<?PHP questions that don\\'t need their own thread ?>

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > <?PHP questions that don\\'t need their own thread ?>

«‹›223 »

Standish: May 21, 2001

You're assigning empty variables to the session,

php:

<?
$name=$_POST['name']; 
$address=$_POST['address'];?>

needs to go before

php:

<?
$_SESSION['name'] = $name; 
$_SESSION['address'] = $address; ?>

# ? Aug 17, 2008 22:43

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 04:07

Thirteenth Step: Mar 3, 2004

Standish posted:

You're assigning empty variables to the session,
php:
<?
$name=$_POST['name']; 
$address=$_POST['address'];?>
needs to go before
php:
<?
$_SESSION['name'] = $name; 
$_SESSION['address'] = $address; ?>

I moved the session variables above but still no luck, is there any other reason this could be doing this??

# ? Aug 17, 2008 22:50

thedaian: Dec 11, 2005; Blistering idiots.

Gibbon_WBA posted:

I moved the session variables above but still no luck, is there any other reason this could be doing this??

You need to have the PHP bit that you posted in two.php, since that's where the form is going. Otherwise, you're still getting empty variables.

# ? Aug 17, 2008 23:05

Thirteenth Step: Mar 3, 2004

thedaian posted:

You need to have the PHP bit that you posted in two.php, since that's where the form is going. Otherwise, you're still getting empty variables.

Argh I thought I had it then! but no there's still no output on the final page (where is shows the user what he/she has inputted on the previous pages), there's nothing :confused:

php:

<?php 
session_start(); 

$name=$_SESSION['name'];
$address=$_SESSION['address'];
$dateofbirth=$_SESSION['dateofbirth'];
$username=$_SESSION['username'];
$password=$_SESSION['password'];
$accept=$_SESSION['accept'];
$email=$_SESSION['email'];
$acceptemail=$_SESSION['acceptemail'];

echo "$name";
echo "$address";
echo "$dateofbirth";
echo "$username";
echo "$password";
echo "$accept";
echo "$email";
echo "$acceptemail";

?>

Thats the simple code for the final confirmation page but nothing is bieng displayed. :confused:

# ? Aug 17, 2008 23:33

jasonbar: Apr 30, 2005; Apr 29, 2005

Gibbon_WBA posted:

Argh I thought I had it then! but no there's still no output on the final page (where is shows the user what he/she has inputted on the previous pages), there's nothing

Make sure that your php.ini file is setup to use cookie based sessions, and not URL based session passing.

edit:

code:

; Whether to use cookies.
session.use_cookies = 1

edit2: failing that, perhaps paste the current incarnation of your first page, and your second page where you are trying to output the session data.

jasonbar fucked around with this message at 00:22 on Aug 18, 2008

# ? Aug 18, 2008 00:12

Thirteenth Step: Mar 3, 2004

jasonbar posted:

Make sure that your php.ini file is setup to use cookie based sessions, and not URL based session passing.

edit:
code:
; Whether to use cookies.
session.use_cookies = 1

As far as I know; I dont have a php.ini file. :confused:

# ? Aug 18, 2008 00:21

duz: Jul 11, 2005; Come on Ilhan, lets go bag us a shitpost

You arn't assigning the user supplied values to the session.

# ? Aug 18, 2008 00:33

Thirteenth Step: Mar 3, 2004

duz posted:

You arn't assigning the user supplied values to the session.

php:

<?
$_SESSION['name'] = $name; 
?>

I thought that's what this was...?

Or am i missing something else? :confused:

# ? Aug 18, 2008 00:46

Alex007: Jul 8, 2004

Gibbon_WBA posted:

I thought that's what this was...?

Or am i missing something else?

Can you post your whole code on pastebin ? It's kind of hard to debug with what we have right now.

# ? Aug 18, 2008 00:58

duz: Jul 11, 2005; Come on Ilhan, lets go bag us a shitpost

Gibbon_WBA posted:

php:
<?
$_SESSION['name'] = $name; 
?>
I thought that's what this was...?

Or am i missing something else?

And $name is empty.

Alex007 posted:

Can you post your whole code on pastebin ? It's kind of hard to debug with what we have right now.

Not really. He's assigning unassigned variables to the session then wondering why they're empty when he tries to view them later. $_POST does not contain the values of the form on that page, it contains the values of the form POSTed to it. Doing

php:

<?
$name=$_POST['name'];
$_SESSION['name'] = $name;
echo " Name: <input type=text name='name'>";
?>

will not work how you apparently think it does.

duz fucked around with this message at 01:03 on Aug 18, 2008

# ? Aug 18, 2008 01:00

thedaian: Dec 11, 2005; Blistering idiots.

I've been talking with Gibbon on AIM for a while, and I'm pretty sure we've solved the problem. Though, Gibbon, I urge you to learn how to program with another language. PHP is a pretty terrible beginners language, and there's a million issues of security and other things that could happen. Plus, even though PHP has pretty good documentation, a lot of tutorials are either badly written, or ignore a lot of the security problems that can exist.

# ? Aug 18, 2008 03:19

waffle iron: Jan 16, 2004

thedaian posted:

I've been talking with Gibbon on AIM for a while, and I'm pretty sure we've solved the problem. Though, Gibbon, I urge you to learn how to program with another language. PHP is a pretty terrible beginners language, and there's a million issues of security and other things that could happen. Plus, even though PHP has pretty good documentation, a lot of tutorials are either badly written, or ignore a lot of the security problems that can exist.

Post of the year. Really helps everyone who comes to ask a question in this thread. :rolleyes:

# ? Aug 18, 2008 03:41

functional: Feb 12, 2008

Gibbon_WBA posted:

Argh I thought I had it then! but no there's still no output on the final page (where is shows the user what he/she has inputted on the previous pages), there's nothing
php:
<?php 
session_start(); 

$name=$_SESSION['name'];
$address=$_SESSION['address'];
$dateofbirth=$_SESSION['dateofbirth'];
$username=$_SESSION['username'];
$password=$_SESSION['password'];
$accept=$_SESSION['accept'];
$email=$_SESSION['email'];
$acceptemail=$_SESSION['acceptemail'];

echo "$name";
echo "$address";
echo "$dateofbirth";
echo "$username";
echo "$password";
echo "$accept";
echo "$email";
echo "$acceptemail";

?> 
Thats the simple code for the final confirmation page but nothing is bieng displayed.

Let me show you how to refactor this type of block... All the typing you're doing is hurting me.

php:

<?
$s='name address dateofbirth username'; //And so on...
$a=explode(' ',$s);
foreach($a as $x)$$x=$_SESSION[$x];
foreach($a as $x)echo $$x;
echo $name; //works
?>

# ? Aug 18, 2008 20:15

Zorilla: Mar 23, 2005; GOING APE SPIT

It may be even cleaner to put all input variables into an array for organization's sake:

php:

<?
foreach ($_SESSION as $key => $value) {
    $input[$key] = $value;
}

echo $input["name"]."<br />\n";
echo $input["address"]."<br />\n"; // and so on...
?>

Or you could probably just use $input = $_SESSION, but that will wipe out any previous keys in $input.

Zorilla fucked around with this message at 22:07 on Aug 18, 2008

# ? Aug 18, 2008 21:53

KuruMonkey: Jul 23, 2004

Arguing over the neatest way to do redundant things ITT?

Zorilla posted:

It may be even cleaner to put all input variables into an array for organization's sake:

Dear god; they're already IN an array!

php:

<?
var_dump($_SESSION);
?>

There's no reason to start copying stuff out of the session until you've managed to put something IN it. Certainly no reason to worry about the neatest way to duplicate the content of an array...

The only copy needed for this at this stage is:

php:

<?
session_start();
foreach(array_keys($_POST) as $k) $_SESSION[$k] = $_POST[$k];
// next stage of your form here...
?>

(not that this is a good way to be dealing with session data)

Edit: can't type for toffee tonight

KuruMonkey fucked around with this message at 23:38 on Aug 18, 2008

# ? Aug 18, 2008 23:31

Acer Pilot: Feb 17, 2007; put the 'the' in therapist

Is this:

php:

<?
    function check_explored($sector, &$map)
    {
        $explored = $this->search_explored(0, (count($map)-1), $sector, $map);

        if($explored < 0)
            return -1;

        return $map[$explored];
    }

    function search_explored($start, $end, $key, &$map)
    {
        if($start > $end)
            return -1;
    
        $mid = round(($start + $end)/2);
    
        if($map[$mid] == $key)
            return $mid;
        elseif($key < $map[$mid])
            return $this->search_explored($start, ($mid-1), $key, $map);
        return $this->search_explored(($mid+1), $end, $key, $map);
    }?>

Faster and or more efficient than in_array?

# ? Aug 19, 2008 04:30

Begby: Apr 7, 2005; Light saber? Check. Black boots? Check. Codpiece? Check. He's more machine than kid now.

drcru posted:

Faster and or more efficient than in_array?

Probably not. One thing to keep in mind is that in_array is a compiled c routine, so its going to be pretty quick.

However even if yours was faster, who cares. I don't think you need to worry about milliseconds of difference (which is what the difference would be) unless your site is getting a million hits an hour.

# ? Aug 19, 2008 13:44

Acer Pilot: Feb 17, 2007; put the 'the' in therapist

Gotcha.

Now for another question I haven't seen in awhile...

How should I store passwords in MySQL? The only way I know of is to MD5 it with a salt. How would a security conscious goon do it?

# ? Aug 21, 2008 10:46

Zorilla: Mar 23, 2005; GOING APE SPIT

drcru posted:

How should I store passwords in MySQL? The only way I know of is to MD5 it with a salt. How would a security conscious goon do it?

That's pretty much it, I think. You could make the login process done through SSL or use Javascript to MD5 the password on the client side so it isn't sent out cleartext, but you're on the right track so far.

# ? Aug 21, 2008 12:39

MononcQc: May 29, 2007

drcru posted:

Gotcha.

Now for another question I haven't seen in awhile...

How should I store passwords in MySQL? The only way I know of is to MD5 it with a salt. How would a security conscious goon do it?

Use SHA-1. Otherwise, salting it is pretty much the right thing to do.

# ? Aug 21, 2008 13:06

Acer Pilot: Feb 17, 2007; put the 'the' in therapist

Zorilla posted:

That's pretty much it, I think. You could make the login process done through SSL or use Javascript to MD5 the password on the client side so it isn't sent out cleartext, but you're on the right track so far.

Well I did get a free SSL certificate from Namecheap a week or two back so I'll give that a shot as well, thanks.

MononcQc posted:

Use SHA-1. Otherwise, salting it is pretty much the right thing to do.

Is there a huge difference between MD5 and SHA-1 other than the bit lengths? I would like to try something new, SHA-1 in this case, but I would like to keep our user accounts fairly safe from tampering.

Thanks for help so far goons.

# ? Aug 21, 2008 23:30

duz: Jul 11, 2005; Come on Ilhan, lets go bag us a shitpost

drcru posted:

Is there a huge difference between MD5 and SHA-1 other than the bit lengths? I would like to try something new, SHA-1 in this case, but I would like to keep our user accounts fairly safe from tampering.

MD5 is very broken, SHA1 is only kind of broken.

# ? Aug 21, 2008 23:50

Scaevolus: Apr 16, 2007

duz posted:

MD5 is very broken, SHA1 is only kind of broken.

Are collisions really that big of a problem with password hashing?

# ? Aug 22, 2008 00:03

Acer Pilot: Feb 17, 2007; put the 'the' in therapist

So would you add a salt before and after?

# ? Aug 22, 2008 00:06

Scaevolus: Apr 16, 2007

drcru posted:

So would you add a salt before and after?

If you want to be paranoid--

generate ~16 random bytes for salt
hash salt . password
do another ~100 rounds of hashing on the result
store the salt + hash in the database

This will make bruteforcing really slow, and rainbow tables impractical.

# ? Aug 22, 2008 00:10

Mine GO BOOM: Apr 18, 2002; If it isn't broken, fix it till it is.

Scaevolus posted:

do another ~100 rounds of hashing on the result

Hashing a hash only increases the chance of collisions and doesn't make it more secure.

For a salt, in PHP, I just use sha1(uniqid(mt_rand(), true).

# ? Aug 22, 2008 00:52

Inquisitus: Aug 4, 2006; I have a large barge with a radio antenna on it.

Mine GO BOOM posted:

Hashing a hash only increases the chance of collisions and doesn't make it more secure.

For a salt, in PHP, I just use sha1(uniqid(mt_rand(), true).

Collisions aren't a problem if you're salting; the point is that hashing that many times would gently caress up rainbow tables since they'd take millennia to generate and bruteforcing would also be slow as poo poo.

# ? Aug 22, 2008 02:51

fletcher: Jun 27, 2003; ken park is my favorite movie; Cybernetic Crumb

php:

<?

$query = $database->prepare("UPDATE table SET field = field + :value WHERE id = :id");
$query->bindParam(":id", $id);
$query->bindParam(":value", $value);

?>

Why does this throw an PDOException with an invalid number of parameters?

fletcher fucked around with this message at 08:34 on Aug 22, 2008

# ? Aug 22, 2008 08:26

The March Hare: Oct 15, 2006; _{Je r�ve d'un}
Wayne's World 3; Buglord

I will freely admit to being an idiot here but I have no idea how to do this and it's really been bothering me for a while (few hours). I just started using PHP with mysql about six hours ago and have managed to do the following. (e; I will also freely admit that I stole a whole lot of the code from google.)

code:

<?

include "connect.php";

$url = $_POST['url'];
$category = $_POST['category'];

echo "<center><FONT SIZE=-1 face=verdana>";
echo "Full URL: $url";
PRINT "<center><FONT SIZE=-1 face=verdana>";
PRINT "Category: $category"; 
      if(preg_match('/youtube\.com\/(v\/|watch\?v=)([\w\-]+)/', $_POST['url'], $id)) {;
      echo "<br>ID: $id[2]";
      }

mysql_query("INSERT INTO vids 
(URL, CATEGORY) VALUES('$id[2]', '$category' ) ") 
or die(mysql_error());  

mysql_close ($link);

?>
<html>
<body><br><br><object width="425" height="355"><param name="movie" value="http://www.youtube.com/v/<?php echo $id[2]; ?

>"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/<?php echo $id[2]; ?>" 

type="application/x-shockwave-flash" wmode="transparent" width="425" height="355"></embed></object>
</body>
</html>

This code takes a youtube url and a category selection from a form and strips the url to just the video ID and then sets that to $id while setting the category to $category. Then it saves the url's ID and category to an sql database. This is all working well and good but I was wondering if any of you smart guys could tell me how to go about making a link that randomly sends you to a video by category? That is to say if I were to click "dogs" it would give me a video that is tagged as "dogs" out of the database. As it stands right now everything, including display of the video that the user input in the form, is working as it should. I'm just a bit confused when it comes to calling the data I guess.

# ? Aug 25, 2008 02:06

jasonbar: Apr 30, 2005; Apr 29, 2005

The March Hare posted:

...random video...

You can do this using one sql statement, mysql_query() and http://www.php.net/mysql_fetch_assoc

code:

SELECT `URL`
FROM `vids`
WHERE `CATEGORY` = '$the_category'
ORDER BY RAND()
LIMIT 1

That should get you one random video from "$the_category". In place of your $id[2] in the movie ojbect link, you would use $result_row['URL']

# ? Aug 25, 2008 02:48

The March Hare: Oct 15, 2006; _{Je r�ve d'un}
Wayne's World 3; Buglord

jasonbar posted:

You can do this using one sql statement, mysql_query() and http://www.php.net/mysql_fetch_assoc
code:
SELECT `URL`
FROM `vids`
WHERE `CATEGORY` = '$the_category'
ORDER BY RAND()
LIMIT 1
That should get you one random video from "$the_category". In place of your $id[2] in the movie ojbect link, you would use $result_row['URL']

You're the best, I'll test this now and get back to the thread with results

# ? Aug 25, 2008 03:14

The March Hare: Oct 15, 2006; _{Je r�ve d'un}
Wayne's World 3; Buglord

Alright, after all this time I have managed to concoct this

code:

<?

include "connect.php";

$sql = "SELECT `URl`
    	FROM   `vids`
    	WHERE `CATEGORY` = 'dog' 
	ORDER BY RAND() 
	LIMIT 1";



$result = mysql_query($sql);
$row = mysql_fetch_assoc($result);


if (!$result) {
    echo "Could not successfully run query ($sql) from DB: " . mysql_error();
    exit;
}

if (mysql_num_rows($result) == 0) {
    echo "No rows found, nothing to print so am exiting";
    exit;
}	
	
mysql_close ($link);

?>
<html>
<body><br><br><object width="425" height="355"><param name="movie" value="http://www.youtube.com/watch?v=<?php echo $row; ?

>"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/watch?v=<?php echo $row; ?>" 

type="application/x-shockwave-flash" wmode="transparent" width="425" height="355"></embed></object>
<br><br>
<a href="http://localhost/imgay.php">Another!</a>
<a href="http://localhost/dogs.php">DOGS!</a>
</body>
</html>

I know it doesn't work because I tested it and it is returning

code:

<object width="425" height="355"><param name="movie" value="http://www.youtube.com/watch?v=Array"></param><param name="wmode" 
value="transparent"></param><embed src="http://www.youtube.com/watch?v=Array" 
type="application/x-shockwave-flash" wmode="transparent" width="425" height="355"></embed></object>

Any and all further help is greatly appreciated as this is all a bit over my head right now I think.

# ? Aug 25, 2008 04:26

bt_escm: Jan 10, 2001

change all the

php:

<?
echo $row;
?>

php:

<?
echo $row['URl']
?>

# ? Aug 25, 2008 04:28

The March Hare: Oct 15, 2006; _{Je r�ve d'un}
Wayne's World 3; Buglord

bt_escm posted:

change all the
php:
<?
echo $row;
?>
to
php:
<?
echo $row['URl']
?>

You da man, thanks

# ? Aug 25, 2008 04:32

nbv4: Aug 21, 2002; by Duchess Gummybuns

I have a huge array that is filled with strings in the form of "ABC-DEF", "ABC-XYZ", "XYZ-ABC", etc.

I want to not only remove duplicates (which is very easy), but also remove any "reverse" duplicates. For instance, only one of "XYZ-ABC" and "ABC-XYZ" should exist. Each three letter "word" represents a start point and an end point in a line. I only need each line once, not its "backcourse". This seems like a very simple problem, but I can't think of a simple solution that doesn't involve tons of lines of code and large memory useage.

# ? Aug 25, 2008 15:38

KuruMonkey: Jul 23, 2004

nbv4 posted:

"ABC-DEF"

Wherever and however you are checking for a dupe, construct the inverse and check for "dupe OR inverse"

e.g. if you have $a = "ABC-DEF" and check something like

php:

<?
$a = "ABC-DEF";
$current = "???-???"; // i.e. your current possibile dupe
if($a == $current)
{
// de-dupe
}
?>

you now want:

php:

<?
$a = "ABC-DEF";
$current = "???-???"; // i.e. your current possibile dupe
if($a == $current || implode("-", array_reverse(explode("-", $a)))) == $current)
{
// de-dupe
}
?>

or some such

if there are more details to the way XYZ-ABC is constructed (like if XZY == XYZ) you can probably find some more easy optimisation by eliminating the - and sorting the characters before comparing, or something.

There's probably also a cleverer way to do this if it becomes worth building a cache of mappings you've seen one way already (depends how common dupes will be, if you are running this test as part of an iteration that has to happen anyway etc etc)

Edit: I'm an idiot; change however you get the data into the array to only ever store "xyz-abc" OR "abc-xyz" as "abc-xyz" and then never have to do the reversing check while iterating.

2nd Edit: do as in edit 1, even if you just loop through tidying once on load, then you can just use array_unique, which on reflection you are probably doing now... (depends how huge the huge array is I guess)

KuruMonkey fucked around with this message at 16:05 on Aug 25, 2008

# ? Aug 25, 2008 15:57

nbv4: Aug 21, 2002; by Duchess Gummybuns

KuruMonkey posted:

Wherever and however you are checking for a dupe, construct the inverse and check for "dupe OR inverse"

I'm not really "checking" for dupes, I'm just doing:

php:

<?
$line_array = array_values(array_unique($line_array));        
?>

Basically "removing the dupe" just means removing it from the array. The only way I can think of is to determine what the inverse of the current string is:

php:

<?
implode("-", array_reverse(explode("-", $line_string))))?>

then searching through the array, looking to see if that string is present. If it is, then remove it from the array. The only problem is the array search function is very memory intensive, especially when you're searching a 5000 item array 5000 times.

# ? Aug 25, 2008 16:07

Begby: Apr 7, 2005; Light saber? Check. Black boots? Check. Codpiece? Check. He's more machine than kid now.

nbv4 posted:

I'm not really "checking" for dupes, I'm just doing: .....

A couple of things to keep in mind

1. Don't worry about how memory intensive it is unless you are actually seeing a performance hit under load.

2. Searching on array keys is faster than searching on array values

One thing you can do is read from the old array, and insert into a new array and have it keyed by the value you want to have unique

code:

foreach($oldArray as $value)
{
  $reversedValue = implode("-", array_reverse(explode("-", $value)))
  if (!array_key_exists($value, $newArray) && !array_key_exists($reversedValue, $newArray)
  {
   $newArray[$value] = 'stuff'
  }
}

Using the above, the first iteration the new array is length 0, the second iteration length 1, and so on. That way you aren't searching a 5000 item array on every iteration.

Secondly, its searching on keys instead of values. So this should be a lot faster.

# ? Aug 25, 2008 16:41

Mine GO BOOM: Apr 18, 2002; If it isn't broken, fix it till it is.

nbv4 posted:

Basically "removing the dupe" just means removing it from the array. The only way I can think of is to determine what the inverse of the current string is:

php:

<?
function sortNode($line_string)
{
  return implode("-", array_reverse(explode("-", $line_string))));
}

$line_array = array_values(array_unique(array_map('sortNode', $line_array)));
?>

Just order your values before you run array_unique. A better option is to have the ordered nodes be keys, as then it will always be unique.

# ? Aug 25, 2008 17:21

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 04:07

ante: Apr 9, 2005; SUNSHINE AND RAINBOWS

So, uh.
Arbitrary precision bitwise operators?

I'm using BCMath, but Christ. What a loving mess.

# ? Aug 25, 2008 23:27

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > <?PHP questions that don\\'t need their own thread ?>

«‹›223 »