[PHP] security, receiving html from a form
For my website I created an updating system in php. Where my staff and I can write articles that then get saved to the server, linked to, etc. I allowed html to be passed from the form because a lot of the staff likes to use html tags in their articles. Which I know is a security issue. I know I could use HTMLSpecialChars() and then devise my own mark up system; which I will if I have no other alternative. But I was wondering if just searching the article string for "", "http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] security, receiving html from a form
- Original Message - From: "Rasmus Lerdorf" <[EMAIL PROTECTED]> > > I know I could use HTMLSpecialChars() and then devise my own mark up system; > > You could also define a list of tags you allow and pass them to the > strip_tags() function. See http://php.net/strip_tags > Interesting. Thanks for the link, it gave me some good stuff to think about. strip_tags() appears to have some holes in it, but the comments offered provided some work arounds. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Prevent user to close web browser
on 7/19/01 8:33 AM, Tom Malone at [EMAIL PROTECTED] wrote: > I am almost positive this is not possible with JavaScript or even VBScript. > It might be possible with Visual Basic, but again - why would you want to do > that? Netscape will warn the user that the script (javascript) is trying to close their main window. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] I AM AT THE START POINT
on 7/19/01 9:33 AM, Ali YILDIRIM at [EMAIL PROTECTED] wrote: > Hi; > I am just at the beginning process to php. > My question is: > I type in notepad my php code ok allright but where > will I test this? > > I know this is so simple but you know I am new to this > and ... > Please help.. You can upload it to your webhost and test it that way. However that's not very ideal. You should install a webserver, php and mysql on your own computer. Then you can test what you're doing without needing to go online. For windows98/ME you can get Personal Web Server, which is free and included on Windows98/ME cds, or you can download it from microsoft.com (I don't know where though). Then go to www.php.net and get the Windows version of php, or go to www.php4win.de. I can't really help you on WinNT/2000. If you're using Linux, you probably already have most, if not all, of what you need installed. Apache and php are installed by default in the distros I'm familiar with. If not you probably have the rpms on your linux cd, or you can get them, or the source, off the net. If you have linux, fire up a webbrowser and just type in "localhost" as the URL, if it brings up a page about apache, chances are you're good to go. I recommend grabbing "Beginning PHP4" from Wrox press. They cover getting php installed pretty well, and of course give you a nice primer on the language itself. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Prevent user to close web browser
on 7/19/01 10:30 AM, Tom Malone at [EMAIL PROTECTED] wrote: >> Netscape will warn the user that the script (javascript) is trying to close >> their main window. >> > True, but JavaScript can't prevent the user from closing their web browser > window, which is the basis of the original question. > D'oh! Reading comprehension is usually considered to be a good thing :) My bad. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Another how do i question
on 7/23/01 6:25 PM, Kyle Smith at [EMAIL PROTECTED] wrote: > I made this code for a simple for (the end of it) but what do i change in the > $message variable so there is a new line between each other variable in > $message (ive tried $name. . $last_name and. happens) > Did you try $name . "" . $last_name, etc. Although the will just show up as plain text in a text email, so I'd try the new line character "\n". Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Another how do i question
on 7/23/01 10:49 AM, Matt Greer at [EMAIL PROTECTED] wrote: > on 7/23/01 6:25 PM, Kyle Smith at [EMAIL PROTECTED] wrote: > >> I made this code for a simple for (the end of it) but what do i change in the >> $message variable so there is a new line between each other variable in >> $message (ive tried $name. . $last_name and. happens) >> > > Did you try $name . "" . $last_name, etc. > Er, I mean $message = "$name . '' ... "; Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Keeping fields out of URL
on 7/23/01 10:55 AM, Shrout, Ryan at [EMAIL PROTECTED] wrote: > How can I keep fields in a form out of the URL? > > I am writing a basic PHP/login script to password protect a directory of the > web site (if anyone knows of something pre-made, please do let me know). > If you're on a unix server you can use .htaccess A search on any search engine should pull up lots of info on it. > But, the first stumbling block is that when sometypes in their > username/password, even when the I use th INPUT Type Password so only > asterics appear when it is typed, the password still appears in the submit > query URL. How do I stop that? Change your method to "post" as in Keep in mind that just sticks the variables in the header rather than on the command line. It's not any more secure than what you had before. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
[PHP] keeping track of external image linking with php?
I don't think that's the best subject, but I'm not really sure how to phrase it. I'm not familiar with php's image capabilities. I've read about them a bit, but never really used them. I'd like to have an image that when accessed would cause php to kick in and do a few things before sending the image along to whoever is requesting it. Basically I'd like to keep a running tally of how many times a website is accessing an image on my server. Which functionally speaking is identical to a hit counter I guess. Is it possible to have on a webpage something like and then image.php takes note of the website variable, does a few things with mysql, then passes on the image that is wanted, utilizing something from the gd library? Thanks, Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
[PHP] working with remote images
It looks like my attempt to send this bounced. Which is fine, since I've now got a slightly different question. I'm working on a "network" for my site and others related to it. We want to keep track of which sites are the most popular by having everyone place on their site something to the effect of http://www.mywebsite.com/image.php?somevariables=here";> I want to then have image.php make note of which site requested it and add to their tally in the database. Then feed them the image requested. But my concern is if that image is on my server I'll be getting a lot more bandwidth. So I'm wondering if its possible to then have image.php tell the requesting server to grab their own copy of the image and load it up? I have a feeling php will grab the image from the other site's server, download it to my server and then upload it back to them. Even worse :) Thanks, Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
[PHP] can't get gd working at all
I'm trying to get a simple piece of code involving gd functions to work just to ensure gd is working properly on my server. I took this straight from my book. All that comes up is a broken image. I talked with my host and they assured me gd is installed and working properly on the server. Any ideas? Here's what I'm trying to do: This is from chapter 16 of Beginning PHP4 from Wrox press. Thanks, Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] ereg_replace
on 7/25/01 10:38 AM, Clayton Dukes at [EMAIL PROTECTED] wrote:
>
>
> Can someone tell me why this doesn't work?
>
> $home_street = ereg_replace (" " , "+" , $home_street);
>
> The input is "123 happy trail"
> I need the output to be "123+happy+trail"
Not exactly what you wanted, but you could do
implode("+", explode(" ", $home_street));
Matt
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] can't get gd working at all
on 7/25/01 9:35 AM, Warren Vail at [EMAIL PROTECTED] wrote: > If the gd extension is not loaded each time php is loaded you will need to > cause it to be loaded from your script. Ok, I tried this and got gd is not loaded I don't know if that's the name of gd on my server though. A search through phpinfo() turns up nothing on gd, which makes me think its not installed after all. Is it possible to upload the extension to my directory and call it from there? Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] can't get gd working at all
Ah ha, my host was wrong. gd is not installed on the server I'm on, but they're moving me over to one that has it. Sorry everyone, but I didn't know enough about any of this to be able to verify what they told me. Thanks for all the help. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] html form question
> What's the method for populating any number of html > form ... tags with query results? > I've seen lots of php-embedded examples for CHECKBOX, > RADIO and even SELECT, but I can't seem to figure out > how to create a simple drop-down menu. HELP!!! Wouldn't it just be: If there's a varying number of options run a loop with arrays $option[$i] ?> Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] IE -> View Source
on 7/26/01 10:44 AM, Sheridan Saint-Michel at [EMAIL PROTECTED] wrote: > Besides... do you REALLY have anything so mind bogglingly original in your > code that you have to > go to all these extremes to protect it? That's what I've never understood about people wanting to hide their source. HTML isn't rocket science. Any server side scripting won't be seen, and Javascript isn't all that difficult. I can't imagine any webpage that would truly have a reason to hide their source. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] auto refresh in every five seconds.
- Original Message - From: "Mark Lo" <[EMAIL PROTECTED]> To: "php general" <[EMAIL PROTECTED]> Sent: Friday, July 27, 2001 10:40 PM Subject: [PHP] auto refresh in every five seconds. > Hi, > > I would like to know how to do a auto refresh in every five seconds. This isn't php, and javascript can surely do this. But this will also do it... http://www.website.com/index.html";> Where X is the number of seconds between refreshes, and set the url to itself. Place this within the head. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
[PHP] weird caching problem
I'm calling an image through a php file, but when I make changes to the
image, I can't get them to show. For some reason the old image is getting
cached somewhere, and none of the standard remedies are working (refreshing,
deleting cache, etc). What does work is changing the value of $icon and then
reflecting that change in my code. But that's not ideal for what I'm doing.
Any ideas?
Here's how I'm calling the image in php:
http://www.rcnchicago.com/~tortus/goombaw.gif";);
else header("Location: http://www.rcnchicago.com/~tortus/goombab.gif";);
?>
Thanks,
Matt
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Re: HTTP header question.
> What I'm looking for is a way to do this such that the user does not see > anything more than http://host.name.here/rams/login.php in their address > bar when it failed... Doesn't using a form with its method set to post send the variables through headers? If that's the case, couldn't you manually set those headers yourself using header()? I'm curious about this myself, but so far I've not been able to find any info on the web. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Admin help please!
on 7/30/01 9:00 AM, B. van Ouwerkerk at [EMAIL PROTECTED] wrote: > So.. for php general help thats: > [EMAIL PROTECTED] > > Uhm, this was also in the welcome messages you got when you subscribed. > It's also in the footer of every message posted to this list :) Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
[PHP] array/mysql problems
I've been trying to get this to work all night with no luck. I've gotten a
similar version to work, with the only real difference being I didn't use
mysql (I just plugged some stuff in). But other than that I can't see the
difference. Basically I'm trying to pull stuff out of a database, get an
average for each entry, and then sort the entries by the average from
largest to smallest. I don't get any output other than the basic html in
other parts of the file. No error messages. I've tried sticking in echos all
over the place testing stuff looking for the problem and I can't find
anything. Any ideas?
$link = mysql_connect("host", "user", "pass");
mysql_select_db("db");
$result = mysql_query("SELECT * FROM table");
$sitearray = array();
$dummysite = new siteinfo();//siteinfo is a class containing just
variables
while ($query_data = mysql_fetch_object($result))
{
$dummysite->days = (int)((time() - $query_data->startday)/86400);
if ($dummysite->days < 1) $dummysite->days = 1;
$dummysite->sitename = $query_data->sitename;
$dummysite->tvisits = $query_data0->visits;
$dummysite->avisits = $dummysite->tvisits/$dummysite->days;
$sitearray[$dummysite->avisits] = $dummysite;
}
echo "";
$sitearray = array_reverse($sitearray);
//just trying to get some output, any output
for ($i = 1; $i != 100; $i++)
echo $sitearray[$i]->sitename;
thanks,
Matt
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] whats wrong?
on 7/31/01 10:09 AM, Jeremy Morano at [EMAIL PROTECTED] wrote: > Anythig visibly wrong with this? > > > > "> The quotes around $uid are ending value prematurely. html thinks value is "http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Make a mailing list
on 7/31/01 12:48 PM, B. van Ouwerkerk at [EMAIL PROTECTED] wrote: > Do you really want others to write your code so you can copy and paste it?? > If you can't find the manual it's on www.php.net you can even search the > documentation for the word mail. Actually www.php.net/functionname will bring up the manual page for the function. In the case of www.php.net/mail it brings up a page on all mail related functions. Very handy IMO. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Re: FAQ
on 8/1/01 11:01 AM, Angerer, Chad at [EMAIL PROTECTED] wrote: > > PHP Hypertext Preprocessor. > > Isn't it Personal Home Pages? > I believe that was the original name. But now the first P represents an acronym itself, as Kirk pointed out, PHP Hypertext Preprocessor. So as I understand it, it's Personal Home Page Hypertext Preprocessor. Rather a mouthful. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] SQL syntax error in PHP script. dunno what's wrong
on 8/1/01 11:35 AM, Chris Worth at [EMAIL PROTECTED] wrote: > > > hey gang. > > here is my sql statement from my php script. > > $sql = "UPDATE TABLE seminar SET > title=$title,speaker=$speaker,event_date=$tdate,time=$time,bldg=$building > ,rm=$room WHERE id=$id"; > strings in a mysql query need to be quoted. So change it to $sql = "UPDATE TABLE seminar SET title='$title',speaker='$speaker',..."; Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Installing PHP probs
on 8/1/01 9:57 PM, Kyle Smith at [EMAIL PROTECTED] wrote: > well what if i want to set up the computer im using to be able to run php > acripts, but NOT be an internet server? > You can't. You need a webserver on your computer to run php locally. If you're running windows98/me you can use Personal Web Server, which is free and included on your Win98/me cd. It's no big deal once its set up, you still see the scripts' output through your web browser. You can forget about the web server once its in place and working. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Content Type Text?
on 8/1/01 4:35 PM, Jeff Oien at [EMAIL PROTECTED] wrote:
> I've looked all over and can't find a content-type declaration for text.
> This is my guess
> header("Content-Type: text/txt");
> but I'm not sure if this is right. I know this is more HTTP than PHP.
> I want info to be displayed in a browser as plain text not HTML.
> Thanks.
> Jeff Oien
Look at the headers of an email. If the sender is savvy, they sent it in
plain text...
Content-Type: text/plain;
This works fine as long as you don't include the tag "". On IE5 for
the Mac at least, this causes the browser to interpret the tags regardless
of the header. Without , the rest of the html tags will show up as
plain text.
Matt
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] stop a file called foo.bar
on 8/3/01 4:22 AM, void at [EMAIL PROTECTED] wrote: > stop a file called foo.bar from being downloaded with a web server ? > > Say you'r web site's name is foobar.net. > > ..and... > > Script-kiddy Johny knows that, > but also knows that you'r secret file is called foo.bar > and it is saved in the root dir. of you'r web site. Does it need to be in the website's root directory? If you stick it off to the side, no one will be able to access it via http. If you need this file for php stuff, use an include to stick it in there. I know that's not what you asked, but it's worth a try. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Host OnLine ?
on 8/6/01 7:45 PM, Arcadius A. at [EMAIL PROTECTED] wrote: > Hello ! > Is there any function in PHP returning true or false or something similar > when a given host is online or not ? > > Basically , I'm in need od something "ping" > Thanks ... Just a knee jerk reaction, but what about fopen? Try to open the site's main page. If you can the site is online, if not, it's not. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] percentage problems
On Saturday 22 September 2001 16:41, you wrote: > Hello all, > > I'm having some troubles making correct percentages. > > I'm writing a simple poll system. Is there an easy way to generate > percentages? I know to divide and all that good stuff. I do substr to get > rid of the decimals, but sometimes the percentages still aren't displayed > correctly. How do you people usually go about doing percentages? Better than substr is to cast the variable to be an int (int)$firstpercent would force the variable to be an integer, chopping off any decimals it may have. Other than that I don't really know what to say. Determining percentage is more a math thing than php. Maybe take a look at other poll scripts out there (there's tons of them). Keep in mind both substr and casting to an integer are essentially always rounding down. So if your values are 58.9, 12.6, and 28.5 then you'll lose 2 percent after all is said and done. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] formatting in HTML from PHP scripts. Please help!
On Sunday 23 September 2001 17:01, rico wrote: > The problem is in the final formatting in arrayprocr.php. I notice that > whenever a new is added to the final table, it gets pushed further > down the page, almost as if a has been added for each new ...but > there is not. > I cant look at your files as they always arrive as gibberish. How are you encoding them? Generally attachments on a mailing list is a faux pas however. But extra space in tables can happen if you allow a carriage return or white space between the element and what it contains. So instead of: data here have data here this is especially true of images I have no idea if that's your problem, but its worth a shot. Matt -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Sessions just don't work on my machine. (Trying thisagain)
on 9/24/01 10:56 AM, Thomas Deliduka at [EMAIL PROTECTED] wrote: > > VAR 3: VALUE="go"> > > I dont see where the SID is being passed to the next page. I recently struggled through getting sessions to work, and for me I had to send SID myself manually, the server wouldn't send it via a cookie. I have mine set up a little differently, something like //index.php Go to page two //index2.php --- You can also send the SID in a form via I use the constant SID and the shorthand because that is what is recommended and demonstrated on php.net Matt _ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
Re: [PHP] Running a Shell Script in PHP HELP!
On Sunday 30 September 2001 18:23, Armando Cerna wrote:
> I have tried system (updatemp) and exec (updatemp)
The system() function requires a string as its argument. So you need to write
it as system("updatemp"); or system("$files");
Matt
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
