Sunday, 2 December 2012

Create a Connection to a MySQL Database

Before you can access data in a database, you must create a connection to the database.
In PHP, this is done with the mysql_connect() function.

Syntax

mysql_connect(servername,username,password);

Parameter Description
servername Optional. Specifies the server to connect to. Default value is "localhost:3306"
username Optional. Specifies the username to log in with. Default value is the name of the user that owns the server process
password Optional. Specifies the password to log in with. Default is ""
Note: There are more available parameters, but the ones listed above are the most important. Visit our full PHP MySQL Reference for more details.

Example

In the following example we store the connection in a variable ($con) for later use in the script. The "die" part will be executed if the connection fails:
<?php
$con = mysql_connect("localhost","peter","abc123");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

// some code
?>

Closing a Connection

The connection will be closed automatically when the script ends. To close the connection before, use the mysql_close() function:
<?php
$con = mysql_connect("localhost","peter","abc123");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

// some code

mysql_close($con);
?>

PHP Variables

As with algebra, PHP variables are used to hold values or expressions.
A variable can have a short name, like x, or a more descriptive name, like carName.
Rules for PHP variable names:
  • Variables in PHP starts with a $ sign, followed by the name of the variable
  • The variable name must begin with a letter or the underscore character
  • A variable name can only contain alpha-numeric characters and underscores (A-z, 0-9, and _ )
  • A variable name should not contain spaces
  • Variable names are case sensitive (y and Y are two different variables)

Creating (Declaring) PHP Variables

PHP has no command for declaring a variable.
A variable is created the moment you first assign a value to it:
$myCar="Volvo";
After the execution of the statement above, the variable myCar will hold the value Volvo.
Tip: If you want to create a variable without assigning it a value, then you assign it the value of null.

Thursday, 29 November 2012

Apache Handlers - Running HTML as PHP

Apache handlers allow you to control what Apache will do with certain file types. When Apache sees a file, it has an action built in for that file type, and will perform that action.

If you wish Apache to do a different action, you will need to make a handler to tell Apache to perform that action. For example, if you use a file type that requires a special service to run it, such as a file with server side includes that is not named with a .shtml extension, you need to tell Apache to treat these files differently.

To get regular html pages to handle php code, you need to add this line to your htaccess file.

It is highly recommended that you never allow html pages to automatically handle php or shtml, because this forces all of your html pages to be processed by the server first. Instead, please rename your files to .php or .shtml whenever possible.

System Mime Type defaults
Handler Code File Extensions
application/x-hdf hdf
application/vnd.wap.wbxml wbxml
image/x-xbitmap xbm
image/x-icon ico
image/vnd.djvu djvu djv
application/x-troff-me me
application/perl pl plx ppl perl pm
application/x-tcl tcl
image/bmp bmp
text/x-sql sql
image/png png
text/x-log log
audio/x-realaudio ra
application/x-latex latex
application/x-director dcr dir dxr
text/rtf rtf
application/xhtml+xml xhtml xht
application/vnd.ms-powerpoint ppt
application/x-csh csh
image/svg+xml svg
application/x-troff-ms ms
image/x-rgb rgb
application/x-img img
image/jpeg jpeg jpg jpe
image/x-portable-pixmap ppm
text/plain asc txt
image/cgm cgm
application/x-sh sh
application/andrew-inset ez
application/vnd.wap.wmlscriptc wmlsc
text/x-registry reg
video/vnd.mpegurl mxu
image/ief ief
audio/x-pn-realaudio ram rm
image/x-xpixmap xpm
video/mpeg mpeg mpg mpe
text/tab-separated-values tsv
application/rdf+xml rdf
application/x-httpd-php phtml php php3 php4 php5 php6
x-conference/x-cooltalk ice
image/tiff tiff tif
text/richtext rtx
text/css css
application/ruby rb
application/x-wais-source src
application/xml xml xsl
application/voicexml+xml vxml
image/x-portable-graymap pgm
chemical/x-xyz xyz
model/iges igs iges
application/vnd.mif mif
application/mathml+xml mathml
application/x-ustar ustar
application/x-troff-man man
text/vbscript vbs
text/calendar ics ifb
chemical/x-pdb pdb
application/smil smi smil
application/srgs+xml grxml
image/x-portable-anymap pnm
application/x-shockwave-flash swf
audio/mpeg mpga mp2 mp3
video/x-sgi-movie movie
application/cgi cgi
application/x-cpio cpio
application/x-javascript js
text/x-setext etx
audio/basic au snd
text/sgml sgml sgm
application/x-tar tgz tar
application/vnd.mozilla.xul+xml xul
application/x-futuresplash spl
application/xslt+xml xslt
model/mesh msh mesh silo
application/mac-binhex40 hqx
text/vnd.wap.wml wml
image/x-cmu-raster ras
application/x-sv4cpio sv4cpio
audio/x-aiff aif aiff aifc
application/x-gtar gtar
audio/x-ms-wax wax
audio/x-ms-wma wma
image/x-xwindowdump xwd
application/x-cdlink vcd
application/msword doc
video/quicktime qt mov
application/x-bcpio bcpio
application/x-tex tex
text/x-config cnf conf
application/x-sv4crc sv4crc
application/x-dvi dvi
application/x-troff t tr roff
audio/x-mpegurl m3u
application/x-shar shar
audio/mp4 a-latm m4p m4a mp4
application/pdf pdf
application/mac-compactpro cpt
application/vnd.wap.wmlc wmlc
video/x-msvideo avi
application/ogg ogg
text/html html htm shtml
image/gif gif
audio/midi mid midi kar
application/x-pkcs7-crl crl
application/x-chess-pgn pgn
audio/x-pn-realaudio-plugin rpm
application/srgs gram
application/x-koan skp skd skt skm
image/vnd.wap.wbmp wbmp
application/x-netcdf nc cdf
model/vrml wrl vrml
application/x-httpd-php-source phps
application/vnd.ms-excel xls
application/postscript ai eps ps
application/x-texinfo texinfo texi
application/zip zip
image/x-portable-bitmap pbm
audio/x-wav wav
application/x-x509-ca-cert crt
application/oda oda
application/xml-dtd dtd
application/octet-stream bin dms lha lzh exe class so dll iso dmg
text/vnd.wap.wmlscript wmls
application/x-stuffit sit
 

Wednesday, 28 November 2012

Mysql - sql injection prevention


If you have ever taken raw user input and inserted it into a MySQL database there's a chance that you have left yourself wide open for a security issue known as SQL Injection.
SQL injection refers to the act of someone inserting a MySQL statement to be run on your database without your knowledge. Injection usually occurs when you ask a user for input, like their name, and instead of a name they give you a MySQL statement that you will unknowingly run on your database.

Below is a sample string that has been gathered from a normal user and a bad user trying to use SQL Injection. We asked the users for their login, which will be used to run a SELECT statement to get their information.

MySQL & PHP Code:
// a good user's name
$name = "timmy";
$query = "SELECT * FROM customers WHERE username = '$name'";
echo "Normal: " . $query . "<br />";

// user input that uses SQL Injection
$name_bad = "' OR 1'";

// our MySQL query builder, however, not a very safe one
$query_bad = "SELECT * FROM customers WHERE username = '$name_bad'";

// display what the new query will look like, with injection
echo "Injection: " . $query_bad;

Display:

Normal: SELECT * FROM customers WHERE username = 'timmy'
Injection: SELECT * FROM customers WHERE username = '' OR 1''

The normal query is no problem, as our MySQL statement will just select everything from customers that has a username equal to timmy.
However, the injection attack has actually made our query behave differently than we intended. By using a single quote (') they have ended the string part of our MySQL query
  • username = ' '
and then added on to our WHERE statement with an OR clause of 1 (always true).
  • username = ' ' OR 1
This OR clause of 1 will always be true and so every single entry in the "customers" table would be selected by this statement!



Sunday, 25 November 2012

Sending an email containing HTML from within a PHP page

The mail function in PHP allows you to send a plain text email in a single function call from within your script but please read the cautions at the end of this post before you do so!. How do you send out something in HTML format, though?

The mail function takes an additional (fourth) parameter of extra headers ... and one of the headers that you can use is a content-type: which lets you define the data type that's in the email - for example: text/html. There's an example showing how a message may be sent as both plain text and as HTML [here].

Email protocols are intrinsically line based, and 7 bit ... which means that what you send out needs to have a new line character at least once every 80 characters, and it cannot reliably contain high end (special) characters. In theory, that should not be a problem with HTML, but it could be a nuisance to have to split things down, and it could be more than a nuisance if you were sending out things like .jpg images. The solution here is to use a content-transfer-encoding header, with a base64 encoding - and of course to encode the data stream to suit. Full example [here].

Some Common Email Headers

The lines given here are examples of each of the most common types:

Supplied as parameters to the mail function:

To: Graham Ellis <graham@wellho.net>
Subject: A Demonstration of Email Headers

Supplied (if required) as part of the fourth (extra) parameter

From: Well House Consultants <info@wellho.net>
Reply-To: Lisa Ellis <lisa@wellho.net>
Cc: Gypsy <thedog@wellho.net>, Charlie <thecat@wellho.net>
Bcc: copybox@wellho.net, Audit <audittrail@wellho.net>
Date: Thu, 4 Nov 2010 14:30:27 +0000
Precedence: Bulk
Message-ID: 12345
In-Reply-To: wellho-5454
References: 12332, 11001, wellho-5420
MIME-Version: 1.0

A line like this sets up the document to be multipart if you wish:

Content-Type: multipart-alternative;boundary=00112233445566778899aabbccddeeff

The following can be supplied as part of the header or at the head of each section in a multipart email

Content-Type: text/html
Content-transfer-encoding: base64
Content-disposition: inline; filename="mypage.html"

The cautions at the end of this post

Before you start emailing from your server, consider the following:

a) Does the person your sending to REALLY want the email? (If it's confirming an order, the answer will be a resounding "YES", but if you're writing to tell him of your latest gizmo for sale, he might not be so keen!)

b) You're sending out an automated email from your server ... so it may look rather like other automated emails that people send out in bulk from servers (a.k.a. "spam") to many automated filters. How are you going to make your message special enough to be delivered?

c) Check that you are not providing an open emailing platform - that a user of your site is NOT able to enter a recipient's email address and message and use your server to send out unsolicited advertising material without your knowledge / approval. You really don't want to get yourself blacklisted!