHP to accomplish this but I shalln't
    be buying web hosting, etc until I've completely finished the site
    - therefore I am unable to test the the from to see if it works.
    The following is what I have done:
    1:) Created a HTML page with the following inserted into the
    body of the page:
    <form method="post" action="sendmail.php">
    Email: <input name="email" type="text" /><br />
    Message:<br />
    <textarea name="message" rows="15" cols="40">
    </textarea><br />
    <input type="submit" />
    </form>
    2:) I then created a PHP page with only the following code in
    the PHP file:
    <?
    $email = $_REQUEST['email'] ;
    $message = $_REQUEST['message'] ;
    mail( "[email protected]", "Feedback Form Results",
    $message, "From: $email" );
    header( "Location:
    http://www.example.com/thankyou.html"
    ?>
    I would be very grateful if somebody could perhaps test this
    or could tell me that it will indeed work - or as the case maybe,
    it won't.
    All the best,
    Kristopher (UK).

    Coxdabd wrote:
    > I would be very grateful if somebody could perhaps test
    this or could tell me
    > that it will indeed work - or as the case maybe, it
    won't.
    Yes, it will work. It will also turn your website into a
    wonderful spam
    relay. You should never trust user input without checking its
    content.
    Validating user input isn't something that can be covered in
    a simple
    forum post, but one thing that would make your script
    (marginally) safer
    is to remove "From: $email" from the mail() function. As
    currently
    scripted, it's a wide open security gap.
    David Powers, Adobe Community Expert
    Author, "The Essential Guide to Dreamweaver CS3" (friends of
    ED)
    Author, "PHP Solutions" (friends of ED)
    http://foundationphp.com/

  • All new php code now sends the header already sent warning

    I have had none of these 'headers already sent....' problems
    creating php forms in the past with dreamweaver cs3 (on leopard).
    Now, every single php form generated using dreamweaver returns this
    warning - without fail. I copied the EXACT code from a working
    login form into a new page.....the new page, using the same include
    file is now returning the warning: I am pasting the code that
    works, and below that, the code that does not work. Even Developer
    Toolkit, on the rare occasion it doesn't cause DW to crash, seems
    to be inserting code that does not work properly - same goes for
    the insert > data objects.
    I've attached the code from both pages - page that works at
    the top, page that doesn't work at the bottom:

    debrankin55 wrote:
    > I have had none of these 'headers already sent....'
    problems creating php forms
    > in the past with dreamweaver cs3 (on leopard). Now,
    every single php form
    > generated using dreamweaver returns this warning -
    without fail.
    Select Modify > Page Properties, and check Title/Encoding.
    Make sure
    that Include Unicode Signature (BOM) is deselected.
    If that doesn't do the trick, select View > Code View
    Options > Hidden
    Characters. Make sure there aren't any rogue characters
    outside the PHP
    tags, both in the affected page and any include file.
    David Powers, Adobe Community Expert
    Author, "The Essential Guide to Dreamweaver CS3" (friends of
    ED)
    Author, "PHP Solutions" (friends of ED)
    http://foundationphp.com/

  • How to write this sql query in php code ?

    for example:
    insert into temp
    select *
    from testtable;
    after this, i will query data from sql below:
    select *
    from temp;
    how to write this php code ?
    who can help me ?
    thanks!

    Have a look at the manual to find out how to issue queries.
    http://us3.php.net/oci8

  • PHP code disappearing from Muse html

    I'm having an odd error that I'm hoping someone can help me with.
    I am using Adobe Muse and a server side CMS called Pulsepro. To run the CMS modules all I have to do is paste an embed line like the following:
    <?php include("pulsepro/includes/gallery2.php"); ?>
    I am placing this php code in an HTML snippet in muse and then exporting and uploading to server. On the server I have an .htaccess file with the following lines of code to make sure that the browser can find the PHP:
    AddType application/x-httpd-php .html .htm
    AddHandler application/x-httpd-php .html .htm
    When I go to my page, where the php should be is blank. Upon viewing source code it shows that the php include is completed deleted and just has a blank DIV. Now, the local file on my machine (the export from Muse) shows the correct php include line. Why is it that when the browser runs the code it removes the php code from the HTML file? If I put the same php line in a simple html file it runs fine.
    Help? I've never had this issue with anything other than Muse.
    Best,
    Oliver

    Browsers do not find or process PHP. PHP is found and processed by the server before it hits your browser.
    The reason why you may not see anything where you placed the PHP is that it is unable to locate "pulsepro/includes/gallery2.php" or that included PHP file is simply rendering nothing. 
    What happens when you call "pulsepro/includes/gallery2.php" directly in your browser? Does it display anything?

  • I need php code for copy paste our all histroy of browser in a text page.

    I need php code for copy paste our all histroy of browser in a text page can any one send me the code please.

    You can use an application like GarageSale for doing this....
    http://www.macupdate.com/info.php/id/16035/garagesale

  • How to set FBL1N T code Layout to default to all the users using this T cod

    Dear Friends
    I have created a new layout by modifying the some of the fields in FBL1N T code output.  I want to set as default layout to all the users using this T Code. Is there any way we can set the  custom layout as default layout  to all the users.
    Presently Only I can see as default layout but  not the other users
    Thanks in Advance
    Thanks
    MVS

    Hi
    I have one above like issue but in FB03, I have been one layout as default using -lay admin when i come back and re execute the
    FB03 transaction  the default lay out not working directly every time i have to  "display as list from the" Go to" menu then only
    document showing as per lay out..I want  that lay out has to be work with out  going to Dispaly as list
    please advice me where i did wrong .its not working  even after the changes i log out the from the SAP and re login
    thanks
    Ranamka
    Edited by: Ranamka on Mar 10, 2011 9:59 PM

  • Would like to upgrade to Dragon Naturally Speaking 11 from DNS 6 (which would also entail a necessary upgrade from Windows 2000 to 7) but understand after all this expense and trouble, DNS upgrade may not be compatible with Firefox 6?

    Question
    Would like to upgrade to Dragon Naturally Speaking 11 from DNS 6 (which would also entail a necessary upgrade from Windows 2000 to 7) but understand after all this expense and trouble, DNS upgrade may not be compatible with Firefox 6?
    Main priority is voice activation upgrade. Ideas about how to proceed appreciated!

    AFAIK, it's been over three years since a WinXP laptop or desktop PC has been sold; I specifically bought a laptop in June 2008 because it was being clearanced by that retail chain to meet Microsoft's deadline, and got it real cheap. It was tagged for the store manager to purchase, but he let me have it because I exceeded his expectations for the services I performed for his store and thought I deserved it. Anything that wasn't made for Vista-compatibility will be very iffy with Win7, IMO - so that basically rules out anything that was made before like Oct or Nov 2007.
    Unless another DNS 11 user happens to see this thread and can verify whether it works in Firefox 6.0 or not, I don't what to recommend except for you doing a web search to see what other DNS / Firefox users have to say about compatibility.

  • Template Updates wipe out PHP code at top of file

    Hey everybody,
    I'm helping my wife with a web site that needed PHP, and
    since I know Dreamweaver I figured it couldn't be that hard to do.
    And it's not - between the DW application development features and
    a little hacking, it's been going fgreat.
    But the site is based off of a .dwt template, and every time
    she makes a change to the design it wipes out all the connection
    code that dreamweaver writes at the top of the page... arrrgh! I
    tried looking it up on the site, and tried adding a
    codeOutsideHTMLIsLocked="false" tag (I also tried "true") and that
    did not help.
    I never had this problem with Cold Fusion before. There's
    something in the livedocs about "dynamic templates" but that seems
    to imply I'd have to make my own XML definition file for php
    documents, which is pretty stupid, and makes me think it's not
    necessary.
    Anyone ever come up against this before?

    There's more to it than that, right? Let's see it all,
    please. The best
    way would be to upload it and post a link....
    Murray --- ICQ 71997575
    Adobe Community Expert
    (If you *MUST* email me, don't LAUGH when you do so!)
    ==================
    http://www.projectseven.com/go
    - DW FAQs, Tutorials & Resources
    http://www.dwfaq.com - DW FAQs,
    Tutorials & Resources
    ==================
    "illovich" <[email protected]> wrote in
    message
    news:g1frjf$mi6$[email protected]..
    > Here is is, thanks for taking a look!
    >
    >
    >
    > <?php require_once('Connections/serv.php'); ?>
    > <?php
    > if (!function_exists("GetSQLValueString")) {
    > function GetSQLValueString($theValue, $theType,
    $theDefinedValue = "",
    > $theNotDefinedValue = "")
    > {
    > $theValue = get_magic_quotes_gpc() ?
    stripslashes($theValue) :
    > $theValue;
    >
    > $theValue = function_exists("mysql_real_escape_string")
    > mysql_real_escape_string($theValue) :
    mysql_escape_string($theValue);
    >
    > switch ($theType) {
    > case "text":
    > $theValue = ($theValue != "") ? "'" . $theValue . "'" :
    "NULL";
    > break;
    > case "long":
    > case "int":
    > $theValue = ($theValue != "") ? intval($theValue) :
    "NULL";
    > break;
    > case "double":
    > $theValue = ($theValue != "") ? "'" .
    doubleval($theValue) . "'" :
    > "NULL";
    > break;
    > case "date":
    > $theValue = ($theValue != "") ? "'" . $theValue . "'" :
    "NULL";
    > break;
    > case "defined":
    > $theValue = ($theValue != "") ? $theDefinedValue :
    > $theNotDefinedValue;
    > break;
    > }
    > return $theValue;
    > }
    > }
    >
    > mysql_select_db($database_serv, $serv);
    > $query_posters = "SELECT * FROM isazPosters ORDER BY
    posterID ASC";
    > $posters = mysql_query($query_posters, $serv) or
    die(mysql_error());
    > $row_posters = mysql_fetch_assoc($posters);
    > $totalRows_posters = mysql_num_rows($posters);
    > ?>
    >

  • Php code is not working as intended in a simple spam block solution

    Hi. I'm trying to get some simple php code (as suggested on a tutorial page I found) to work on my form submission test page in order to reduce/stop spam. However, the results so far have not quite been what I expected. Any help will be appreciated.
    Basically I used the code given in the two grey boxes on this tutorial page http://myphpform.com/form-spam.php (but had to add this <?php ... ?> around the code given in the second box, otherwise it wouldn't have worked!) for my test page, and the result was supposed to look something like shown on this page http://myphpform.com/contact.php and indeed when I previewed my page in offline mode it displayed as intended with the extra field similar to the "Access code:" as on this example page, however that's not what I got when I uploaded my page.
    What happens when I go to the live page is that as soon as it loads it gives me the message: "Wrong access code" before I even have a chance to look at the form there. It's the message the user is supposed to get when they input the suggested code incorrectly, but not when the page first loads! This is what the live test page basically looks like when I go to it http://www.scotiauk.com/contact/forms/smotsContactTest.php. I wonder what's going wrong?
    I actually noticed a short while ago, after 'viewing page source' (source code) on the live test page that the page is for some reason only displaying less than half of the html code and cuts off the rest of it (including all of the <body>) just at the point (at the end of the <head> section) where the couple of lines of php script (borrowed from the second grey box in the tutorial) were meant to be - the script that includes "Wrong access code". So I get why it shows a blank page with only that message in it but not why it removes all of the <body> code once it is live!
    Just for information, this is what the page is really meant to look like - minus the php code: http://www.scotiauk.com/contact/forms/smotsContact.html. That is the original page that I copied and tried to modify with the new code. So, any ideas will be appreciated, thanks!

    Just for information, this is what the page is really meant to look like - minus the php code: http://www.scotiauk.com/contact/forms/smotsContact.html. That is the original page that I copied and tried to modify with the new code. So, any ideas will be appreciated, thanks!
    The page that you have quoted contains an infection as the following warns.
    As far as your problem is concerned, you need to know how a from works. Have a look at this video.

  • Firefox 3 displays the php code when pages launched from dreamweaver 8

    The problem seems to relate to files opening as —
    file:///C:/localweb/ .... when sent from Dreamweaver 8.0 to Firefox
    The first html/php page loads correctly from dreamweaver as
    processed HTML, a second page linked from either an HTML or php
    page also loads correctly, but selecting any link from that or
    subsequent pages displays the full php code instead of processed
    html layout - so this appears to be a third level or greater
    problem.
    If I manually substitute -
    http://localhost/ — the problem
    does not arise.
    This is a problem with version 3 of firefox, all previous
    versions I used worked fine with both — file:///C:/localweb/
    and
    http://localhost/
    Both prefixes also appear with pure HTML sites, but they load
    and function correctly.
    Not every php site I have loads with file:///C:/localweb/, so
    I am wondering if this relates to something in the php code or
    Dreamweaver - I have conn.php set to:
    mysql_connect("localhost", "root", "") or die(mysql_error());
    I use winxp and have xampp installed - everything worked fine
    until I installed Firefox 3

    > but selecting any link from that or subsequent pages
    You are being confused by a) not understanding root relative
    vs document
    relative links, and b) not understanding how DW previews
    files.
    If I have a document with a link to an image that looks like
    this -
    <img src="/images/foo.gif"...
    That's what's called a root relative link.
    If I preview that document in DW, then the browser gets the
    document, sees
    the leading "/" and reads that as the root of the hard drive,
    since the
    browser has no idea where the root of the site is. Thus, the
    image is
    broken in the preview.
    If I have temp files enabled, then DW will secretly convert
    the file being
    previewed into a temporary file, and hand that to the
    browser. This temp
    file has had all root relative links converted to document
    relative links
    (as you will see by looking at the code in the browser), and
    has had all
    include files actually embedded in the page, and has had all
    external CSS
    and js markup embedded in the page. In other words, DW has
    made the
    document into a stand-alone page.
    If you do not have temp files enabled, all of these links
    would be broken on
    preview.
    Now - if you are using root relative links, AND you have temp
    files enabled,
    AND you click away from the previewed document, then all of
    your links will
    be broken, since DW has not made that linked file into a temp
    file. This is
    what you are seeing.
    So - if you want to click away on preview, then you must use
    document
    relative links for the site -
    <img src="../images/foo.gif"... (for example)
    These will still work on preview since the browser knows how
    to determine
    the current file's location and how to follow that path.
    Make sense?
    Murray --- ICQ 71997575
    Adobe Community Expert
    (If you *MUST* email me, don't LAUGH when you do so!)
    ==================
    http://www.projectseven.com/go
    - DW FAQs, Tutorials & Resources
    http://www.dwfaq.com - DW FAQs,
    Tutorials & Resources
    ==================
    "gbiras" <[email protected]> wrote in
    message
    news:[email protected]...
    > The problem seems to relate to files opening as ?
    file:///C:/localweb/
    > ....
    > when sent from Dreamweaver 8.0 to Firefox
    >
    > The first html/php page loads correctly from dreamweaver
    as processed
    > HTML, a
    > second page linked from either an HTML or php page also
    loads correctly,
    > but
    > selecting any link from that or subsequent pages
    displays the full php
    > code
    > instead of processed html layout - so this appears to be
    a third level or
    > greater problem.
    >
    > If I manually substitute -
    http://localhost/ ? the problem does
    not arise.
    >
    > This is a problem with version 3 of firefox, all
    previous versions I used
    > worked fine with both ? file:///C:/localweb/ and
    http://localhost/
    >
    > Both prefixes also appear with pure HTML sites, but they
    load and function
    > correctly.
    >
    > Not every php site I have loads with
    file:///C:/localweb/, so I am
    > wondering
    > if this relates to something in the php code or
    Dreamweaver - I have
    > conn.php
    > set to:
    >
    > mysql_connect("localhost", "root", "") or
    die(mysql_error());
    >
    > I use winxp and have xampp installed - everything worked
    fine until I
    > installed Firefox 3
    >

  • Can some one have a look at this php script?

    Ok! hear's the script! It work's fine! but with one problem.
    when I get the email it look's like this>
    Base Color: NaturalTread Color: Black
    What I want the email to look like is>
    Base Color: Natural
    Tread Color: Black
    ie i don't want all the "var's" on on line!
    Hear's my php code>
    Can someone have a look to give me some poniters?

    I too am learnig. And just found this>
    <?php
    $sendTo = "******@hotmail.com";
    $subject = "Combo Test Two";
    $headers = "From: " . $_POST["name"];
    $headers .= "<" . $_POST["email"] . ">\r\n";
    $headers .= "Reply-To: " . $_POST["email"] . "\r\n";
    $headers .= "Return-Path: " . $_POST["email"];
    $message .= $_POST["baseColor"] . "\r\n";
    $message .= $_POST["treadColor"] . "\r\n";
    mail($sendTo, $subject, $message, $headers);
    ?>
    u need to put Line-Feed & Carridge Return:
    \r\n
    And good luck to you! Thanks for the help my friend!

  • Having trouble with my PHP code. Appers to get stuck on a white page.

    HI all,
    I have just began having trouble with my PHP code. Was working before and haven't made any changes to the code since last time it worked.
    What happens is after the form is submitted it goes to a white page (no text just all white page) and in the address bar it has the path for my php page. what supposed to happen is either it goes to a success page or a error page.
    I've had a problem where the info entered is correct but was directed to the error page. i managed to fix that issue but i am puzzled what is happening to my php page now.
    Mind you that i didn't write this code i just took over the responsiblities of this website and i am hopping that its a quick fix.
    I appreciate any help you could give me. Thank you.
    CODE:
    <?php
       $to = '[email protected]';
          $from = '[email protected]';
            //Make sure we have some info posted from the form...
            if (isset($HTTP_POST_VARS)){
                //Clear the body of the message to be sent
                $body = '';
                //go through all POSTed variables sent
                while (list($key, $value) = each($HTTP_POST_VARS)){
        if($key <> "Submit" && $key <> "submit") {
         $body .= $key . ' = ' . $value . "\r\n"; 
                //Now building mail headers.....
                $headers = "From: ".$from."\r\n";
                //Mail message
                $success = mail($to, "Email Club" . date("m/d/Y"), $body, $headers);
       // CURL stuff.....
       $ch = curl_init();
       curl_setopt($ch, CURLOPT_FAILONERROR, 1);
       curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
       curl_setopt($ch, CURLOPT_TIMEOUT, 4); //times out after 4s
       curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
                 if ($success){
        //readfile('http://www.lvpaiutegolf.com/thankyou.html');
        curl_setopt($ch, CURLOPT_URL,"http://www.lvpaiutegolf.com/thankyou.html");
        header("Location:http://www.lvpaiutegolf.com/thankyou.html");
                else{
                 // readfile('http://www.lvpaiutegolf.com/error.html');
         curl_setopt($ch, CURLOPT_URL,"http://www.lvpaiutegolf.com/error.html");
         header("Location:http://www.lvpaiutegolf.com/error.html");
       // Output
       //$result=curl_exec ($ch);
       //curl_close ($ch);
       //echo $result'";
    ?>

    Insert the install disk and boot from it. Use disk utitlity to repair your drive and check for errors (report any errors back here) then reinstall the os. This should not erase your data.

  • Use PHP code coloring in HTML files

    In Dreamweaver CS3, what changes do I need to make to get PHP
    code coloring show up in .html files?

    robot88888888,
    First, copy this file from the app config folder:
    C:\Program Files\Adobe\Adobe Dreamweaver
    CS3\configuration\CodeColoring\PHP.xml
    To the user config folder:
    C:\Documents and Settings\[username]\Application
    Data\Adobe\Dreamweaver
    9\Configuration\CodeColoring\
    Then open PHP.xml in your favorite editor. You need to add
    HTML to all
    of the doctype lists Change every occurrence of this:
    doctypes="PHP_MySQL"
    to be:
    doctypes="PHP_MySQL,HTML"
    Save and close. If DW is running, close it. Now restart DW.
    HTH,
    Randy
    > In Dreamweaver CS3, what changes do I need to make to
    get PHP code coloring show up in .html files?

  • The tax code entered is not defined in the country for this company code

    HI ALL
    when we relase billing document to finance i am getting this below error
    Diagnosis
        The tax code entered is not defined in the country for this
        company code.
    System Response
    Procedure
        Check and, if necessary, correct the entry.
    Procedure for System Administration
        If it is not an input error, check and possibly change the
        system settings.
        To do this, choose Maintain entries (F5).
        1.  Check whether the required tax determination procedure
            is assigned to the relevant country. the Procedure
            field is in the detail screen.
        2.  Create a new tax code if required.
    Thanks & Regards
    Aarman

    You can define the tax code for your country using the following menupath in customizing:
    IMG>Financial Accounting>Financial Accounting Global Settings>Tax on Sales and Purchases>Calculation-->Define tax codes ........... in the next screen enter your country and then the tax code you wish to create and press enter. You would be then directed to another screen, where you would maintain the description and whether it is a  Input tax or Output tax and then maintain the appropriate tax percentage and save.
    Your country should also be assigned to a calculation procedure. You check the same using the same menupath as mentioned above: .............Tax on Sales and purchases>Basic Settings>Assign country to calculation procedure........In the next screen, enter the appropriate tax procedure for your country. Eg: for country DE assign tax procedure as TAXD and save.
    Hope this helps.
    Regards
    SATYA

Maybe you are looking for

  • HP Smart Web Printing 4.60 is incompatible withg Firefox 3.6.12l; what can be done, please?

    My computer (desktop) runs on Windows XP2002 SP3 and Microsoft Works home edition. My new printer HP Photosmart Premium c390g-m has "smart web printing", but this feature is incompatible with my system, I am told. Can anything be done about this, ple

  • InternalCatalogException in Reporting Services 2008 - no reports rendering

    Hi all, We've had an unexpected outage on two of our reporting services server overnight and we're hoping someone can point us in the right direction.  We have a Windows Server 2008 machine running about 5 instances of reporting services in standalon

  • Reference field value in the F110 Payment document

    Dears We are running the automatic payment run for the vendor invoices posted. In each vendor invoice, we have filled the reference field, text field, etc.  However, while running the payment in F110, the system does not reproduce this reference fiel

  • A technical puzzler for the resourceful

    hi all i've got a special problem with leopard installation which i can't seem to untangle: 1. mac mini (power pc) running tiger. internal superdrive is dead. plugged into a custom-built firewire plextor cd-burner which can't read dual-layered cds. 2

  • No marker on JFreeChart into Pdf file by IText, why?

    Hello everyone, I have a question which has wasted my few days. I created a web report with JFreechart and Table on Panel. There is a Value Marker (vertical line ) on the line chart which created by JFreeChart. They all work fine on the website. Then