Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Treytor
Feb 8, 2003

Enjoy, uh... refreshing time!
This is an ip logger and checker, which outputs to a text file on the server. Is there a more efficient way to do this? Say for example if my site was getting hammered and my host was complaining about the PHP slowing down the entire server...

code:
function recordData($REMOTE_ADDR,$ipLog)
{ 
    $log=fopen("$ipLog", "a+"); 
    fputs ($log,$REMOTE_ADDR."][".time()."\n"); 
    fclose($log); 
    
} 
function checkLog($REMOTE_ADDR,$ipLog,$timeout) 
{
    global $valid; $ip=$REMOTE_ADDR;
    $data=file("$ipLog"); $now=time();

    foreach ($data as $record) 
    {
        $subdata=explode("][",$record);
        if ($now < ($subdata[1]+300*$timeout) && $ip == $subdata[0]) 
        {
            $valid=0; Header("Location: denied.php"); exit(0);
            break;
        }
    }
} 
checkLog($_SERVER['REMOTE_ADDR'],$ipLog,$timeout);
if ($valid!="0") recordData($_SERVER['REMOTE_ADDR'],$ipLog); 
EDIT: also, how would I delete expired entries?

Treytor fucked around with this message at 03:36 on Apr 2, 2008

Adbot
ADBOT LOVES YOU

such a nice boy
Mar 22, 2002

Treytor posted:

This is an ip logger and checker, which outputs to a text file on the server. Is there a more efficient way to do this? Say for example if my site was getting hammered and my host was complaining about the PHP slowing down the entire server...

EDIT: also, how would I delete expired entries?

Using a database would be more efficient. But if you really don't want to do that, why not set up a cron job to purge the stuff that's older than an hour, and have it run every hour or so?

Treytor
Feb 8, 2003

Enjoy, uh... refreshing time!
This isn't on my web host, and I don't have (free) access to the crontab on the server.

I realize this would work better in a DB, but that's beyond me at this point. Time is pressing and I would think if the script just deleted any entry older than the time specified it would help keep processing cost down?

EDIT:

Here is the script edited a bit, and this is what will get run repeatedly as people refresh like mad. What line do I throw in there to check to see if a time stamp is $timeout older than $now? And if so, delete that entry.

code:
<?php
$ipLog='ip.txt'; // Your logfiles name here
$timeout='300'; // How many seconds to block IP

function checkLog($REMOTE_ADDR,$ipLog,$timeout) 
{
    global $valid; $ip=$REMOTE_ADDR;
    $data=file("$ipLog"); $now=time();

    foreach ($data as $record) 
    {
        $subdata=explode("][",$record);
        if ($now < ($subdata[1]+$timeout) && $ip == $subdata[0]) 
        {
            $stamp = ($subdata[1]+$timeout) - $now;
			$timeleft = date('i', $stamp);
	    return $timeleft;
        }
    }
	    if(!isset($timeleft))
    {
        Header('Location: index.php');

    }

}

$timeleft = checkLog($_SERVER['REMOTE_ADDR'],$ipLog,$timeout);
?>

Treytor fucked around with this message at 04:18 on Apr 2, 2008

dustgun
Jun 20, 2004

And then the doorbell would ring and the next santa would come
Has anyone used Zend_Search_Lucene? I've got it all setup and working fairly well, but I can't get sort to work. At all.
The documentation says to just specify the field you want to sort by (and optionally, how to sort that) in the find method
$index->find($query); will get the results
$index->find($query,'created_on'); should be sorting by the created_on field. But it still sorts by the drat score.

What the hell? :(

uhhhh so apparently I was calling find() without any sorting further down. oops.

dustgun fucked around with this message at 04:43 on Apr 2, 2008

duz
Jul 11, 2005

Come on Ilhan, lets go bag us a shitpost


Treytor posted:

:words:

Instead of using explode and what not, look up fgetcsv and fputcsv.

Treytor
Feb 8, 2003

Enjoy, uh... refreshing time!

duz posted:

Instead of using explode and what not, look up fgetcsv and fputcsv.

Can you chat on gmail?

admiraldennis
Jul 22, 2003

I am the stone that builder refused
I am the visual
The inspiration
That made lady sing the blues

Treytor posted:

This is an ip logger and checker, which outputs to a text file on the server. Is there a more efficient way to do this? Say for example if my site was getting hammered and my host was complaining about the PHP slowing down the entire server...

:bang:

Let me quote myself from a few pages ago:

admiraldennis posted:

you should probably consider paying somebody to do the code correctly for you instead of asking a bunch of questions here just so you can use some crappy file database that's going to choke to death if your site ever gets a lot of traffic.
Do you have mysql access on your webhost?

I know you "want to do it yourself" but seriously if your site is getting hammered and your host is complaining just buck up and either 1) go learn to do this with a database, or 2) have somebody else do it for you and study the code and db schema to figure out how it works.

admiraldennis fucked around with this message at 08:37 on Apr 2, 2008

Begby
Apr 7, 2005

Light saber? Check. Black boots? Check. Codpiece? Check. He's more machine than kid now.

admiraldennis posted:

I know you "want to do it yourself" but seriously if your site is getting hammered and your host is complaining just buck up and either 1) go learn to do this with a database, or 2) have somebody else do it for you and study the code and db schema to figure out how it works.

I have to agree with this guy's view point.

Personally I cringe whenever I have to write or read from any sort of files. Its nots terribly difficult, but more difficult than working with a database. If you have any sort of head on your shoulders and are not illiterate, you should be able to figure out how to create a database, write to it, then read from it in 4 hours max.

duz
Jul 11, 2005

Come on Ilhan, lets go bag us a shitpost


I helped him out with what he needed to do to access a DB and wrote the SQL query needed. I'm guessing everything worked out.

duck monster
Dec 15, 2004

duz posted:

The roll-your-own kind. Good luck figuring out that system!


Alt tags on inputs are for screen readers. jQuery has a nice form validation plugin that uses class names or you can use JSON to build you validation requirements.


Edit: fopen is GET only, not POST, sorry. vv Learn something new all the time, that might come in handy.

Yes, except that for input tags, you normally use the <label> tag to tell a screen reader what its for. Its yet another anomaly in html, but it means that the alt attribute on INPUT tags genuinely have no role.

omgwtfnoway
Aug 22, 2004

Uhhh.... little help here, please?
I'm trying to use exec() in a php script to add and commit some files to SVN.

I'm doing something like:

code:
$cmd = "cd c:\pathWithSVN";
exec($cmd);
$cmd = "svn add $abaFilename";
exec($cmd);
I had to cd into that path first - or else any SVN commands won't execute.

Then to commit - I do something like:

code:
$cmd = "cd c:\pathWithSVN";
exec($cmd);
$cmd = "svn commit -m \"Updates yadda yadda\"";
exec($cmd);
The problem is: neither of these commands are being run. Any ideas? I've never tried executing command line commands from a script before. This is run on a windows machine with apache/php5.

brae
Feb 2, 2006

omgwtfnoway posted:

I'm trying to use exec() in a php script to add and commit some files to SVN.

I'm doing something like:

code:
$cmd = "cd c:\pathWithSVN";
exec($cmd);
$cmd = "svn add $abaFilename";
exec($cmd);
...

The problem is: neither of these commands are being run. Any ideas? I've never tried executing command line commands from a script before. This is run on a windows machine with apache/php5.

I don't know how it works on windows, but in UNIX I wouldn't expect changing directories this way (via exec) to work. Try chdir:
http://us2.php.net/manual/en/function.chdir.php

Also exec returns the last line of output from the thing you're trying to run. Do you get anything in your example? Do you have safe_mode disabled? If it's enabled, you can only exec in certain directories.

minato
Jun 7, 2004

cutty cain't hang, say 7-up.
Taco Defender
Are you using double back slashes? If not, then the actual string will be "cd c:pathWithSVN". Try using single quotes.

Edit: Also, the "cd blah" thing is never going to work, the scope is limited to that exec call only. Use chdir as brae suggests.

Also, use escapeshellarg() to ensure that your command line parameters get passed correctly.

Acer Pilot
Feb 17, 2007
put the 'the' in therapist

:dukedog:

How can I improve this system of including/defining?

code:
define('ROOT_PATH', '/home/username');	// set the ROOT_PATH here
define('BACKYARD', '/lawn');		// set the backyard path here
include_once(ROOT_PATH . BACKYARD . '/config.inc.php');
include_once(ROOT_PATH . BACKYARD . '/skin.php');
include_once(ROOT_PATH . BACKYARD . '/db.inc.php');
include_once(ROOT_PATH . BACKYARD . '/error.inc.php');
I've set up 3 pages so far but I'm worried about making changes for when we go live...

Begby
Apr 7, 2005

Light saber? Check. Black boots? Check. Codpiece? Check. He's more machine than kid now.

drcru posted:

How can I improve this system of including/defining?

code:
define('ROOT_PATH', '/home/username');	// set the ROOT_PATH here
define('BACKYARD', '/lawn');		// set the backyard path here
include_once(ROOT_PATH . BACKYARD . '/config.inc.php');
include_once(ROOT_PATH . BACKYARD . '/skin.php');
include_once(ROOT_PATH . BACKYARD . '/db.inc.php');
include_once(ROOT_PATH . BACKYARD . '/error.inc.php');
I've set up 3 pages so far but I'm worried about making changes for when we go live...

You can setup a config.php file in your root, or even above your site root, then include that at the top of your pages. Then use the constants in your pages.

in config.php you might have something like this.....

code:
define('SITE_ROOT', dirname(__FILE__));
define('INCLUDE_PATH', SITE_ROOT.DIRECTORY_SEPARATOR.'/lawn');
Then in one of your pages
code:
require_once('../config.php');
require_once(INCLUDE_PATH.'/error.inc.php');
'__FILE__' means 'the full path name of the file I am currently in'. So if you're config.php file is in /some/path/config.php, that is exactly what will be in __FILE__. Try echoing it.

dirname() will take a string that is a file path and try to chop off the file and return the directory only. So if you pass it /some/path/config.php it should return /some/path.

'DIRECTORY_SEPARATOR' is a predefined constant that has the directory separator specific to the OS you are running php on. So if you are on windows it will return '\\' and on linux '/'.

So now if you have a single include that is setup like that you never have to change any of this even if you move your app to another server, which is handy. The only thing you might need to change is the require_once('../config.php') if you start moving files around.

duz
Jul 11, 2005

Come on Ilhan, lets go bag us a shitpost


omgwtfnoway posted:

I'm trying to use exec() in a php script to add and commit some files to SVN.

Install the SVN PECL extension then do it natively.

omgwtfnoway
Aug 22, 2004

Uhhh.... little help here, please?

duz posted:

Install the SVN PECL extension then do it natively.

This is what I ended up doing. Seems to work pretty well.

Thanks for the help.

fletcher
Jun 27, 2003

ken park is my favorite movie

Cybernetic Crumb
All my classes refer to $this->database to interact with the database. Is there any way to avoid having to pass it in as a parameter to a static function of a different class that needs the db?

Small White Dragon
Nov 23, 2007

No relation.

fletcher posted:

All my classes refer to $this->database to interact with the database. Is there any way to avoid having to pass it in as a parameter to a static function of a different class that needs the db?

You could use the singleton design pattern.

nbv4
Aug 21, 2002

by Duchess Gummybuns
is there a more elegant way to do this?:

code:
$variable = $field . "_sel";
$$variable = "checked";

Evil Angry Cat
Nov 20, 2004

nbv4 posted:

is there a more elegant way to do this?:

code:
$variable = $field . "_sel";
$$variable = "checked";

When this is absolutely neccesary I go with ${$variable} = "whatever"; . I'd have to see a bigger section of your code to see if there was an easier/cleaner way around it (which there usually is).

gibbed
Apr 10, 2006

Evil Angry Cat posted:

When this is absolutely neccesary I go with ${$variable} = "whatever"; . I'd have to see a bigger section of your code to see if there was an easier/cleaner way around it (which there usually is).
Personally I would go with an array.

OlSpazzy
Feb 10, 2004

Does anyone see a reason why the "show news comments" section of this code is only displaying the newest comment for each post?

$comments_list_commentbit is being called from within the template for "news_newsbit_commentslink". Note that some classes and variables may not appear to be defined as this is only a portion of the script.

php:
<?
if ($action == '')
{
    define('ISPRINTABLEPAGE', false);
    define('WILLTRUNCATE', true);
    define('ISRSS', false);
    $templatesused = 'news_newsbit, news_newsbit_commentslink, news_avatarbit, news_newsbit_readmorelink, comments_list_commentbit, comments_list_commentbit_removecomment';
    unp_cacheTemplates($templatesused);
    $getnews = $DB->query("SELECT * FROM `unp_news` ORDER BY `date` DESC LIMIT $newslimit");
    while ($news = $DB->fetch_array($getnews))
    {
        $catid = $news['catid'];
        $category = $categorycache["$catid"];
        $newsid = $news['newsid'];
        $subject = $news['subject'];
        $newstext = $news['news'];
        $poster = $news['poster'];
        $posterid = $news['posterid'];
        $date = $news['date'];
        $postdate = unp_date($dateformat, $date);
        $posttime = unp_date($timeformat, $date);
        $avatar = unp_checkAvatar($posterid);
        // begin Show News Comments
        $getcomments = $DB->query("SELECT * FROM `unp_comments` WHERE newsid='$newsid'");
        if ($DB->num_rows($getcomments) > 0)
        {
            while ($comments = $DB->fetch_array($getcomments))
            {
                // grab and fix up comments
                $c_id = $comments['id'];
                $c_title = htmlspecialchars(stripslashes($comments['title']));
                $c_name = htmlspecialchars(stripslashes($comments['name']));
                $c_email = htmlspecialchars(stripslashes($comments['email']));
                $c_date = unp_date($dateformat, $comments['date']);
                $c_time = unp_date($timeformat, $comments['date']);
                $c_text = nl2br(htmlspecialchars(stripslashes($comments['comments'])));
                $c_ipaddress = $comments['ipaddress'];
                $c_proxy = $comments['proxy'];
                $c_text = $n->unp_doSmilies($c_text);
                if ($isloggedin == 1)
                {
                    eval('$removecommentlink = "'.unp_printTemplate('comments_list_commentbit_removecomment').'";');
                }
                else
                {
                    $removecommentlink = '';
                }
                eval('$comments_list_commentbit = "'.unp_printTemplate('comments_list_commentbit').'";');
            }
        }
        else
        {
            $comments_list_commentbit = '';
        }
        // end Show News Comments
        if (!$avatar)
        {
            $useravatar = '';
        }
        else
        {
            eval('$useravatar = "'.unp_printTemplate('news_avatarbit').'";');
        }
        if ($commentsallowance == '1')
        {
            $comments = $news['comments'];
            eval('$commentsinfo = "'.unp_printTemplate('news_newsbit_commentslink').'";');
        }
        else
        {
            $commentsinfo = '&nbsp;';
        }
        $comments = $news['comments'];
        //$newstext = $n->unp_doNewsTrim($newstext); // Move to unp_doNewsFormat
        $newstext = $n->unp_doNewsFormat($newstext);
        $subject = $n->unp_doSubjectFormat($subject);
        // NewsBit
        eval('$news_newsbit = "'.unp_printTemplate('news_newsbit').'";');
        unp_echoTemplate($news_newsbit);
                
        // NewsBit
        echo "\n\n";
    }
    unset($news);
}?>

bt_escm
Jan 10, 2001

OlSpazzy posted:

Does anyone see a reason why the "show news comments" section of this code is only displaying the newest comment for each post?

$comments_list_commentbit is being called from within the template for "news_newsbit_commentslink". Note that some classes and variables may not appear to be defined as this is only a portion of the script.

php:
<?
code
?>

I looks like you are assigning $comments_list_commentbit each time. I think you want to use .= instead of =

Also I see no reason to use eval here or anywhere else in your code and it's really just a style and readability thing, but never use select * from table, even when you want to select everything from the table. List out the columns. It will save your sanity in the future.

OlSpazzy
Feb 10, 2004

bt_escm posted:

I looks like you are assigning $comments_list_commentbit each time. I think you want to use .= instead of =

Also I see no reason to use eval here or anywhere else in your code and it's really just a style and readability thing, but never use select * from table, even when you want to select everything from the table. List out the columns. It will save your sanity in the future.

I actually did try .= instead and somehow that causes each post to display all of it's comments AND the comments of the post above it. Posts with zero comments don't display anything. It also causes this notice only once at the top of code execution:

code:
Notice: Undefined variable: comments_list_commentbit in /home/x/y/z.com/news/news.php(149) : eval()'d code on line 8
Also, the evals are necessary, without them unp_printTemplate('comments_list_commentbit') returns, for example:

{$c_name}{$c_date} at {$c_time} {$removecommentlink}
{$c_text}

So it's needed to get the variables within the templates to actually parse. Thanks for the suggestion on table selections.

duz
Jul 11, 2005

Come on Ilhan, lets go bag us a shitpost


OlSpazzy posted:

Also, the evals are necessary, without them unp_printTemplate('comments_list_commentbit') returns, for example:

eval is never necessary. Especially not when all you're doing is string replacement.

fletcher
Jun 27, 2003

ken park is my favorite movie

Cybernetic Crumb

OlSpazzy posted:

php:
<?
$newsid = $news['newsid'];
?>

I might be alone on this, but I don't understand the point of doing that. It adds lines to the code and makes it less readable, in my opinion.

Also, if you are using an object oriented DB layer instead of building the SQL manually like "SELECT * FROM `unp_comments` WHERE newsid='$newsid'" you should consider using prepared statements.

Finite
Jan 9, 2003

What do you mean mullets aren't fashionable?!?

OlSpazzy posted:

So it's needed to get the variables within the templates to actually parse. Thanks for the suggestion on table selections.

I built a simple templating function and I used extract instead, so you get things like this:

php:
<?
$templateData = array('variable1' => 'value goes here', 'variable2' => 'another value here');
extract($templateData);

print ($variable1);
// Outputs 'value goes here'
?>
I'm not sure if this is the best way, but eval is something that is generally frowned upon.
Also, put "rendering" code like that inside a function so you don't accidentally write over any variables you need.

fletcher posted:

I might be alone on this, but I don't understand the point of doing that. It adds lines to the code and makes it less readable, in my opinion.

I do it in a few places to do things like...

code:
$colour = $data['colour'];
$string = "The lazy $colour fox jumps over the I can't remember the rest of this."
But I decided that was a little stupid the other day and I'm trying to use sprintf instead.

Finite fucked around with this message at 20:15 on Apr 4, 2008

bt_escm
Jan 10, 2001
I honestly don't know where to begin with this.

To fix the append issues try adding $comments_list_commentbit='' in between the number of rows check and the while loop.


Don't use eval.

bt_escm fucked around with this message at 20:18 on Apr 4, 2008

duz
Jul 11, 2005

Come on Ilhan, lets go bag us a shitpost


Finite posted:

I do it in a few places to do things like...
code:
$colour = $data['colour'];
$string = "The lazy $colour fox jumps over the I can't remember the rest of this."
But I decided that was a little stupid the other day and I'm trying to use sprintf instead.

You're supposed to use braces when you want the contents of a variable.

php:
<?
$string = "The quick {$data['colour']} fox jumps over the lazy dogs."
?>

Inquisitus
Aug 4, 2006

I have a large barge with a radio antenna on it.

duz posted:

You're supposed to use braces when you want the contents of a variable.

php:
<?
$string = "The quick {$data['colour']} fox jumps over the lazy dogs."
?>

Alternatively:
php:
<?
$string = "The quick $data[colour] fox jumps over the lazy dogs."
?>

fletcher
Jun 27, 2003

ken park is my favorite movie

Cybernetic Crumb

Finite posted:

I do it in a few places to do things like...

code:
$colour = $data['colour'];
$string = "The lazy $colour fox jumps over the I can't remember the rest of this."
But I decided that was a little stupid the other day and I'm trying to use sprintf instead.

What is wrong with

php:
<?
$string = "The lazy ".$data['color']." fox jumps over ...";
?>
Why introduce another variable?

Finite
Jan 9, 2003

What do you mean mullets aren't fashionable?!?

duz posted:

You're supposed to use braces when you want the contents of a variable.

php:
<?
$string = "The quick {$data['colour']} fox jumps over the lazy dogs."
?>

...

...

I had no idea you could do that.

fletcher posted:


Sorry, that was a bit too simple of an example. I usually do it when I'm trying to put several variables in a string, I find it more readable.

admiraldennis
Jul 22, 2003

I am the stone that builder refused
I am the visual
The inspiration
That made lady sing the blues

Finite posted:

...

...

I had no idea you could do that.

Thats the only way one should include variables within a double-quoted string, in my opinion. Either that or with a concatenation. It's borderline ambiguous otherwise and hurts readability.

duz
Jul 11, 2005

Come on Ilhan, lets go bag us a shitpost


admiraldennis posted:

Thats the only way one should include variables within a double-quoted string, in my opinion. Either that or with a concatenation. It's borderline ambiguous otherwise and hurts readability.

And braces allows you to do crazy things like:
php:
<?
$variable = 'something';
$obj->a = 'variable';
echo ${$obj->a};
?>

<deleted user>

Treytor posted:

Here is the script edited a bit, and this is what will get run repeatedly as people refresh like mad. What line do I throw in there to check to see if a time stamp is $timeout older than $now? And if so, delete that entry.

code:
<?php ?>

I know you posted a few days ago, but I just saw it and it's too fun to pass up, so here's a five minute version of an approach you may try...

php:
<?

define('LOG_PATH', '/tmp/mylogs');
define('TIMEOUT', 300);

function ip2path($ip_string, $check_path = false) {
    $ip_long = ip2long($ip_string);
    $filename = constant('LOG_PATH');
    for($i = 0; $i < 4; $i++) {
        $filename .= '/' . ($ip_long >> ($i*8) & 255);
        if($i == 3 && $check_path && !file_exists($filename)) {
            for($j = 0; $j < 3; $j++) @mkdir(constant('LOG_PATH') . ($create_dir .= '/' . ($ip_long >> ($j*8) & 255)));
        }
    }
    return $filename;
}

function recordData($ip) {
    $fh = fopen(ip2path($ip, true), 'w+');
    fwrite($fh, pack('l', time()));
    fclose($fh);
}

function checkLog($ip) {
    if(($fh = @fopen(ip2path($ip), 'r')) === false) return true;
    list($foobar, $logtime) = unpack('l', fread($fh, 4));
    fclose($fh);
    return (time() + 200 > ($logtime + constant('TIMEOUT')));
}

# example use...
$some_ip = '21.36.14.10';
printf("path for %s is: %s\n", $some_ip, ip2path($some_ip));
recordData($some_ip);
printf("is ip ok? %s\n", checkLog($some_ip) ? 'yes' : 'no');

?>
I guarantee you this can take a hammering. Basically, you take advantage of the filesystem's ability to lookup filenames quickly. It maintains a directory structure based on the IP octets, so that you don't have 2^32 files in one directory (which would not be good). This also only uses 4 bytes of disk space per address you log.

As a bonus, if you want to delete old entries, you can cron a one-liner with find to remove files older than a certain modification time.

Scarboy
Jan 31, 2001

Good Luck!

admiraldennis posted:

Thats the only way one should include variables within a double-quoted string, in my opinion. Either that or with a concatenation. It's borderline ambiguous otherwise and hurts readability.

I disagree. If you're going to be outputting this, and it's data from the user then I would use sprintf and wrap the variable in htmlentities() (I don't write PHP much, is this the correct function to use?) to not allow html/js injection.

duz
Jul 11, 2005

Come on Ilhan, lets go bag us a shitpost


Scarboy posted:

I disagree. If you're going to be outputting this, and it's data from the user then I would use sprintf and wrap the variable in htmlentities() (I don't write PHP much, is this the correct function to use?) to not allow html/js injection.

Ideally you'd have already sanitized it by the time you output it.

hey mom its 420
May 12, 2007

I'm of the opinion that it's generally best to sanitize data as late as possible. So if you're sanitizing it for output, sanitize it right before outputting or when you know that you won't be doing anything with it other than outputting.

Adbot
ADBOT LOVES YOU

minato
Jun 7, 2004

cutty cain't hang, say 7-up.
Taco Defender
I'm with Bonus, sanitize when you need to. If you sanitize before you write to the DB it means that:

- You can present the user with exactly what they wrote if they go back to edit it. We have a comment system that you can enter HTML into, and we use HTMLtidy to clean it and sanitize it. The guy who implemented the system made it so that the data was always cleaned before writing, and so we get users confused as to why their post has tags inserted into it that they didn't write themselves.

- As a coder you can get a false sense of security by assuming that all DB data is clean.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply