Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #5568

Re: php include, function, ...

Followups directed to: comp.lang.php

Show all headers | View raw

hipa wrote:

> I have a litle page with a form, which inserts an article in a postgres
> db with php.
> The php code is in the html page. Can someone tell me what the best way
> is to exclude the php code from this page. And then just calling it true
> a function or something?

Rather obviously you cannot exclude "the php code" from "this page" unless 
"this page" should become static.  However, you can move parts of the code 
into an include (file).  You do not have to call a function, but it helps. 

Probably the best way to do this is not only to call a function, but 
construct an object as defined by a class, so that it can encapsulate data 
(like state) and functionality, and call methods of that object that 
implement this functionality, which may include the generation of HTML (in 
an MVC-based approach that would be the view's methods).

Bottom line: RTFM.
 
> […]
> <form action="<?php echo $_SERVER['PHP_SELF']; ?>"

If you use $_SERVER['PHP_SELF'] this way your application is vulnerable to 
code injection as that element of the $_SERVER superglobal array includes 
the *complete* URI (with the query part).  Use $_SERVER['SCRIPT_NAME'], or 
htmlspecialchars() to escape $_SERVER['PHP_SELF'], instead (in general, 
escape all output in HTML unless you are very sure that escaping is 
unnecessary).  And use the POST method for requests that change data, so 
that those cannot be triggered accidentally while navigating back and 
forward (or as part of a low-profile attack).


PointedEars
-- 
Sometimes, what you learn is wrong. If those wrong ideas are close to the 
root of the knowledge tree you build on a particular subject, pruning the 
bad branches can sometimes cause the whole tree to collapse.
  -- Mike Duffy in cljs, <news:Xns9FB6521286DB8invalidcom@94.75.214.39>

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

php include, function, ... hipa <hipa.invalid@telenet.be> - 2012-04-18 20:03 +0000
  Re: php include, function, ... Redcat <redcat@catfolks.net> - 2012-04-18 20:08 +0000
    Re: php include, function, ... hipa <hipa.invalid@telenet.be> - 2012-04-21 06:40 +0000
  Re: php include, function, ... Arno Welzel <usenet@arnowelzel.de> - 2012-04-18 22:12 +0200
  Re: php include, function, ... Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-04-19 02:55 +0200
    Re: php include, function, ... hipa <hipa.invalid@telenet.be> - 2012-04-21 06:46 +0000
  Re: php include, function, ... IRC <ircadhikari@gmail.com> - 2012-04-19 03:55 -0700
  Re: php include, function, ... IRC <ircadhikari@gmail.com> - 2012-04-19 03:51 -0700

csiph-web