Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > comp.lang.php > #10373 > unrolled thread

GUI designer in html

Started byLightee <lightaiyee@gmail.com>
First post2013-08-03 23:32 -0700
Last post2013-08-07 12:55 -0400
Articles 20 on this page of 28 — 8 participants

Back to article view | Back to comp.lang.php


Contents

  GUI designer in html Lightee <lightaiyee@gmail.com> - 2013-08-03 23:32 -0700
    Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-04 09:17 +0200
    Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-04 09:23 +0100
      Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-04 13:10 +0100
      Re: GUI designer in html bill <william@TechServSys.com> - 2013-08-06 09:33 -0400
        Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-06 15:56 +0100
    Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-04 09:48 -0400
      Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:22 -0400
        Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-04 17:33 +0100
        Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-04 22:11 -0400
    Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:40 -0400
      Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 08:14 -0400
    PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:47 -0400
      Re: PS Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-04 19:09 +0200
        Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 17:01 -0400
        Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-04 22:23 +0100
        Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-04 20:59 -0400
          Re: PS Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-05 06:41 +0200
            Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-05 10:57 -0400
              Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-05 18:55 -0400
                Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-06 00:32 +0100
                  Re: PS Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 19:59 -0400
                  Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-07 12:51 -0400
                    Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-07 18:52 +0100
          Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-05 10:51 -0400
            Re: PS Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 20:00 -0400
            Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-05 21:35 -0400
              Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-07 12:55 -0400

Page 1 of 2  [1] 2  Next page →


#10373 — GUI designer in html

FromLightee <lightaiyee@gmail.com>
Date2013-08-03 23:32 -0700
SubjectGUI designer in html
Message-ID<5d478759-277d-41b1-bdab-f6e1b2076093@googlegroups.com>
Would the web application developers here recommend some Visual-basic like GUI designer for HTML? I find it rather tedious to design web forms in HTML code manually. Is there a good tool for this job?

Thank you.

[toc] | [next] | [standalone]


#10374

From"J.O. Aho" <user@example.net>
Date2013-08-04 09:17 +0200
Message-ID<b66dfqFmtabU1@mid.individual.net>
In reply to#10373
On 04/08/13 08:32, Lightee wrote:
> Would the web application developers here recommend some Visual-basic like GUI designer for HTML?
> I find it rather tedious to design web forms in HTML code manually. Is there a good tool for this job?

I tend to see such tools make poor html which may only work in certain 
browser. I would suggest you look at something like Bootstrap which will 
make it a lot easier to make good looking sites and you need to fiddle 
less with the html/css as much is already designed for you.

For forms I would most likely just build up functions generating the 
right type of input, and then have a array which describes which 
variables to use, which type of input and the text (label, description),
then generate the output based on the content of the array, if you need 
to change something, add/remove from the array as you please and you 
don't need to make any changes for html.

-- 

  //Aho

[toc] | [prev] | [next] | [standalone]


#10375

FromTim Streater <timstreater@greenbee.net>
Date2013-08-04 09:23 +0100
Message-ID<timstreater-5A86DD.09233604082013@news.individual.net>
In reply to#10373
In article <5d478759-277d-41b1-bdab-f6e1b2076093@googlegroups.com>,
 Lightee <lightaiyee@gmail.com> wrote:

> Would the web application developers here recommend some Visual-basic like 
> GUI designer for HTML?

No.

> I find it rather tedious to design web forms in HTML 
> code manually. Is there a good tool for this job?

No.

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]


#10377

FromThe Natural Philosopher <tnp@invalid.invalid>
Date2013-08-04 13:10 +0100
Message-ID<ktlgca$6dd$2@news.albasani.net>
In reply to#10375
On 04/08/13 09:23, Tim Streater wrote:
> In article <5d478759-277d-41b1-bdab-f6e1b2076093@googlegroups.com>,
> Lightee <lightaiyee@gmail.com> wrote:
>
>> Would the web application developers here recommend some Visual-basic 
>> like GUI designer for HTML?
>
> No.
>
>> I find it rather tedious to design web forms in HTML code manually. 
>> Is there a good tool for this job?
>
> No.
>
I ended up writing my own libraries.

functions which, given a bunch of parameters set up an form element 
onscreen.

-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]


#10422

Frombill <william@TechServSys.com>
Date2013-08-06 09:33 -0400
Message-ID<ktqtvf$vme$1@speranza.aioe.org>
In reply to#10375
On 8/4/2013 4:23 AM, Tim Streater wrote:
>
>> Would the web application developers here recommend some
>> Visual-basic like GUI designer for HTML?
>
> No.
>
>> I find it rather tedious to design web forms in HTML code
>> manually. Is there a good tool for this job?
>
> No.
>
> --
> Tim

Hey Tim,
Could you be a little less verbose ? :-)

bill

[toc] | [prev] | [next] | [standalone]


#10423

FromTim Streater <timstreater@greenbee.net>
Date2013-08-06 15:56 +0100
Message-ID<timstreater-804C09.15563506082013@news.individual.net>
In reply to#10422
In article <ktqtvf$vme$1@speranza.aioe.org>,
 bill <william@TechServSys.com> wrote:

> On 8/4/2013 4:23 AM, Tim Streater wrote:
> >
> >> Would the web application developers here recommend some
> >> Visual-basic like GUI designer for HTML?
> >
> > No.
> >
> >> I find it rather tedious to design web forms in HTML code
> >> manually. Is there a good tool for this job?
> >
> > No.
> >
> > --
> > Tim
> 
> Hey Tim,
> Could you be a little less verbose ? :-)

I'll try and keep my VD in order in future, sorry.

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]


#10380

FromJerry Stuckle <jstucklex@attglobal.net>
Date2013-08-04 09:48 -0400
Message-ID<ktllms$nqn$2@dont-email.me>
In reply to#10373
On 8/4/2013 2:32 AM, Lightee wrote:
> Would the web application developers here recommend some Visual-basic like GUI designer for HTML? I find it rather tedious to design web forms in HTML code manually. Is there a good tool for this job?
>
> Thank you.
>

Why are you asking about html designers in a PHP newsgroup?

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]


#10385

FromTwayne <nobody@spamcop.net>
Date2013-08-04 12:22 -0400
Message-ID<ktlv4s$isl$1@speranza.aioe.org>
In reply to#10380
On 2013-08-04 9:48 AM, Jerry Stuckle wrote:
> On 8/4/2013 2:32 AM, Lightee wrote:
>> Would the web application developers here recommend some Visual-basic
>> like GUI designer for HTML? I find it rather tedious to design web
>> forms in HTML code manually. Is there a good tool for this job?
>>
>> Thank you.
>>
>
> Why are you asking about html designers in a PHP newsgroup?
>

Duhhh, probably because HTML has a large place within PHP?

[toc] | [prev] | [next] | [standalone]


#10386

FromTim Streater <timstreater@greenbee.net>
Date2013-08-04 17:33 +0100
Message-ID<timstreater-207D32.17333704082013@news.individual.net>
In reply to#10385
In article <ktlv4s$isl$1@speranza.aioe.org>,
 Twayne <nobody@spamcop.net> wrote:

> On 2013-08-04 9:48 AM, Jerry Stuckle wrote:
> > On 8/4/2013 2:32 AM, Lightee wrote:
> >> Would the web application developers here recommend some Visual-basic
> >> like GUI designer for HTML? I find it rather tedious to design web
> >> forms in HTML code manually. Is there a good tool for this job?

> > Why are you asking about html designers in a PHP newsgroup?

> Duhhh, probably because HTML has a large place within PHP?

It's still not a PHP question, O soppy one.

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]


#10408

FromJerry Stuckle <jstucklex@attglobal.net>
Date2013-08-04 22:11 -0400
Message-ID<ktn181$srp$4@dont-email.me>
In reply to#10385
On 8/4/2013 12:22 PM, Twayne wrote:
> On 2013-08-04 9:48 AM, Jerry Stuckle wrote:
>> On 8/4/2013 2:32 AM, Lightee wrote:
>>> Would the web application developers here recommend some Visual-basic
>>> like GUI designer for HTML? I find it rather tedious to design web
>>> forms in HTML code manually. Is there a good tool for this job?
>>>
>>> Thank you.
>>>
>>
>> Why are you asking about html designers in a PHP newsgroup?
>>
>
> Duhhh, probably because HTML has a large place within PHP?
>
>

Then why have HTML newsgroups?  For that matter, PHP runs under Apache. 
  Why not ask Apache questions here then?  And they both require Linux 
or Windows - so I guess Linux and Windows questions are on topic, also.

But then we know you're trolling again.  That's all you're good for.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]


#10387

FromTwayne <nobody@spamcop.net>
Date2013-08-04 12:40 -0400
Message-ID<ktm06a$m8p$2@speranza.aioe.org>
In reply to#10373
On 2013-08-04 2:32 AM, Lightee wrote:
> Would the web application developers here recommend some Visual-basic like GUI designer for HTML?

  I find it rather tedious to design web forms in HTML code manually. Is 
there a good tool for this job?
>
> Thank you.
>

Yes, there are a few decent WYSIWYG editors and some text editors too, 
which display text in various colors to differentiat various things.

In the "old" days I used NVU to make websites; quite capable, free, and 
functional.
http://net2.com/nvu/

Netobjects Fusion 12 or later is an excellent wysiwyg web site 
generator. It include a LOT of features, is not free, and is fully 
capable of handling fairly large web site (couple hundred pages). 
Auto-menues, galleries, pretty much all you could want, and works with 
many 3rd party apps.
    Ive written a total of 4 sites, 8 over the years, with it.
    As I mentioned, it's a "Generator" of code, allows for PHP et al, 
and is database formatted, though you don't need to use that to enjoy 
its uses.
See:
http://netobjects.com/

Then there are text editors like Notepad++ and NoteTAB Pro, both 
excellent text editors.
    NoteTab comes with libraries for a lot of apps, and lets you create 
your own should you want to, with ease.  NotePad++ is probably a little 
better IMO at text coloring but NoteTab is more intuitive, predictive 
and handy when all of its features are considered.
    Either would make a good editor. And both allow you to send files to 
your local server if you have one setup.

Is that anywhere near what you were asking?

I can't comment of vb code or vb.net but vb.net is VERY capable but I 
couldn't afford the subscriptions and eventually opted for Fusion 12. I 
have'nt looked at Fusion 13 yet but its main claim to fame seems to be 
writing HTML 5 code. As I always do I'll wait for another rev to come 
out so the initial bugs get fixed before I contemplate purchasing it.

HTH,

Twayne`

[toc] | [prev] | [next] | [standalone]


#10410

FromJerry Stuckle <jstucklex@attglobal.net>
Date2013-08-05 08:14 -0400
Message-ID<kto4jg$kgq$1@dont-email.me>
In reply to#10387
On 8/4/2013 12:40 PM, Twayne wrote:
> On 2013-08-04 2:32 AM, Lightee wrote:
>> Would the web application developers here recommend some Visual-basic
>> like GUI designer for HTML?
>
>   I find it rather tedious to design web forms in HTML code manually. Is
> there a good tool for this job?
>>
>> Thank you.
>>
>
> Yes, there are a few decent WYSIWYG editors and some text editors too,
> which display text in various colors to differentiat various things.
>
> In the "old" days I used NVU to make websites; quite capable, free, and
> functional.
> http://net2.com/nvu/
>
> Netobjects Fusion 12 or later is an excellent wysiwyg web site
> generator. It include a LOT of features, is not free, and is fully
> capable of handling fairly large web site (couple hundred pages).
> Auto-menues, galleries, pretty much all you could want, and works with
> many 3rd party apps.
>     Ive written a total of 4 sites, 8 over the years, with it.
>     As I mentioned, it's a "Generator" of code, allows for PHP et al,
> and is database formatted, though you don't need to use that to enjoy
> its uses.
> See:
> http://netobjects.com/
>
> Then there are text editors like Notepad++ and NoteTAB Pro, both
> excellent text editors.
>     NoteTab comes with libraries for a lot of apps, and lets you create
> your own should you want to, with ease.  NotePad++ is probably a little
> better IMO at text coloring but NoteTab is more intuitive, predictive
> and handy when all of its features are considered.
>     Either would make a good editor. And both allow you to send files to
> your local server if you have one setup.
>
> Is that anywhere near what you were asking?
>
> I can't comment of vb code or vb.net but vb.net is VERY capable but I
> couldn't afford the subscriptions and eventually opted for Fusion 12. I
> have'nt looked at Fusion 13 yet but its main claim to fame seems to be
> writing HTML 5 code. As I always do I'll wait for another rev to come
> out so the initial bugs get fixed before I contemplate purchasing it.
>
> HTH,
>
> Twayne`
>

This reply is exactly why I recommended asking in an HTML newsgroup - 
where he'll get answers from people who KNOW what they're talking about.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]


#10388 — PS Re: GUI designer in html

FromTwayne <nobody@spamcop.net>
Date2013-08-04 12:47 -0400
SubjectPS Re: GUI designer in html
Message-ID<ktm0jc$nf7$1@speranza.aioe.org>
In reply to#10373
On 2013-08-04 2:32 AM, Lightee wrote:

I feel it's necessary to let you know that HTML forms are notoriously 
famous for being hacked, cracked and used by miscreants for spamming 
using your forms.

The best way to alleviate those exposures is to learn PHP coding, IMO. 
You may write your first page in HTML, and then use a second PHP page to 
do all the testing of input data on the server-side where no one can see 
it working nor can they easily get past a rotund random code and 
sanitization and validation codes.

php.net and w3schools both have excellent tutorials for learning PHP. 
It's similar to but different from C++ language, but it provides a lot 
of protection when used correctly.

Also IMO, avoid Captcha code at all costs!  Duplicate it yourself, or 
parts of it, like the protection, but don't use their idiotic, hard to 
read code images; they keep out as many people as they do robots. 
Captcha code however is a pretty decent learning code; just don't use 
it<GRIN>.

Regards,

Twayne`

[toc] | [prev] | [next] | [standalone]


#10390 — Re: PS Re: GUI designer in html

From"J.O. Aho" <user@example.net>
Date2013-08-04 19:09 +0200
SubjectRe: PS Re: GUI designer in html
Message-ID<b67g6gFu7vhU1@mid.individual.net>
In reply to#10388
On 04/08/13 18:47, Twayne wrote:
> On 2013-08-04 2:32 AM, Lightee wrote:
>
> I feel it's necessary to let you know that HTML forms are notoriously
> famous for being hacked, cracked and used by miscreants for spamming
> using your forms.

It's not the HTML forms, but the scripts which are to handle the input 
which do not validate the content properly, no HTML WYSIWYG will make 
the script to validate better, no matter how pretty the form looks like.


> The best way to alleviate those exposures is to learn PHP coding, IMO.
> You may write your first page in HTML, and then use a second PHP page to
> do all the testing of input data on the server-side where no one can see
> it working nor can they easily get past a rotund random code and
> sanitization and validation codes.

Rule one, always validate user input, no matter if it's always your 
mother who does the input, one day she may just try to see what happens 
if she enters "'; drop database youdatabase; #" as input and as you 
never have a backup of the database, you lost everything.


> Also IMO, avoid Captcha code at all costs!  Duplicate it yourself, or
> parts of it, like the protection, but don't use their idiotic, hard to
> read code images; they keep out as many people as they do robots.
> Captcha code however is a pretty decent learning code; just don't use
> it<GRIN>.

I would advice to never write your own captcha or copy those average 
Aarav (kind of Indian Joe), as they usually do include a lot of issues 
with security and validation, if using captcha use something like 
reCaptcha from Google.


-- 

  //Aho

[toc] | [prev] | [next] | [standalone]


#10399 — Re: PS Re: GUI designer in html

FromTwayne <nobody@spamcop.net>
Date2013-08-04 17:01 -0400
SubjectRe: PS Re: GUI designer in html
Message-ID<ktmffj$2a7$1@speranza.aioe.org>
In reply to#10390
On 2013-08-04 1:09 PM, J.O. Aho wrote:
> On 04/08/13 18:47, Twayne wrote:
>> On 2013-08-04 2:32 AM, Lightee wrote:
>>
>> I feel it's necessary to let you know that HTML forms are notoriously
>> famous for being hacked, cracked and used by miscreants for spamming
>> using your forms.
>
> It's not the HTML forms, but the scripts which are to handle the input
> which do not validate the content properly, no HTML WYSIWYG will make
> the script to validate better, no matter how pretty the form looks like.
>
>
>> The best way to alleviate those exposures is to learn PHP coding, IMO.
>> You may write your first page in HTML, and then use a second PHP page to
>> do all the testing of input data on the server-side where no one can see
>> it working nor can they easily get past a rotund random code and
>> sanitization and validation codes.
>
> Rule one, always validate user input, no matter if it's always your
> mother who does the input, one day she may just try to see what happens
> if she enters "'; drop database youdatabase; #" as input and as you
> never have a backup of the database, you lost everything.

Right on!  ALL user input, even including things like Radio Buttons and 
drop-down Lists should be sanitized and closely scrutinized for any type 
of code injection, injected scriptings, all sorts of things.
    Also keep in mind that there IS NO such thing as a perfectly 100% 
secure website and/or webform in particular.
     If one is determined enough and has the proper tools, they WILL 
hack the site and its forms! All one can hope to accomplish is to make 
it too slow, or too much trouble, to use any methods at all. And another 
reason to not copy a captcha script is that tools to crack them are easy 
for the bass turds of the world to find and use. All one can do is to 
make it hopefully out of reach of their tools and methods to bother with 
any particular site. It's a trade-off on how locked you want things to 
be and how much interference your visitors are ready to put up with 
because sometimes the users rebel at too many hoops. It's best of course 
if they never see or suspect why things are, but will still not object 
to what strategies that are not going to seriously make them feel like 
idiots or bots themselves.
    Another strategy  is to allow only so many mistakes in submitting or 
filling out a form and, depending on what you're monitoring, ban further 
input from their IP or Proxy for an hour, 24 hours, whatever you wish. 
Personally my forms will allow two error-prone attempts and on the 3rd, 
remove their access permanently.  .htaccess is one ticket to doing that.

>
>> Also IMO, avoid Captcha code at all costs!  Duplicate it yourself, or
>> parts of it, like the protection, but don't use their idiotic, hard to
>> read code images; they keep out as many people as they do robots.
>> Captcha code however is a pretty decent learning code; just don't use
>> it<GRIN>.
>
> I would advice to never write your own captcha or copy those average
> Aarav (kind of Indian Joe), as they usually do include a lot of issues
> with security and validation, if using captcha use something like
> reCaptcha from Google.

Personally I'd avoid using Captcha of any sort although you're right, 
reCaptcha is a gentler, kinder captcha for most users. But to get one 
introduced to a lot of the possibilities of site security, it's a free, 
common thing to study, including some articles about the scripts 
available to hack Captcha et al. But that's another book. Better to try 
and learn from those who have been there before you, and help you to 
understand more and more about Security all the time.
    I was in error by using the word "copy" there. I didn't mean to copy 
pieces of the captcha code, but to copy and hopefully improve on the 
methods used in the scripts. It makes for a good starting point, is 
free, and introduces one to the myriad possibilities of PHP.
    I do of course agree that HTML simply cannot be made XSS or 
injection protected. PHP on the other hand offers many great ways to 
achieve those goals.

>
>

Decent post, J; I'd have liked to include a LOT more about sanitizing, 
validation techniques et al, but that would be like writing a book 
which, strangely enough, has already been covered off on some reputable 
websites for PHP and even some pretty decent tuts.
    Valid, reliable links are always a good way to avoid re-writing 
books or parts of them and there are a few great sites out there for 
that purpose.  I usually recommend php.net, w3schools, Tizag and NAS as 
great starting points but there are others. Just be sure to research any 
site you choose before going there: Some of them are pretty ignorant or 
even malware-passing pieces of junk! Always check a site's reputation 
before using them or even accessing them, if possible.
     IMO W3schools is easier to understand, wastes less screen 
real-estate, and in general is as knowledgeable as any about PHP and its 
features and functions.

Regards,

Twayne`


[toc] | [prev] | [next] | [standalone]


#10400 — Re: PS Re: GUI designer in html

FromThe Natural Philosopher <tnp@invalid.invalid>
Date2013-08-04 22:23 +0100
SubjectRe: PS Re: GUI designer in html
Message-ID<ktmgo3$ben$1@news.albasani.net>
In reply to#10390
On 04/08/13 18:09, J.O. Aho wrote:
> On 04/08/13 18:47, Twayne wrote:
>> On 2013-08-04 2:32 AM, Lightee wrote:
>>
>> I feel it's necessary to let you know that HTML forms are notoriously
>> famous for being hacked, cracked and used by miscreants for spamming
>> using your forms.
>
> It's not the HTML forms, but the scripts which are to handle the input 
> which do not validate the content properly, no HTML WYSIWYG will make 
> the script to validate better, no matter how pretty the form looks like.
>
>
>> The best way to alleviate those exposures is to learn PHP coding, IMO.
>> You may write your first page in HTML, and then use a second PHP page to
>> do all the testing of input data on the server-side where no one can see
>> it working nor can they easily get past a rotund random code and
>> sanitization and validation codes.
>
> Rule one, always validate user input, no matter if it's always your 
> mother who does the input, one day she may just try to see what 
> happens if she enters "'; drop database youdatabase; #" as input and 
> as you never have a backup of the database, you lost everything.
>
>
well if you use addslashes or convert that string to a hexadecimal, it 
will end up like that in the database.

Probably converting to hex is the simplest conceptually.

function sanitize_for_sql($user_garbage)
{
return ("0x".hex($user_garbage));
}

Then
mysqli_query($link, "update mytable set mystring = 
".sanitize_for_sql($user_garbage)." where id = "int($id));
should be safe

>> Also IMO, avoid Captcha code at all costs!  Duplicate it yourself, or
>> parts of it, like the protection, but don't use their idiotic, hard to
>> read code images; they keep out as many people as they do robots.
>> Captcha code however is a pretty decent learning code; just don't use
>> it<GRIN>.
>
> I would advice to never write your own captcha or copy those average 
> Aarav (kind of Indian Joe), as they usually do include a lot of issues 
> with security and validation, if using captcha use something like 
> reCaptcha from Google.
>
>



-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]


#10404 — Re: PS Re: GUI designer in html

FromNorman Peelman <npeelman@cfl.rr.com>
Date2013-08-04 20:59 -0400
SubjectRe: PS Re: GUI designer in html
Message-ID<ktmt1e$bq1$1@dont-email.me>
In reply to#10390
On 08/04/2013 01:09 PM, J.O. Aho wrote:
> On 04/08/13 18:47, Twayne wrote:
>> On 2013-08-04 2:32 AM, Lightee wrote:
>>
>> I feel it's necessary to let you know that HTML forms are notoriously
>> famous for being hacked, cracked and used by miscreants for spamming
>> using your forms.
>
> It's not the HTML forms, but the scripts which are to handle the input
> which do not validate the content properly, no HTML WYSIWYG will make
> the script to validate better, no matter how pretty the form looks like.
>
>
>> The best way to alleviate those exposures is to learn PHP coding, IMO.
>> You may write your first page in HTML, and then use a second PHP page to
>> do all the testing of input data on the server-side where no one can see
>> it working nor can they easily get past a rotund random code and
>> sanitization and validation codes.
>
> Rule one, always validate user input, no matter if it's always your
> mother who does the input, one day she may just try to see what happens
> if she enters "'; drop database youdatabase; #" as input and as you
> never have a backup of the database, you lost everything.
>
>

   That's only if you go out of your way to enable multiple statements 
by using 'mysqli_multi_query()', which doesn't support prepared 
statements. By default mysqli_query() and mysqli_real_query() do not 
allow multiple queries separated by semi-colons.

http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php


-- 
Norman
Registered Linux user #461062
-Have you been to www.php.net yet?-

[toc] | [prev] | [next] | [standalone]


#10409 — Re: PS Re: GUI designer in html

From"J.O. Aho" <user@example.net>
Date2013-08-05 06:41 +0200
SubjectRe: PS Re: GUI designer in html
Message-ID<b68oniF7p87U1@mid.individual.net>
In reply to#10404
On 05/08/13 02:59, Norman Peelman wrote:
> On 08/04/2013 01:09 PM, J.O. Aho wrote:

>> Rule one, always validate user input, no matter if it's always your
>> mother who does the input, one day she may just try to see what happens
>> if she enters "'; drop database youdatabase; #" as input and as you
>> never have a backup of the database, you lost everything.
>>
>>
>
>    That's only if you go out of your way to enable multiple statements
> by using 'mysqli_multi_query()', which doesn't support prepared
> statements. By default mysqli_query() and mysqli_real_query() do not
> allow multiple queries separated by semi-colons.
>
> http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php

Unless something changed, mysqli_query supports multiple statements, but 
the return value do not support to give you the result from all the 
queries, I think it returned the last one.

-- 

  //Aho

[toc] | [prev] | [next] | [standalone]


#10414 — Re: PS Re: GUI designer in html

FromTwayne <nobody@spamcop.net>
Date2013-08-05 10:57 -0400
SubjectRe: PS Re: GUI designer in html
Message-ID<ktoeg0$ntb$1@speranza.aioe.org>
In reply to#10409
On 2013-08-05 12:41 AM, J.O. Aho wrote:
> On 05/08/13 02:59, Norman Peelman wrote:
>> On 08/04/2013 01:09 PM, J.O. Aho wrote:
>

...

>>
>>    That's only if you go out of your way to enable multiple statements
>> by using 'mysqli_multi_query()', which doesn't support prepared
>> statements. By default mysqli_query() and mysqli_real_query() do not
>> allow multiple queries separated by semi-colons.
>>
>> http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php
>
> Unless something changed, mysqli_query supports multiple statements, but
> the return value do not support to give you the result from all the
> queries, I think it returned the last one.
>

Quite correct and as the manual states;
"
MySQL optionally allows having multiple statements in one statement 
string. Sending multiple statements at once reduces client-server round 
trips but requires special handling.

Multiple statements or multi queries must be executed with 
mysqli_multi_query(). The individual statements of the statement string 
are separated by semicolon. Then, all result sets returned by the 
executed statements must be fetched.

The MySQL server allows having statements that do return result sets and 
statements that do not return result sets in one multiple statement.
"



[toc] | [prev] | [next] | [standalone]


#10417 — Re: PS Re: GUI designer in html

FromNorman Peelman <npeelman@cfl.rr.com>
Date2013-08-05 18:55 -0400
SubjectRe: PS Re: GUI designer in html
Message-ID<ktpa4s$f3v$1@dont-email.me>
In reply to#10414
On 08/05/2013 10:57 AM, Twayne wrote:
> On 2013-08-05 12:41 AM, J.O. Aho wrote:
>> On 05/08/13 02:59, Norman Peelman wrote:
>>> On 08/04/2013 01:09 PM, J.O. Aho wrote:
>>
>
> ....
>
>>>
>>>    That's only if you go out of your way to enable multiple statements
>>> by using 'mysqli_multi_query()', which doesn't support prepared
>>> statements. By default mysqli_query() and mysqli_real_query() do not
>>> allow multiple queries separated by semi-colons.
>>>
>>> http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php
>>
>> Unless something changed, mysqli_query supports multiple statements, but
>> the return value do not support to give you the result from all the
>> queries, I think it returned the last one.
>>
>
> Quite correct and as the manual states;

No.

> "
> MySQL optionally allows having multiple statements in one statement
> string. Sending multiple statements at once reduces client-server round
> trips but requires special handling.
>
> Multiple statements or multi queries must be executed with
> mysqli_multi_query(). The individual statements of the statement string
> are separated by semicolon. Then, all result sets returned by the
> executed statements must be fetched.
>
> The MySQL server allows having statements that do return result sets and
> statements that do not return result sets in one multiple statement.
> "
>

   You need to scroll down to the middle of the page and read
*Security considerations* and *Example #2*.


-- 
Norman
Registered Linux user #461062
-Have you been to www.php.net yet?-

[toc] | [prev] | [next] | [standalone]


Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.lang.php


csiph-web