Programming Forums

Programming Forums (http://www.programmingforums.org/forumindex.php)
-   PHP (http://www.programmingforums.org/forum29.html)
-   -   Help With Passing Values. (http://www.programmingforums.org/showthread.php?t=1080)

Pizentios Nov 9th, 2004 11:05 AM

Hey,

I am currently webifying one of my vb apps. I am ofcourse using PHP and Postgresql. Anyways, i am having trouble grabing values from the url. Here is the code that generates the link that the user clicks:

:

        case "list":
 //Settting up for db transaction.
 $db = new dbobj();
 $db->setUser($postgres_user);       
 $db->setDBname($database);
 //connecting to the db.
 if ($db->conn())
 {
        //now to do a select and output all of the customers.
        $res = $db->dbSelect("*", "customerinfo", "");
        if (pg_num_rows($res) > 0)
        {
  echo "<table width=\"500\" cellpadding=\"0\" cellspacing=\"0\">\n";       
  echo "<tr>\n"
    ."<td align=\"center\" bgcolor=\"$background2\"><font color=\"$background1\"><b>Company Name:</b></font></td>\n"
    ."<td align=\"center\" bgcolor=\"$background2\"><font color=\"$background1\"><b>City:</b></font></td>\n"
    ."<td align=\"center\" bgcolor=\"$background2\"><font color=\"$background1\"><b>Street Address:</b></font></td>\n"
    ."<td align=\"center\" bgcolor=\"$background2\"><font color=\"$background1\"><b>Contact Name:</b></font></td>\n"
    ."</tr>\n";
  for ($x=0; $x<pg_num_rows($res); $x++)
  {
          $data = pg_fetch_object($res, $x);
          $company = htmlentities(urlencode($data->companyname));
          $cityu = htmlentities(urlencode($data->city));
          $saddy = htmlentities(urlencode($data->streetaddress));

          echo "<tr>\n"
    ."<td align=\"left\"><a href=\"cuslist.php?action=cusinfo&cname=$company&city=$cityu&streeta=$saddy\">$data->companyname</a></td>\n"
                      //The above line is the link that the user clicks to run the next block of code.
                      ."<td align=\"left\">$data->city</td>\n"
    ."<td align=\"left\">$data->streetaddress</td>\n"
    ."<td align=\"left\">$data->firstname  $data->lastname</td>\n"
    ."</tr>\n";
  }
  echo "</table>\n";
        }
        else
        {
  echo "<tr>\n";
  echo "<td colspan=\"4\" align=\"center\"><b>There are no customers in the database.</b></td>\n";
  echo "</tr>\n";
  echo "</table>\n";
        }
 }
 else
 {
        echo "<center><b>Error, there was a problem while trying to connect to the database.</b></center>";
 }       
 break;


Anyways, when i click that link this is the code that get run.

:

case "cusinfo":
 //setting up objects:
 $db = new dbobj();
 $db->setUser($postgres_user);
 $db->setDBname($database);
 //connecting:
 if ($db->conn())
 {
        //Search the db for the customer/
        $comapny = html_entity_decode(urldecode($cname));
        $city = html_entity_decode(urldecode($city));
        $street = html_entity_decode(urldecode($streeta));
        echo $city . "<---City " . $company . "<---Company " . $street . "<---Street Address";
        if ($company <> "" && $city <> "" && $street <> "")
        {
  $res = $db->dbSelect("*", "customerinfo", "companyname='$company' AND city='$city' AND streetaddres='$street'");
  if (pg_num_rows($res) == 1)
  {
          //Output Shit For the Customer INfo:
          $data = pg_fetch_object($res, 0);
          echo "<table width=\"500\" cellpadding=\"0\" cellspacing=\"0\">\n"
    ."<tr>\n"
    ."<td align=\"center\ colspan=\"4\"><font size=\"5\"><b><u>$data->companyname</u></b></font></td>\n"
    ."</tr>\n"
    ."<td align=\"left\" colspan=\"4\"><font size=\"4\"><b><u>Contact Information:</u></b></td>\n"
    ."</tr>\n"
    ."<tr>\n"
    ."<td align=\"left\"><b>First Name:</b></td>\n"
    ."<td align=\"center\">$data->firstname</td>\n"
    ."<td align=\"Left\"><b>Last Name:</b></td>\n"
    ."<td align=\"Center\">$data->lastname</td>\n"
    ."</tr><tr>\n"
    ."<td align=\"center\" colspan=\"2\"><b>Email:</b></td>\n"
    ."<td align=\"Center\" colspan=\"2\">$data->email</td>\n"
    ."</tr><tr>\n"
    ."<td align=\"left\"><b>Phone Number:</b></td>\n"
    ."<td align=\"center\">$data->landphone</td>\n"
    ."<td align=\"left\"><b>Fax:</b></td>\n"
    ."<td align=\"center\">$data->fax</td>\n"
    ."</tr><tr>\n"
    ."<td align=\"left\" colspan=\"4\"><font size=\"4\"><b><u>Mailing Address:</u></b></td>\n"
    ."</tr><tr>\n"
    ."<td align=\"left\"><b>Country:</b></td>\n"
    ."<td align=\"center\">$data->country</td>\n"
    ."<td align=\"left\"><b>Province:</b></td>\n"
    ."<td align=\"center\">$data->provincestate</td>\n"
    ."</tr><tr>\n"
    ."<td align=\"left\"><b>City:</b></td>\n"
    ."<td align=\"center\">$data->city</td>\n"
    ."<td align=\"left\"><b>Street Address:</b></td>\n"
    ."<td align=\"center\">$data->streetaddress</td>\n"
    ."</tr><tr>\n"
    ."<td align=\"left\" colspan=\"2\"><b>Postal/Zip Code:</b></td>\n"
    ."<td align=\"center\" colspan=\"2\">$data->postalzip</td>\n"
    ."</tr><tr>\n"
    ."<td align=\"left\" colspan=\"4\"><font size=\"4\"><b><u>Other Information:</u></b></font></td>\n"
    ."</tr><tr>\n"
    ."<td align=\"left\"><b>Customer Level:</b></td>\n"
    ."<td align=\"center\">$data->cuslevel</td>\n"
    ."<td align=\"left\"><b>Type of Customer:<b></td>\n"
    ."<td align=\"center\">$data->type</td>\n"
    ."</tr><tr>\n"
    ."<td align=\"center\" colspan=\"2\"><b>OEM Type:</b></td>\n"
    ."<td align=\"center\" colspan=\"2\">$data->oemtype</td>\n"
    ."</tr><tr>\n"
    ."<td align=\"left\"><b>GST #:</b></td>\n"
    ."<td align=\"center\">$data->gst</td>\n"
    ."<td align=\"left\"><b>PST #:</td>\n"
    ."<td align=\"center\">$data->pst</td>\n"
    ."</tr><tr>\n"
    ."<td align=\"center\" colspan=\"4\"><b>Comments:</b></td>\n"
    ."<td align=\"center\" colspan=\"4\"><p align=\"left\">$data->comments</p></td>\n"
        ."</tr></table>\n";
  }
  else
  {
          echo "<table width=\"500\" cellspacing=\"0\" cellpadding=\"0\">\n"
    ."<tr>\n"
    ."<td align=\"center\" bgcolor=\"$errorcolor\">\n";
    $e->queryerror();
          echo "</td></tr></table>\n";
  } 
         
        }
        else
        {
  echo "<table width=\"500\" cellpadding=\"0\" cellspacing=\"0\">\n";
  echo "<tr>\n";
  echo "<td align=\"center\" bgcolor=\"$errorcolor\">\n";
  $e->queryerror();
  echo "</td></tr></table>\n";
        }
 }
 else
 {
        echo "<table width=\"500\" cellpadding=\"0\" cellspacing=\"0\">\n"
    ."<tr>\n"
    ."<td align=\"center\" bgcolor=\"$errorcolor\">\n";
        $e->dberror();
        echo "</td></tr></table>";
 }
 break;

The city value and the street value are both there, however for some reason the company name is not. Why would one be not there and the other come back just fine? I have checked the spelling of my vars and junk that i build the link to the above code with and they all match up. Thanks for any help in advance.

kurifu Nov 9th, 2004 12:51 PM

MY guess is that you are using PHP 4.1 or greater and the PHP GLOBALS have been disabled (because you script is VERY vulnerable to attack if it were not disabled).

When you pass a variable through an HTTP POST or an HTTP GET such as http://.../?foo=bar you do not access it through $foo, you have to access it through $_REQUEST[foo].

This prevents people from "Seeding" invalid global variables, or initialize variables that should not otherwise be initialized, causing severe security vulnerabilities in your script.

Pizentios Nov 9th, 2004 3:50 PM

Yeah i know, but the GLOBALS is turned on currently, however i have tryied it both ways and gotten the same results both times.


All times are GMT -5. The time now is 12:41 AM.

Powered by vBulletin® Version 3.7.0, Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Copyright ©2007 DaniWeb® LLC