Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #5564 > unrolled thread

php include, function, ...

Back to article view | Back to comp.lang.php

Contents

  php include, function, ... hipa <hipa.invalid@telenet.be> - 2012-04-18 20:03 +0000
    Re: php include, function, ... Redcat <redcat@catfolks.net> - 2012-04-18 20:08 +0000
      Re: php include, function, ... hipa <hipa.invalid@telenet.be> - 2012-04-21 06:40 +0000
    Re: php include, function, ... Arno Welzel <usenet@arnowelzel.de> - 2012-04-18 22:12 +0200
    Re: php include, function, ... Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-04-19 02:55 +0200
      Re: php include, function, ... hipa <hipa.invalid@telenet.be> - 2012-04-21 06:46 +0000
    Re: php include, function, ... IRC <ircadhikari@gmail.com> - 2012-04-19 03:55 -0700
    Re: php include, function, ... IRC <ircadhikari@gmail.com> - 2012-04-19 03:51 -0700

#5564 — php include, function, ...

Hi there

I have a litle page with a form, which inserts an article in a postgres 
db with php.
The php code is in the html page. Can someone tell me what the best way 
is to exclude the php code from this page. And then just calling it true 
a function or something?

<body>
<?php
if(isset($_POST['insertarticle']) && $_POST['insertarticle']){
     $dbh = pg_connect("host=..... dbname=..... user=..... 
password=.....");
     if (!$dbh) {
         die("Error in connection: " . pg_last_error());
     }

if(isset($_POST['article'])){
$article = pg_escape_string($_POST['article']);
$sql = "INSERT INTO tblarticle values ((select max(idarticle) + 1 from 
tblarticle), '{$article}')";
$result = pg_query($dbh, $sql);
}
{die(pg_last_error());}

if (!$result) {
         die("Error in SQL query: " . pg_last_error());
     }
pg_free_result($result);
pg_close($dbh);
}
?>

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post"> 
<input type="submit" name="insertarticle" value="Insert Article">
<label>Article:</label> <input id="article" name="article" type="text">
</form>
</body>

[toc] | [next] | [standalone]

#5565

On Wed, 18 Apr 2012 20:03:40 +0000, hipa wrote:

> Hi there
> 
> I have a litle page with a form, which inserts an article in a postgres
> db with php.
> The php code is in the html page. Can someone tell me what the best way
> is to exclude the php code from this page. And then just calling it true
> a function or something?

I'm not sure what you mean by "exclude the php code from the page". The 
code needs to be in the HTML file if it's going to execute. If you're 
worried about users being able to view your code, you needn't - the code 
won't get displayed to them, even if they do a "view source", if your web 
server is configured properly. The code will get executed on the server 
side when it's loaded, and will display to the user whatever output it's 
supposed to spit out.

What are you hoping to accomplish?

Redcat

[toc] | [prev] | [next] | [standalone]

#5620

Op Wed, 18 Apr 2012 20:08:51 +0000, schreef Redcat:

> On Wed, 18 Apr 2012 20:03:40 +0000, hipa wrote:
> 
>> Hi there
>> 
>> I have a litle page with a form, which inserts an article in a postgres
>> db with php.
>> The php code is in the html page. Can someone tell me what the best way
>> is to exclude the php code from this page. And then just calling it
>> true a function or something?
> 
> I'm not sure what you mean by "exclude the php code from the page". The
> code needs to be in the HTML file if it's going to execute. If you're
> worried about users being able to view your code, you needn't - the code
> won't get displayed to them, even if they do a "view source", if your
> web server is configured properly. The code will get executed on the
> server side when it's loaded, and will display to the user whatever
> output it's supposed to spit out.
> 
> What are you hoping to accomplish?
> 

Ok I explained it bad, and yes I'm not a php developer. Maybe just 
starting...
I put the code to connect to the db in separate php file.
So I can include it wherever I want.

include 'opendb.php';

Also going to look at classes...
I did not know that the code is nog visible for users, thanks!

[toc] | [prev] | [next] | [standalone]

#5566

hipa, 2012-04-18 22:03:

> Hi there
> 
> I have a litle page with a form, which inserts an article in a postgres 
> db with php.
> The php code is in the html page. Can someone tell me what the best way 
> is to exclude the php code from this page. And then just calling it true 
> a function or something?

Learn PHP - then come back.



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#5568

hipa wrote:

> I have a litle page with a form, which inserts an article in a postgres
> db with php.
> The php code is in the html page. Can someone tell me what the best way
> is to exclude the php code from this page. And then just calling it true
> a function or something?

Rather obviously you cannot exclude "the php code" from "this page" unless 
"this page" should become static.  However, you can move parts of the code 
into an include (file).  You do not have to call a function, but it helps. 

Probably the best way to do this is not only to call a function, but 
construct an object as defined by a class, so that it can encapsulate data 
(like state) and functionality, and call methods of that object that 
implement this functionality, which may include the generation of HTML (in 
an MVC-based approach that would be the view's methods).

Bottom line: RTFM.
 
> […]
> <form action="<?php echo $_SERVER['PHP_SELF']; ?>"

If you use $_SERVER['PHP_SELF'] this way your application is vulnerable to 
code injection as that element of the $_SERVER superglobal array includes 
the *complete* URI (with the query part).  Use $_SERVER['SCRIPT_NAME'], or 
htmlspecialchars() to escape $_SERVER['PHP_SELF'], instead (in general, 
escape all output in HTML unless you are very sure that escaping is 
unnecessary).  And use the POST method for requests that change data, so 
that those cannot be triggered accidentally while navigating back and 
forward (or as part of a low-profile attack).


PointedEars
-- 
Sometimes, what you learn is wrong. If those wrong ideas are close to the 
root of the knowledge tree you build on a particular subject, pruning the 
bad branches can sometimes cause the whole tree to collapse.
  -- Mike Duffy in cljs, <news:Xns9FB6521286DB8invalidcom@94.75.214.39>

[toc] | [prev] | [next] | [standalone]

#5621

Op Thu, 19 Apr 2012 02:55:47 +0200, schreef Thomas 'PointedEars' Lahn:

> hipa wrote:
> 
>> I have a litle page with a form, which inserts an article in a postgres
>> db with php.
>> The php code is in the html page. Can someone tell me what the best way
>> is to exclude the php code from this page. And then just calling it
>> true a function or something?
> 
> Rather obviously you cannot exclude "the php code" from "this page"
> unless "this page" should become static.  However, you can move parts of
> the code into an include (file).  You do not have to call a function,
> but it helps.

That is what I mean.

> Probably the best way to do this is not only to call a function, but
> construct an object as defined by a class, so that it can encapsulate
> data (like state) and functionality, and call methods of that object
> that implement this functionality, which may include the generation of
> HTML (in an MVC-based approach that would be the view's methods).

This is even more what I'm saying :-)

> Bottom line: RTFM.

Yes, I should more....

[toc] | [prev] | [next] | [standalone]

#5571

On Apr 18, 9:03 pm, hipa <hipa.inva...@telenet.be> wrote:
> Hi there
>
> I have a litle page with a form, which inserts an article in a postgres
> db with php.
> The php code is in the html page. Can someone tell me what the best way
> is to exclude the php code from this page. And then just calling it true
> a function or something?
>
> <body>
> <?php
> if(isset($_POST['insertarticle']) && $_POST['insertarticle']){
>      $dbh = pg_connect("host=..... dbname=..... user=.....
> password=.....");
>      if (!$dbh) {
>          die("Error in connection: " . pg_last_error());
>      }
>
> if(isset($_POST['article'])){
> $article = pg_escape_string($_POST['article']);
> $sql = "INSERT INTO tblarticle values ((select max(idarticle) + 1 from
> tblarticle), '{$article}')";
> $result = pg_query($dbh, $sql);}
>
> {die(pg_last_error());}
>
> if (!$result) {
>          die("Error in SQL query: " . pg_last_error());
>      }
> pg_free_result($result);
> pg_close($dbh);}
>
> ?>
>
> <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
> <input type="submit" name="insertarticle" value="Insert Article">
> <label>Article:</label> <input id="article" name="article" type="text">
> </form>
> </body>

"exclude the php code from this page" didn't make any sense, but, if
you would like to separate the php code from html page, better write
all the php stuff in one page and including it into the required area
or you make create a function and call it wherever you like.

[toc] | [prev] | [next] | [standalone]

#5572

On Apr 18, 9:03 pm, hipa <hipa.inva...@telenet.be> wrote:
> Hi there
>
> I have a litle page with a form, which inserts an article in a postgres
> db with php.
> The php code is in the html page. Can someone tell me what the best way
> is to exclude the php code from this page. And then just calling it true
> a function or something?
>
> <body>
> <?php
> if(isset($_POST['insertarticle']) && $_POST['insertarticle']){
>      $dbh = pg_connect("host=..... dbname=..... user=.....
> password=.....");
>      if (!$dbh) {
>          die("Error in connection: " . pg_last_error());
>      }
>
> if(isset($_POST['article'])){
> $article = pg_escape_string($_POST['article']);
> $sql = "INSERT INTO tblarticle values ((select max(idarticle) + 1 from
> tblarticle), '{$article}')";
> $result = pg_query($dbh, $sql);}
>
> {die(pg_last_error());}
>
> if (!$result) {
>          die("Error in SQL query: " . pg_last_error());
>      }
> pg_free_result($result);
> pg_close($dbh);}
>
> ?>
>
> <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
> <input type="submit" name="insertarticle" value="Insert Article">
> <label>Article:</label> <input id="article" name="article" type="text">
> </form>
> </body>

Hipa, "exclude the php code from this page" didn't make sense here.
However, you can separate php stuff by building function within the
individual page and then call that function wherever you like.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web