Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10373 > unrolled thread

GUI designer in html

Back to article view | Back to comp.lang.php

Contents

  GUI designer in html Lightee <lightaiyee@gmail.com> - 2013-08-03 23:32 -0700
    Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-04 09:17 +0200
    Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-04 09:23 +0100
      Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-04 13:10 +0100
      Re: GUI designer in html bill <william@TechServSys.com> - 2013-08-06 09:33 -0400
        Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-06 15:56 +0100
    Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-04 09:48 -0400
      Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:22 -0400
        Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-04 17:33 +0100
        Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-04 22:11 -0400
    Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:40 -0400
      Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 08:14 -0400
    PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:47 -0400
      Re: PS Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-04 19:09 +0200
        Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 17:01 -0400
        Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-04 22:23 +0100
        Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-04 20:59 -0400
          Re: PS Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-05 06:41 +0200
            Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-05 10:57 -0400
              Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-05 18:55 -0400
                Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-06 00:32 +0100
                  Re: PS Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 19:59 -0400
                  Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-07 12:51 -0400
                    Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-07 18:52 +0100
          Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-05 10:51 -0400
            Re: PS Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 20:00 -0400
            Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-05 21:35 -0400
              Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-07 12:55 -0400

Page 2 of 2 — ← Prev page 1 [2]

#10418 — Re: PS Re: GUI designer in html

On 05/08/13 23:55, Norman Peelman wrote:
> On 08/05/2013 10:57 AM, Twayne wrote:
>> On 2013-08-05 12:41 AM, J.O. Aho wrote:
>>> On 05/08/13 02:59, Norman Peelman wrote:
>>>> On 08/04/2013 01:09 PM, J.O. Aho wrote:
>>>
>>
>> ....
>>
>>>>
>>>>    That's only if you go out of your way to enable multiple statements
>>>> by using 'mysqli_multi_query()', which doesn't support prepared
>>>> statements. By default mysqli_query() and mysqli_real_query() do not
>>>> allow multiple queries separated by semi-colons.
>>>>
>>>> http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php
>>>
>>> Unless something changed, mysqli_query supports multiple statements, 
>>> but
>>> the return value do not support to give you the result from all the
>>> queries, I think it returned the last one.
>>>
>>
>> Quite correct and as the manual states;
>
> No.
>
>> "
>> MySQL optionally allows having multiple statements in one statement
>> string. Sending multiple statements at once reduces client-server round
>> trips but requires special handling.
>>
>> Multiple statements or multi queries must be executed with
>> mysqli_multi_query(). The individual statements of the statement string
>> are separated by semicolon. Then, all result sets returned by the
>> executed statements must be fetched.
>>
>> The MySQL server allows having statements that do return result sets and
>> statements that do not return result sets in one multiple statement.
>> "
>>
>
>   You need to scroll down to the middle of the page and read
> *Security considerations* and *Example #2*.
>
>
Furthermore the manual for mysql_query (as opposed to mysqli_query) 
actually states:

"*mysql_query()* sends a unique query *(multiple queries are not 
supported)* to the currently active database on the server that's 
associated with the specified /|link_identifier|/. "

so it would seem that this actual sql injection method is an urban myth.

 From PHP anyway.

ISTR I actually tried it once to see if my code was robust. I failed to 
destroy the database or indeed any data,  at all.

-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#10419 — Re: PS Re: GUI designer in html

On 8/5/2013 7:32 PM, The Natural Philosopher wrote:
> On 05/08/13 23:55, Norman Peelman wrote:
>> On 08/05/2013 10:57 AM, Twayne wrote:
>>> On 2013-08-05 12:41 AM, J.O. Aho wrote:
>>>> On 05/08/13 02:59, Norman Peelman wrote:
>>>>> On 08/04/2013 01:09 PM, J.O. Aho wrote:
>>>>
>>>
>>> ....
>>>
>>>>>
>>>>>    That's only if you go out of your way to enable multiple statements
>>>>> by using 'mysqli_multi_query()', which doesn't support prepared
>>>>> statements. By default mysqli_query() and mysqli_real_query() do not
>>>>> allow multiple queries separated by semi-colons.
>>>>>
>>>>> http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php
>>>>
>>>> Unless something changed, mysqli_query supports multiple statements,
>>>> but
>>>> the return value do not support to give you the result from all the
>>>> queries, I think it returned the last one.
>>>>
>>>
>>> Quite correct and as the manual states;
>>
>> No.
>>
>>> "
>>> MySQL optionally allows having multiple statements in one statement
>>> string. Sending multiple statements at once reduces client-server round
>>> trips but requires special handling.
>>>
>>> Multiple statements or multi queries must be executed with
>>> mysqli_multi_query(). The individual statements of the statement string
>>> are separated by semicolon. Then, all result sets returned by the
>>> executed statements must be fetched.
>>>
>>> The MySQL server allows having statements that do return result sets and
>>> statements that do not return result sets in one multiple statement.
>>> "
>>>
>>
>>   You need to scroll down to the middle of the page and read
>> *Security considerations* and *Example #2*.
>>
>>
> Furthermore the manual for mysql_query (as opposed to mysqli_query)
> actually states:
>
> "*mysql_query()* sends a unique query *(multiple queries are not
> supported)* to the currently active database on the server that's
> associated with the specified /|link_identifier|/. "
>
> so it would seem that this actual sql injection method is an urban myth.
>
>  From PHP anyway.
>
> ISTR I actually tried it once to see if my code was robust. I failed to
> destroy the database or indeed any data,  at all.
>

Incorrect (as usual).

It only means you can't run multiple SQL statements.  But that is only 
ONE method of SQL injection; it is quite possible to screw up a database 
in a single SQL statement.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10432 — Re: PS Re: GUI designer in html

On 2013-08-05 7:32 PM, The Natural Philosopher wrote:
...

>>>
>>> The MySQL server allows having statements that do return result sets and
>>> statements that do not return result sets in one multiple statement.
>>> "
>>>
>>
>>   You need to scroll down to the middle of the page and read
>> *Security considerations* and *Example #2*.
>>
>>
> Furthermore the manual for mysql_query (as opposed to mysqli_query)
> actually states:
>
> "*mysql_query()* sends a unique query *(multiple queries are not
> supported)* to the currently active database on the server that's
> associated with the specified /|link_identifier|/. "

Yes, that's true. As a relative newcomer to PHP and the fact that MYSQL 
is being deprecated, as long as mysqli is available on my servers;
  wouldn't it be wise to go in the mysqlI direction?

    I've no intention of making multiple queries currently but ... I 
haven't used "i" yet either so I'm far from guru; I can only go by what 
I read and the MYSQL reference to mysqli for multiple queries, should 
the occasion arise. In fact, I've only ever experimented with MYSQL 
itself; though I am using it on one of my own sites.

    To me, it simply seems like the right way to go. Do you disagree 
with that?


> so it would seem that this actual sql injection method is an urban myth.

Well, I've seen  a few exploits and how they're done, and I've used one 
of them, and I did successfully trash my database. So, not so sure 
that's 100% the case; perhaps it's just you're good at writing 
sanitize/validate code?

>
>  From PHP anyway.
>
> ISTR I actually tried it once to see if my code was robust. I failed to
> destroy the database or indeed any data,  at all.
>

Interesting observations/experiment; thanks for the info. Don't you 
think it's actually due to your own code?  Just curious, mostly.

Good post,

Twayne`

[toc] | [prev] | [next] | [standalone]

#10434 — Re: PS Re: GUI designer in html

On 07/08/13 17:51, Twayne wrote:
> On 2013-08-05 7:32 PM, The Natural Philosopher wrote:
> ...
>
>>>>
>>>> The MySQL server allows having statements that do return result 
>>>> sets and
>>>> statements that do not return result sets in one multiple statement.
>>>> "
>>>>
>>>
>>>   You need to scroll down to the middle of the page and read
>>> *Security considerations* and *Example #2*.
>>>
>>>
>> Furthermore the manual for mysql_query (as opposed to mysqli_query)
>> actually states:
>>
>> "*mysql_query()* sends a unique query *(multiple queries are not
>> supported)* to the currently active database on the server that's
>> associated with the specified /|link_identifier|/. "
>
> Yes, that's true. As a relative newcomer to PHP and the fact that 
> MYSQL is being deprecated, as long as mysqli is available on my servers;
>  wouldn't it be wise to go in the mysqlI direction?
>
>    I've no intention of making multiple queries currently but ... I 
> haven't used "i" yet either so I'm far from guru; I can only go by 
> what I read and the MYSQL reference to mysqli for multiple queries, 
> should the occasion arise. In fact, I've only ever experimented with 
> MYSQL itself; though I am using it on one of my own sites.
>
>    To me, it simply seems like the right way to go. Do you disagree 
> with that?
>
>
>> so it would seem that this actual sql injection method is an urban myth.
>
> Well, I've seen  a few exploits and how they're done, and I've used 
> one of them, and I did successfully trash my database. So, not so sure 
> that's 100% the case; perhaps it's just you're good at writing 
> sanitize/validate code?
>
>>
>>  From PHP anyway.
>>
>> ISTR I actually tried it once to see if my code was robust. I failed to
>> destroy the database or indeed any data,  at all.
>>
>
> Interesting observations/experiment; thanks for the info. Don't you 
> think it's actually due to your own code?  Just curious, mostly.
>

I really don't know.  I tried everything I could think of.

I suppose defensive coding is a habit you get into when writing code, as 
are copious comments and the use of 'highest common factor' language 
constructs, in case the poor sod who has to maintain it after you are 
gone doesn't actually understand regexp or WHY. I know I never have :[-)

Its always taken less time to do it another way, than really learn the 
syntax.


> Good post,
>
> Twayne`
>
>


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#10413 — Re: PS Re: GUI designer in html

On 2013-08-04 8:59 PM, Norman Peelman wrote:
> On 08/04/2013 01:09 PM, J.O. Aho wrote:
>> On 04/08/13 18:47, Twayne wrote:
>>> On 2013-08-04 2:32 AM, Lightee wrote:
>>>
\...

>
>    That's only if you go out of your way to enable multiple statements
> by using 'mysqli_multi_query()', which doesn't support prepared
> statements. By default mysqli_query() and mysqli_real_query() do not
> allow multiple queries separated by semi-colons.
>
> http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php
>
>

I have to wonder just how much you really know about PHP. Rather than 
point out a solution your only posts seem more like a criticism of any 
information; in fact, that's ALL you point out.

  Why not try to help posters by sharing information rather than be 
picky about something that hasn't even been mentioned yet.

[toc] | [prev] | [next] | [standalone]

#10420 — Re: PS Re: GUI designer in html

On 8/5/2013 10:51 AM, Twayne wrote:
> On 2013-08-04 8:59 PM, Norman Peelman wrote:
>> On 08/04/2013 01:09 PM, J.O. Aho wrote:
>>> On 04/08/13 18:47, Twayne wrote:
>>>> On 2013-08-04 2:32 AM, Lightee wrote:
>>>>
> \...
>
>>
>>    That's only if you go out of your way to enable multiple statements
>> by using 'mysqli_multi_query()', which doesn't support prepared
>> statements. By default mysqli_query() and mysqli_real_query() do not
>> allow multiple queries separated by semi-colons.
>>
>> http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php
>>
>>
>
> I have to wonder just how much you really know about PHP. Rather than
> point out a solution your only posts seem more like a criticism of any
> information; in fact, that's ALL you point out.
>
>   Why not try to help posters by sharing information rather than be
> picky about something that hasn't even been mentioned yet.
>
>

He knows a lot more about PHP than you do.  That is very obvious.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10421 — Re: PS Re: GUI designer in html

On 08/05/2013 10:51 AM, Twayne wrote:
> On 2013-08-04 8:59 PM, Norman Peelman wrote:
>> On 08/04/2013 01:09 PM, J.O. Aho wrote:
>>> On 04/08/13 18:47, Twayne wrote:
>>>> On 2013-08-04 2:32 AM, Lightee wrote:
>>>>
> \...
>
>>
>>    That's only if you go out of your way to enable multiple statements
>> by using 'mysqli_multi_query()', which doesn't support prepared
>> statements. By default mysqli_query() and mysqli_real_query() do not
>> allow multiple queries separated by semi-colons.
>>
>> http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php
>>
>>
>
> I have to wonder just how much you really know about PHP. Rather than
> point out a solution your only posts seem more like a criticism of any
> information; in fact, that's ALL you point out.
>
>   Why not try to help posters by sharing information rather than be
> picky about something that hasn't even been mentioned yet.
>
>

   I simply make note that *mysqli_multi_query()* is used to make 
multiple queries in one call, *mysqli_query* and *mysqli_real_query()* 
are not. I also note that *mysqli_multi_query()* with *prepared 
statements* is not supported. In other words, you can't have them both. 
I mentioned this because J.O. Aho brought up SQL injection...

-- 
Norman
Registered Linux user #461062
-Have you been to www.php.net yet?-

[toc] | [prev] | [next] | [standalone]

#10433 — Re: PS Re: GUI designer in html

On 2013-08-05 9:35 PM, Norman Peelman wrote:
> On 08/05/2013 10:51 AM, Twayne wrote:
>> On 2013-08-04 8:59 PM, Norman Peelman wrote:

...

>
>    I simply make note that *mysqli_multi_query()* is used to make
> multiple queries in one call, *mysqli_query* and *mysqli_real_query()*
> are not. I also note that *mysqli_multi_query()* with *prepared
> statements* is not supported. In other words, you can't have them both.
> I mentioned this because J.O. Aho brought up SQL injection...
>

Good points, Norman.

Thanks for the clarification,

Twayne`

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.lang.php

csiph-web