|
Hi,
I'm working on a security solution that display an image uploaded by the user (if the user has uploaded an image, of course). I recognize the user through a cookie. In order to display the image I use a php script launched as a javascript script because I need to get a javascript variable:
<script type="text/javascript" src="cookie.php?login=document.f_bad.login.value"></script>
Then, in the php script, I retrieve this variable 'login' and use it to get the cookie:
<?php <br mode="hold" /?> Header("content-type: application/x-javascript");
$cook_name = $_GET['login'];
if (isset ($_COOKIE[$cook_name])) {
$file_name = $_COOKIE[$cook_name] ;
echo "document.write(\"<img src="/upload/$file_name" alt="Personal picture" title="Personal picture" name="persPict" border="0" width="100">\");";
echo "document.write('</img>')";
}
else {
echo "document.write(\"<img src="/img/securite.jpg" alt="Personal picture" title="Personal picture" name="persPict" border="0" width="100">\");";
echo "document.write('</img>')";
}
?>
The problem is that I retrieve the right value in 'login' (I tested it with an echo) and I know I can access the cookie (I tried by putting directly $_COOKIE['value']) but it does not work with $_COOKIE[$cook_name].
I really don't understand why. If someone has an idea I would be very grateful.
Thanks
|
|
|
|
|
wheel27 wrote:
Aside from the potential security risk of allowing the user to determine which cookie is used, the login variable is set to 'document.f_bad.login.value', not to 'value'.
|
|
|
|
|
'document.f_bad.login.value' is the variable I need to use. When I used 'value' it was only as an example. It would be the login of the user
|
|
|
|
|
Do not EVER use this code... EVER. There are more security holes in this then there are in a blind security guard with no limbs.
Brad
Australian
The PHP MVP
- Christian Graus on "Best books for VBscript"
A big thick one, so you can whack yourself on the head with it.
|
|
|
|
|
Hi i have created a div element & attach a onkepress event on it as
<b><div onkeydown="alert('Hi');" width="125px">uyiyuihgfhgfhgyu </div></b>
onkeydown event fires on IE & opera but not on mozilla. can any one help me in this regards?
|
|
|
|
|
The element will need to have focus before it'll catch key events. If you want clicking it to give it focus, just set the tabIndex attribute.
Citizen 20.1.01 'The question is,' said Humpty Dumpty, 'which is to be master - that's all.'
|
|
|
|
|
|
Huh?
The tabIndex attribute is spelled t-a-b-i-n-d-e-x. You put it on elements you want to gain focus, and give it a numeric value signifying where that element should appear in the tab order for the document. End of story.
Citizen 20.1.01 'The question is,' said Humpty Dumpty, 'which is to be master - that's all.'
|
|
|
|
|
i need to show a message to the user by using modalpopup extender, when user click on a button. but the problem is when i apply modelpopup extender to the button, button's click event does not work, can you please tell me the solution for that?
thank you,
Chatura Dilan
|
|
|
|
|
We have an ASP.NET forum, it's more heavily used, and this belongs there.
Christian Graus
Please read this if you don't understand the answer I've given you
"also I don't think "TranslateOneToTwoBillion OneHundredAndFortySevenMillion FourHundredAndEightyThreeThousand SixHundredAndFortySeven()" is a very good choice for a function name" - SpacixOne ( offering help to someone who really needed it ) ( spaces added for the benefit of people running at < 1280x1024 )
|
|
|
|
|
Hello all,
I suppose that the variables are inside the server that process everything. Aren't they?
For instance, if I make a variable like $Test and this variable value is 10, anyone in the world that could have access to that variable would be able to see the 10.
Is it correct?
As always thank you in advance.
|
|
|
|
|
Joan Murt wrote: I suppose that the variables are inside the server that process everything. Aren't they?
Yes you can find them inside the PHP trap door at the back of the server, that's where they hide. 
So is this about the time you start wondering if a background in computer science might actually have been helpful? 
led mike
|
|
|
|
|
Ouch! So I've got to look there... but... I have not understood one thing: are they on the back or on the background of the server?
Now being serious... I've never made any single development on web (only the original web page of my company but this was not development... it was like using word in order to get it done), and now I'm trying to get a new page made by some externals... and if you've seen the messages I've left on the lounge you'll understand my sudden interest on the web side of our business...
I wanted to know that, but I think that the most interesting implementation would be that everything would rely on the server and not on the clients, but asking is never too much work if it ensures the result...
Anyway, thank you for your feedback.
|
|
|
|
|
Joan Murt wrote: and if you've seen the messages I've left on the lounge you'll understand my sudden interest on the web side of our business...
Not enough to understand no. However understanding your web "business" is not equal to understanding the "technology" yes?
Joan Murt wrote: I think that the most interesting implementation would be that everything would rely on the server and not on the clients,
Very difficult to answer these questions for people that don't understand technology because the answers are all technical answers in that they require referencing technical items.
Server side code always executes in server processes. Data can be transfered between server and client code and therefore the same data can be used during both server execution and client code execution, but not at the same time of course.
That is probably not very helpful but I thought I should have a go at it. 
led mike
|
|
|
|
|
led mike wrote: Not enough to understand no.
I've left three messages in the lounge explaining that I've subcontracted a company to make the web site of our company and those guys have made a really bad job (everything is based on text files, data inconsistency, different web pages for different languages with different problems in each language...). Now I want to make them to solve this, and meanwhile I was making some tests I came across that doubt related to the way the variables are stored. I must celebrate a meeting with them in order to fix all the errors and I wanted to ask a couple of things before...
I'm all day working far away from the web side of the IT industry, I've made only one CGI in order to configure remotely the subversion source control system, and frankly I consider that I don't know anything related to the web development. (this is why I asked this here...  )... I suppose that when someone doesn't know anything from a specific topic then wrong formulated questions appear... 
Well, anyway at the end, and after a couple of trials I've made a test with different computers with different Internet public IP's and the variable value has maintained the value in all the computers so it must be stored in the server.
Thank you for your answer.
|
|
|
|
|
Some things you have said would indicate you do not have an understanding of how this technology works. That is understandable and very common outside of tech communities. I would at this stage highly recommend hiring a consultant.
Brad
Australian
The PHP MVP
- Christian Graus on "Best books for VBscript"
A big thick one, so you can whack yourself on the head with it.
|
|
|
|
|
Joan Murt wrote: re they on the back or on the background of the server?
I'm not sure what you mean by back or background of the server, but if you are using PHP then anytime a page is requested by a browser your PHP code will run from start to finish - any variables that are created will only exist during the lifetime of the page request, and will not exist on the server afterwards.
Basically, every time a page is generated, the server compiles your PHP, runs the code, and then exits, releasing all resources.
|
|
|
|
|
Sorry! I was only following a joke that Led Mike made...
I've been able to test it using different computers with different public IP's and the variable value is maintained in all the different connections so that variable must be stored in the server side.
Thank you for your answer...
|
|
|
|
|
PHP is a server template system that interprets all PHP script inside <?php ?> tags. Since PHP runs on the server, its variables also reside on the server.
If one user sets $Test = 10; in a script, it is not available in another call to the same script. If you want to share the value among multiple calls by the same user, you have to use $_SESSION['Test'] = 10;. Please make sure that you call session_start(); in all PHP script files that you want to access session variables.
To share between all sessions, use global variables. Syntax: $GLOBAL['Test'] = 10;
modified 29-Aug-18 21:01pm.
|
|
|
|
|
|
No problem. Just in case you are writing a PHP based website from scratch, try to do the following:
Organize code such that functions that provide core functions (such as accessing databases) be kept in separate php files. Then, you can use
<?php
require 'core.php'
?>
to include it in any other PHP file.
This way, you can reuse the functions, there will be as little PHP code in the HTML pages. It is much more manageable that way.
I go to another level usually, where PHP scripts corresponding to user actions are kept in another PHP file. Conceptually similar to MVC.
view.php has all the HTML with minimal PHP calls to functions in controller.php. Controller.php is specific to the view.php and contains all the PHP code specific to that page. All reusable functions between multiple pages go into core.php. I use multiple core files to aggregate functions based on functionality. For example: authentication goes into one file.
In the view.php, I just use
--
require 'core.php';
require 'controller.php';
HTML with function calls to controller.php.
--
I hope this helps. All this is just a matter of individual preference. I have found it much better to manage in the long term.
modified 29-Aug-18 21:01pm.
|
|
|
|
|
Thomas George wrote: To share between all sessions, use global variables. Syntax: $GLOBAL['Test'] = 10;
Um... no. This is wrong. You are confusing Sessions with scope.
Brad
Australian
The PHP MVP
- Christian Graus on "Best books for VBscript"
A big thick one, so you can whack yourself on the head with it.
|
|
|
|
|
A variable with global scope is available to all sessions. What is wrong?
modified 29-Aug-18 21:01pm.
|
|
|
|
|
My understanding is that a variable with global scope is available anywhere within the current instance of the script and (depending on your config) in the current user session.
Brad
Australian
The PHP MVP
- Christian Graus on "Best books for VBscript"
A big thick one, so you can whack yourself on the head with it.
|
|
|
|
|
You are right. Thank you for correcting my misconception. ![Rose | [Rose]](https://codeproject.global.ssl.fastly.net/script/Forums/Images/rose.gif)
modified 29-Aug-18 21:01pm.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
