Shoutbux | submit your thoughts » Tutorial – PHP

PHP File Upload

zemog — Thu, 03 Dec 2009 06:00:58 +0000

Create an Upload-File Form

To allow users to upload files from a form can be very useful.

Look at the following HTML form for uploading files:





Filename:

Notice the following about the HTML form above:

* The enctype attribute of the < form > tag specifies which content-type to use when submitting the form. “multipart/form-data” is used when a form requires binary data, like the contents of a file, to be uploaded
* The type=”file” attribute of the < input > tag specifies that the input should be processed as a file. For example, when viewed in a browser, there will be a browse-button next to the input field

Note: Allowing users to upload files is a big security risk. Only permit trusted users to perform file uploads.

Create The Upload Script

The “upload_file.php” file contains the code for uploading a file:

 0)
  {
  echo "Error: " . $_FILES["file"]["error"] . "
";
  }
else
  {
  echo "Upload: " . $_FILES["file"]["name"] . "
";
  echo "Type: " . $_FILES["file"]["type"] . "
";
  echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb
";
  echo "Stored in: " . $_FILES["file"]["tmp_name"];
  }
?>

By using the global PHP $_FILES array you can upload files from a client computer to the remote server.

The first parameter is the form’s input name and the second index can be either “name”, “type”, “size”, “tmp_name” or “error”. Like this:

* $_FILES["file"]["name"] – the name of the uploaded file
* $_FILES["file"]["type"] – the type of the uploaded file
* $_FILES["file"]["size"] – the size in bytes of the uploaded file
* $_FILES["file"]["tmp_name"] – the name of the temporary copy of the file stored on the server
* $_FILES["file"]["error"] – the error code resulting from the file upload

This is a very simple way of uploading files. For security reasons, you should add restrictions on what the user is allowed to upload.

Restrictions on Upload

In this script we add some restrictions to the file upload. The user may only upload .gif or .jpeg files and the file size must be under 20 kb:

 0)
    {
    echo "Error: " . $_FILES["file"]["error"] . "
";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "
";
    echo "Type: " . $_FILES["file"]["type"] . "
";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb
";
    echo "Stored in: " . $_FILES["file"]["tmp_name"];
    }
  }
else
  {
  echo "Invalid file";
  }
?>

Note: For IE to recognize jpg files the type must be pjpeg, for FireFox it must be jpeg.

Saving the Uploaded File

The examples above create a temporary copy of the uploaded files in the PHP temp folder on the server.

The temporary copied files disappears when the script ends. To store the uploaded file we need to copy it to a different location:

 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "
";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "
";
    echo "Type: " . $_FILES["file"]["type"] . "
";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb
";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "
";

    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "upload/" . $_FILES["file"]["name"]);
      echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
      }
    }
  }
else
  {
  echo "Invalid file";
  }
?>

The script above checks if the file already exists, if it does not, it copies the file to the specified folder.

Note: This example saves the file to a new folder called “upload”

Bookmark It

Hide Sites

PHP MySQL Create Database and Tables

zemog — Thu, 03 Dec 2009 02:25:34 +0000

Create a Database

The CREATE DATABASE statement is used to create a database in MySQL.
Syntax

CREATE DATABASE database_name

To learn more about SQL, please visit our SQL tutorial.

To get PHP to execute the statement above we must use the mysql_query() function. This function is used to send a query or command to a MySQL connection.
Example

The following example creates a database called “my_db”:

Create a Table

The CREATE TABLE statement is used to create a table in MySQL.
Syntax

CREATE TABLE table_name
(
column_name1 data_type,
column_name2 data_type,
column_name3 data_type,
....
)

To learn more about SQL, please visit our SQL tutorial.

We must add the CREATE TABLE statement to the mysql_query() function to execute the command.
Example

The following example creates a table named “Persons”, with three columns. The column names will be “FirstName”, “LastName” and “Age”:

Important: A database must be selected before a table can be created. The database is selected with the mysql_select_db() function.

Note: When you create a database field of type varchar, you must specify the maximum length of the field, e.g. varchar(15).

The data type specifies what type of data the column can hold.

Primary Keys and Auto Increment Fields

Each table should have a primary key field.

A primary key is used to uniquely identify the rows in a table. Each primary key value must be unique within the table. Furthermore, the primary key field cannot be null because the database engine requires a value to locate the record.

The following example sets the personID field as the primary key field. The primary key field is often an ID number, and is often used with the AUTO_INCREMENT setting. AUTO_INCREMENT automatically increases the value of the field by 1 each time a new record is added. To ensure that the primary key field cannot be null, we must add the NOT NULL setting to the field.
Example

$sql = "CREATE TABLE Persons
(
personID int NOT NULL AUTO_INCREMENT,
PRIMARY KEY(personID),
FirstName varchar(15),
LastName varchar(15),
Age int
)";

mysql_query($sql,$con);

Bookmark It

Hide Sites

PHP Switch Statement

zemog — Thu, 03 Dec 2009 02:18:33 +0000

The PHP Switch Statement

Use the switch statement to select one of many blocks of code to be executed.
Syntax

switch (n)
{
case label1:
  code to be executed if n=label1;
  break;
case label2:
  code to be executed if n=label2;
  break;
default:
  code to be executed if n is different from both label1 and label2;
}

This is how it works: First we have a single expression n (most often a variable), that is evaluated once. The value of the expression is then compared with the values for each case in the structure. If there is a match, the block of code associated with that case is executed. Use break to prevent the code from running into the next case automatically. The default statement is used if no match is found.
Example

Bookmark It

Hide Sites

PHP Include File

zemog — Thu, 03 Dec 2009 02:15:22 +0000

Server Side Includes (SSI)

You can insert the content of one PHP file into another PHP file before the server executes it, with the include() or require() function.

The two functions are identical in every way, except how they handle errors:

* include() generates a warning, but the script will continue execution
* require() generates a fatal error, and the script will stop

These two functions are used to create functions, headers, footers, or elements that will be reused on multiple pages.

Server side includes saves a lot of work. This means that you can create a standard header, footer, or menu file for all your web pages. When the header needs to be updated, you can only update the include file, or when you add a new page to your site, you can simply change the menu file (instead of updating the links on all your web pages).
PHP include() Function

The include() function takes all the content in a specified file and includes it in the current file.

If an error occurs, the include() function generates a warning, but the script will continue execution.
Example 1

Assume that you have a standard header file, called “header.php”. To include the header file in a page, use the include() function:

Welcome to my home page!

Some text.

Example 2

Assume we have a standard menu file, called “menu.php”, that should be used on all pages:

Home
 Tutorials
 References
 Examples
 About Us
 Contact Us

All pages in the Web site should include this menu file. Here is how it can be done:

Welcome to my home page.

Some text.

If you look at the source code of the page above (in a browser), it will look like this:

Home Tutorials References Examples About Us Contact Us

Welcome to my home page!

Some text.

PHP require() Function

The require() function is identical to include(), except that it handles errors differently.

If an error occurs, the include() function generates a warning, but the script will continue execution. The require() generates a fatal error, and the script will stop.
Error Example include() Function

Error message:

Warning: include(wrongFile.php) [function.include]:
 failed to open stream:
 No such file or directory in C:\home\website\test.php on line 5

 Warning: include() [function.include]:
 Failed opening 'wrongFile.php' for inclusion
 (include_path='.;C:\php5\pear')
 in C:\home\website\test.php on line 5

 Hello World!

Notice that the echo statement is executed! This is because a Warning does not stop the script execution.
Error Example require() Function

Now, let’s run the same example with the require() function.

Error message:

Warning: require(wrongFile.php) [function.require]:
 failed to open stream:
 No such file or directory in C:\home\website\test.php on line 5

 Fatal error: require() [function.require]:
 Failed opening required 'wrongFile.php'
 (include_path='.;C:\php5\pear')
 in C:\home\website\test.php on line 5

The echo statement is not executed, because the script execution stopped after the fatal error.

It is recommended to use the require() function instead of include(), because scripts should not continue after an error.

Bookmark It

Hide Sites

Connecting to MySQL in PHP

zemog — Wed, 02 Dec 2009 15:43:51 +0000

Create a Connection to a MySQL Database

Before you can access data in a database, you must create a connection to the database.

In PHP, this is done with the mysql_connect() function.
Syntax

mysql_connect(servername,username,password);

Where

servername = Optional. Specifies the server to connect to. Default value is “localhost:3306″
username = Optional. Specifies the username to log in with. Default value is the name of the user that owns the server process
password = Optional. Specifies the password to log in with. Default is “”

Note: There are more available parameters, but the ones listed above are the most important. Visit our full PHP MySQL Reference for more details.
Example

In the following example we store the connection in a variable ($con) for later use in the script. The “die” part will be executed if the connection fails:

Closing a Connection

The connection will be closed automatically when the script ends. To close the connection before, use the mysql_close() function:

Bookmark It

Hide Sites

PHP IF… Else Statement

zemog — Wed, 02 Dec 2009 15:36:10 +0000

Conditional Statements

Very often when you write code, you want to perform different actions for different decisions.

You can use conditional statements in your code to do this.

In PHP we have the following conditional statements:

if statement – use this statement to execute some code only if a specified condition is true
if…else statement – use this statement to execute some code if a condition is true and another code if the condition is false
if…elseif….else statement – use this statement to select one of several blocks of code to be executed
switch statement – use this statement to select one of many blocks of code to be executed

The if Statement

Use the if statement to execute some code only if a specified condition is true.

Syntax

if (condition) code to be executed if condition is true;

The following example will output “Have a nice weekend!” if the current day is Friday:

Notice that there is no ..else.. in this syntax. You tell the browser to execute some code only if the specified condition is true.

The if…else Statement

Use the if….else statement to execute some code if a condition is true and another code if a condition is false.

Syntax

if (condition)
 code to be executed if condition is true;
 else
 code to be executed if condition is false;

Example

The following example will output “Have a nice weekend!” if the current day is Friday, otherwise it will output “Have a nice day!”:

If more than one line should be executed if a condition is true/false, the lines should be enclosed within curly braces:


 

 ";
 echo "Have a nice weekend!";
 echo "See you on Monday!";
 }
 ?>

The if…elseif….else Statement

Use the if….elseif…else statement to select one of several blocks of code to be executed.

Syntax

if (condition)
 code to be executed if condition is true;
 elseif (condition)
 code to be executed if condition is true;
 else
 code to be executed if condition is false;

Example

The following example will output “Have a nice weekend!” if the current day is Friday, and “Have a nice Sunday!” if the current day is Sunday. Otherwise it will output “Have a nice day!”:

Bookmark It

Hide Sites

PHP Loops

zemog — Wed, 02 Dec 2009 14:53:34 +0000

The for Loop

The for loop is used when you know in advance how many times the script should run.

Syntax

for (init; condition; increment)
{
code to be executed;
}

Parameters:

* init: Mostly used to set a counter (but can be any code to be executed once at the beginning of the loop)
* condition: Evaluated for each loop iteration. If it evaluates to TRUE, the loop continues. If it evaluates to FALSE, the loop ends.
* increment: Mostly used to increment a counter (but can be any code to be executed at the end of the loop)

Note: Each of the parameters above can be empty, or have multiple expressions (separated by commas).
Example

The example below defines a loop that starts with i=1. The loop will continue to run as long as i is less than, or equal to 5. i will increase by 1 each time the loop runs:




";
  }
?>

The foreach Loop

The foreach loop is used to loop through arrays.

Syntax

foreach ($array as $value)
  {
  code to be executed;
  }

For every loop iteration, the value of the current array element is assigned to $value (and the array pointer is moved by one) – so on the next loop iteration, you’ll be looking at the next array value.
Example

The following example demonstrates a loop that will print the values of the given array:




";
  }
?>

Bookmark It

Hide Sites

PHP Error Handling

zemog — Wed, 02 Dec 2009 14:40:18 +0000

When creating scripts and web applications, error handling is an important part. If your code lacks error checking code, your program may look very unprofessional and you may be open to security risks.

This tutorial will teach you how to use the die function.

Basic Error Handling: Using the die() function

The first example shows a simple script that opens a text file:

If the file does not exist you might get an error like this:

Warning: fopen(welcome.txt) [function.fopen]: failed to open stream:
No such file or directory in C:\webfolder\test.php on line 2

To avoid that the user gets an error message like the one above, we test if the file exist before we try to access it:

Now if the file does not exist you get an error like this:

File not found

The code above is more efficient than the earlier code, because it uses a simple error handling mechanism to stop the script after the error.

However, simply stopping the script is not always the right way to go. Let’s take a look at alternative PHP functions for handling errors.

Bookmark It

Hide Sites

Preventing SQL Injections in Joomla

zemog — Wed, 18 Nov 2009 04:53:00 +0000

Written by Anthony Ferrara

Recently, I’ve been noticing a lot of misconceptions about how to protect code in 3pd extensions from SQL injection. To be honest, using JRequest is not enough by far!!! I hope to cover some thing here about some methods to prevent SQL attacks. It’s not that difficult; there are a few simple things you can do to prevent injection attacks. I’ll go through them one by one, and show some examples of each.
Force the type you want

Basically, if you are expecting an integer, force it to be an integer (or a float). So, if you have a variable that you are expecting to be an integer, cast it to an integer… For example:

$sql = ‘UPDATE #__mytable SET `id` = ‘ . (int) $int;

If you want to insert a date, then use JDate, and it’ll give you back a valid mysql date each time…

$date =& JFactory::getDate($mydate);
$sql = ‘UPDATE #__mytable SET `date` = ‘ . $db->quote( $date->toMySQL(), false);

ALWAYS escape your strings

Well, anytime you take a string from user input (I always escape everything from a variable, it’s extra insurance), you should escape it using:

$sql = ‘UPDATE #__mytable SET `string` = ‘ . $db->quote( $db->getEscaped( $string ), false );

Notice that we’re using 2 functions there. One escapes the string, and the other wraps it in quotes. If you’ve noticed the second parameter for $db->quote() is false… If you leave that out, or set it to true, then it’ll escape it for you. So that string becomes:

$sql = ‘UPDATE #__mytable SET `string` = ‘ . $db->quote( $string );

Prevent DOS attacks

In a where clause, if you use a LIKE command, you can have a DOS vulnerability by not escaping the special wildcard characters % and _. Joomla has a facility to do this for you! $db->getEscaped can take a second parameter which will escape those characters for you. NOTE: You only should escape these for strings used in a LIKE comparison. So:

$sql = ‘UPDATE #__mytable SET …. WHERE `string` LIKE ‘.
$db->quote( $db->getEscaped( $string, true ), false );

Preventing XSS Attacks

Most people just get data using JRequest::getVar()… But there are a whole bunch of other methods that exist which actually force type much better. Here are some those methods:

For Integers:

$int = JRequest::getInt( $name, $default );

For Floats (decimals):

$float = JRequest::getFloat( $name, $default );

For boolean values (true/false):

$bool = JRequest::getBool( $name, $default );

For “words” (only allows alpha characters, and the _ character)

$word = JRequest::getWord( $name, $default );

For “commands” (Allows alpha characters, numeric characters, . – and _ )

$cmd = JRequest::getCMD( $name, $default );

For NON-HTML text (all HTML will be stripped)

$string = JRequest::getString( $name, $default );

Source: http://developer.joomla.org/security/articles-tutorials/258-preventing-sql-injections.html

Bookmark It

Hide Sites

Get live currency using PHP

zemog — Sat, 07 Nov 2009 17:40:20 +0000

Few years ago I made a script that will get a live currency from a certain site and display the information on my page. After a few hours of looking into my old file, I can not find my script so I made a new one. I remember I use the cURL function but I forgot the website I used to get the data (am I too forgetful these day? hmm)

Without any other choice, I have to use my friend Google for some clues. Throwing different search keys such as “currency converter using PHP”, “live currency feed”, “currency feed”, “pesos to usd conversion using php”, etc., I came across with this forum http://forums.whirlpool.net.au/forum-replies-archive.cfm/783963.html in which the last thread says

Could always use Google.

www.google.com.au/search?q=100+aud+in+usd

Yeah, why not use Google’s own conversion!

So here is the code.


if (function_exists('curl_init'))
{
$ch = curl_init();

curl_setopt($ch, CURLOPT_URL,
'http://www.google.com.au/search?hl=en& q=1+usd+in+php&btnG=Search&
meta=&aq=f&oq=');
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT,
'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0');

$content = curl_exec($ch);

curl_close($ch);

$position1 	= strpos($content,"1 U.S. dollar =");
$cleandata 	= substr($content,$position1+15,7);
echo $cleandata;
}
else
{
echo "sorry no cURL here";
}

Let me discuss to you some points

First there is the condition to check whether cURL is available of not. -> if (function_exists(‘curl_init’))
The most interesting part here is the url

http://www.google.com.au/search?hl=en&q=1+usd+in+php&btnG=Search&meta=&aq=f&oq=

How did I get that url? What I did was put the query “1 usd in php” which translate to 1 US dollar to philippine peso. Then the result appears

1 usd to php

Now that Google have displayed the result, all we need to do is read the html file using cURL and using some string manipulations you can easily get what you want. In the example above you should get the value 47.499

Bookmark It

Hide Sites