<?PHP questions that don\\'t need their own thread ?>

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > <?PHP questions that don\\'t need their own thread ?>

hey mom its 420: May 12, 2007

You also can't do

php:

<?
$bla = new Something()->method();
?>

and I don't know why the hell PHP doesn't allow that.

# ¿ Mar 19, 2008 23:51

Adbot: ADBOT LOVES YOU

# ¿ Apr 29, 2024 10:09

hey mom its 420: May 12, 2007

duck monster posted:

or are you after an initialised object?

Ie $address = new Customer('Dr Philodimo')->address()

Yeah, that's what I was thinking of. It makes no sense that you can't do it because it's not like you can juggle classes in PHP like you can with Python so that there would be ambiguity as to what the new keyword refers to. It always refers to the thing closest to it, so I really don't see a reason why you can't do stuff like that.

# ¿ Mar 20, 2008 00:45

hey mom its 420: May 12, 2007

Don't you mean /<mytag>([^<]*)</mytag>/

# ¿ Mar 28, 2008 14:10

hey mom its 420: May 12, 2007

I'm of the opinion that it's generally best to sanitize data as late as possible. So if you're sanitizing it for output, sanitize it right before outputting or when you know that you won't be doing anything with it other than outputting.

# ¿ Apr 5, 2008 10:04

hey mom its 420: May 12, 2007

Zorilla posted:

So would there be anything wrong with sanitizing as late as the MySQL query string? Right now, I'm getting away with processing form inputs with their original $_POST superglobals, then using htmlspecialchars() at the query function argument to keep form inputs from doing anything too powerful, though I don't know if that would leave you wide open on older, less secure versions of PHP.

Yeah.
But ideally I think the sanitizing for the database should be coupled with the layer that does the actual insertion. A good example of that is either ADOdb or mysqli where you do stuff like this:

php:

<?
$conn->Execute("SELECT * FROM TABLE WHERE COND=?", array($val));
?>

and

php:

<?
$stmt->prepare("SELECT District FROM City WHERE Name=?")) {
$stmt->bind_param("s", $city);
$stmt->execute();
$stmt->bind_result($district);
$stmt->fetch();
?>

respectively. The general idea is that this is good delegation of responsibility, in that the layer communicating with the database is responsible for not exposing the database to injection. So there's no way you could forget to escape data before giving it to the database layer for insertion because it's its responsibility and not yours. :science:

And you probably shouldn't sanitize the input in any other way (i.e. htmlspecialchars) before inserting it into the database. You should always have pure data in your database and then sanitize it for output after fetching it from the database.

hey mom its 420 fucked around with this message at 00:15 on Apr 7, 2008

# ¿ Apr 7, 2008 00:12

hey mom its 420: May 12, 2007

Incidentally, does anyone else think that the interface for mysqli is loving terrible? Especially the bind_param method. First you have to prepare the statement, then you have to bind parameters to it by giving it variables and strings like "sssd", then execute, bind results to variable, then fetch the data and then loop and output the variables that have the results binded to them repeatedly.
Sure, binding results to variables and then the current row being assigned to those variables saves memory by not storing all results in an array but it's not like you're going to be outputting 1 million records on a single page.
ADOdb does it way better.

# ¿ Apr 7, 2008 00:26

hey mom its 420: May 12, 2007

What's a good PHP library for sending out emails? Just one at a time from a form, so no need for mass mailing.

# ¿ May 8, 2008 10:38

hey mom its 420: May 12, 2007

nbv4 posted:

mail()? doesnt get much simpler than that

Yeah, simpler, but I don't really feel like being the victim of a header injection attack or spending several hours getting myself acquainted with and implementing protection against such attacks.

Zorilla: Thanks, I'll try that out!

# ¿ May 8, 2008 11:24

hey mom its 420: May 12, 2007

Dominoes posted:

I just learned PHP, and set up a simple script to email me submitted form data. I have a small problem that I"m hoping someone can help me with.

Here's the website with form.

Here's the PHP file:
code:
<html>
<body>
<?php

$to = "contact@equilibriumpomade.com";
$subject = "Question/Comment";
$name = $_REQUEST["name"];
$message = $_REQUEST["question"];
$from = $_REQUEST["email"];
$headers = "From: $from";

mail($to,$subject,"Name: $name
Message: $message",$headers);
echo "Message Sent!";
?>
</body>
</html>
The emails are received, but the person using the form is redirected to the php page with the printed text. How do I direct the user to an HTML page instead? I don't want them to go to the php page, I just want to use the script to process the form data.

One word of advice: You are receiving data from the user and putting it directly into emails that you send. Much like putting in data from the user into the database without escaping it, you're leaving yourself open for an injection attack here. Only here it's a header injection attack, meaning that anyone can use your email form to send spam from your server to anyone, not just you. This is okay if you're just learning how emails in PHP generally work, but if you're going to be putting it up for use, it's a good idea to filter it.
I just asked about PHP mailing libraries one page ago and at the end I found the Swift library, which filters the data for you. I recommend it, works nicely and I got it set up and working in a matter of minutes.

# ¿ May 11, 2008 12:04

hey mom its 420: May 12, 2007

what the hell

I'm trying to have a user upload an image and then I resize it with gd and save it. I'm using a mix of functions that I got from php.net and some other place. Thing is, it works for very small images, but if I try a bigger image (like 250k), I get this error message

code:

Fatal error: Allowed memory size of 16777216 bytes exhausted (tried to allocate 7500 bytes) in 
F:\AppServ\www\klancar2\funcs.php on line 61

How the hell does it exhaust 16 megs of allowed memory size when trying to allocate 7500 bytes?

I could post the functions I use to convert the images but they're pretty long, basically it's just finding out what the type of the image is with a lot of case structures, then it calculates the new width and height and then it calls imagecopyresampled and then it saves it.

hey mom its 420 fucked around with this message at 17:32 on May 11, 2008

# ¿ May 11, 2008 17:28

hey mom its 420: May 12, 2007

Thanks guys, I managed to solve it by adding around more calls to free up resources and such.
Also, here's something that drove me up the wall today. IE uploads jpg files as image/pjpeg while other browsers do it as image/jpg. I spent at least an hour and then some running around trying to find out why images uploaded with IE don't work, because I was turning the second part of the MIME type directly into the extension. Ugh!

# ¿ May 12, 2008 00:42

hey mom its 420: May 12, 2007

It's easy to convert from a MySQL DATETIME field to a timestamp by using the UNIX_TIMESTAMP MySQL function or to convert from a timestamp to a DATETIME field by using the FROM_UNIXTIME MySQL function, so in the end it largely depends on preference.

# ¿ May 12, 2008 23:26

hey mom its 420: May 12, 2007

I use ADOdb, it's pretty cool, especially parametrization, where you do $db->execute("SELECT * FROM foo WHERE foo.bar = ?", array("baz"))

# ¿ May 13, 2008 18:47

hey mom its 420: May 12, 2007

That depends on the conditions, really. What's the second condition? If it doesn't evaluate to true, whose fault is that? Why would you want your script to just die instead of sending a useful error header and/or message to the user?

# ¿ Jun 26, 2008 00:51

hey mom its 420: May 12, 2007

Yeah, foreach is basically the control flow construct for templates. It needs minimal logic and produces the desired behaviour. If you wanted to put foreach loops out of your templates, you'd probably have to generate all the HTML that requires looping in the controllers and then pass that off to the views ... :wtc:

# ¿ Jul 10, 2008 01:01

hey mom its 420: May 12, 2007

Yeah.

You can't change databases once you have them inside because the BLOB format might be incompatible.
You can't get the images via other protocols (FTP or something RESTful or whatever) without resorting to writing scripts that query the DB and then relay the images.
There are performance implications. Getting them out of the database every time and then echoing them through a serverside language is slow and since the database is the most likely bottleneck of a website you should hit it as little as possible.

Pretty much the only upside to storing them in the DB is that there's no chance of having broken links. But I've used the approach of storing them in the filesystem many times and I've never had any broken links. Just remember to check if it's been uploaded to the filesystem before committing the database record and if it hasn't then just roll it back.

# ¿ Jul 10, 2008 17:10

hey mom its 420: May 12, 2007

My PHP is really rusty and I ran into this problem when building a site for something I'm making. I have an associative array with strings as the keys and they point to arrays:

php:

<?
$contents = array
    ( 'introduction' => array( ...
    , 'starting-out' => array( ...
    , 'types-and-typeclasses' => array( ...
    , 'syntax-in-functions' => array( ...
    , 'higher-order-functions' => array ( ...
    , ...
    )
?>

What I want is a function that will take a key and return the key before it and after it. So if I call it like prevnext("types-and-typeclasses"), I want to get two strings back, namely ["starting-out", "syntax-in-functions"]. I implemented this function already but it looks very inelegant. Basically I use a while loop and the next function to traverse the array and then when I find the element I want, I gently caress around with calling prev once, storing the string, then next twice, storing the string, going back once with prev and then returning those two strings. It seems awfully hackish.

# ¿ Aug 30, 2008 12:25

Adbot: ADBOT LOVES YOU

# ¿ Apr 29, 2024 10:09

hey mom its 420: May 12, 2007

Ah, awesome! Yeah, that looks much more elegant! My PHP's real rusty, I totally forgot about array_keys and array_search. Thanks!

# ¿ Aug 30, 2008 15:42

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > <?PHP questions that don\\'t need their own thread ?>