Anti-SQL Injection





ranking Sort Sort   |   date Sort Sort   |   member Sort Sort
Syndication

« Previous 1 2  ...  9 10 11 12 13 14 15 16 17 Next »
6
Date Submitted Mon. Jun. 4th, 2007 3:06 PM
Revision 1
Scripter Fordiman
Tags "object passing" | JavaScript | PHP | serialize
Comments 6 comments
This is a quick set of overrides for Javascript so that any variable can be passed to PHP in a GET/POST activity. Just call myVar.toPHP();

I use this little set of functions extensively in a little Javascript/PHP RPC handler I wrote. I don't have the reverse function, as I pass JSON back to the browser for the return value.

Note: This lib is not safe for binaries or HTML Elements. The former will come out similar to FTP ASCII breaks, and the latter will cause infinite recursion. If you want to make a speical case for HTML Elements, do so; you could probably just test for parentNode and create a 'safe' object from that. I didn't need it, so I didn't code it.

As for binary safety, at some point between toPHP/escape/post/urldecode/unserialize, the object breaks. Rather than create a huge fix for something I didn't need to do, I put in a quick match/hack. Don't like it? Write the fix yourself.
5
Date Submitted Thu. Sep. 27th, 2007 8:02 AM
Revision 1
Scripter Fordiman
Tags JavaScript | PHP | Prototype | serialize
Comments 2 comments
This is the final version of my Javascript serializer targetted at PHP.

The point:
Objects are most easily passed over the network as serialized strings. Between serialization and unserialization, serialization is by far the easier of the two. Since object passing can sometimes be a process-hungry thing, we want to do things as quickly as possible.

My solution is to always do the hard part in compiled code, while doing the easy part in script. That is, whichever way you're passing an Object, you want to pass it in a natively decoded format for the target.

Since I work mostly in PHP, this meant writing a module that would be able to generate a string that can be decoded with PHP's unserialize() function into a PHP Associative Array (or other applicable type).

Notes:
This lib REQUIRES the Prototype lib. You can hack prototype out of it, of course (by replacing the references to Object.extend() with explicit assignments), but I can't imagine why you'd want to bother; it's used mostly with Ajax.Request anyway.

Previous versions of this code would add the .toPHP() member to the Object prototype. After trying to enumerate things, I found that this is a REALLY bad thing to do, as toPHP springs up where it's not wanted in ALL objects. As a result, I've opted to go the Prototype route and apply it as a member of the Object object.

Please note that if you pass a serialized string to PHP via GET or POST, you'll need to stripslashes() before unserialization.



Javascript sample of use:

var myObject = {
name:'value',
test:['Array','of','strings'],
bool:false,
timestamp: new Date(),
float: 3.1415926539,
number: 42,
func: function () {
alert('Member functions are always omitted from serialization');
}
}
alert(Object.toPHP(myObject));

Output:
a:7:{s:4:"name";s:5:"value";s:4:"test";a:3:{i:0;s:5:"Array";i:1;s:2:"of";i:2;s:7:"strings";}s:4:"bool";b:0;s:9:"timestamp";i:1190897619824;s:5:"float";d:3.1415926539;s:6:"number";i:42;s:4:"func";null}


Sample of subsequent unserialization in PHP (passed via POST as 'myobject')

$myObject=unserialize(stripslashes($_POST['myobject']));
var_dump($myObject);

Output:
array(7) {
["name"]=>
string(5) "value"
["test"]=>
array(3) {
[0]=>
string(5) "Array"
[1]=>
string(2) "of"
[2]=>
string(7) "strings"
}
["bool"]=>
bool(false)
["timestamp"]=>
int(1192296601)
["float"]=>
float(3.1415926539)
["number"]=>
int(42)
["func"]=>
NULL
}
3
Date Submitted Thu. Mar. 6th, 2008 3:09 AM
Revision 1
Scripter Fordiman
Tags JavaScript | parse_url | PHP
Comments 0 comments
Simple. It's parse_url, from PHP, implemented in Javascript. Seen a lot of similar ones around the web, but they were all bulky code and none of them took advantage of the RegEx parser in JS.

Applied as a member of the String prototype, so just call as myURL.parseURL(); Will return a named object with naming identical to that of PHP's function.

Additional: if first argument is present, will break the querystring up into name/value pairs, unescaped, and return that instead of the raw querystriing.
2
Date Submitted Fri. Jun. 27th, 2008 11:29 AM
Revision 1
Scripter Fordiman
Tags PHP | templating
Comments 1 comments
A simple function (with support) that can provide the backbone to any templating system.
2
Date Submitted Wed. Aug. 13th, 2008 11:34 PM
Revision 1
Scripter Fordiman
Tags easy | mysql | PHP
Comments 0 comments
My previous entry on an easy to use SQLite interface for XUL/JS got me thinking: how many times have I had to write functions that were just wrappers for a little SQL?

Below is the fruits of that little query (excuse the pun). Forgive the dbXXX functions; my implementation depended on a small portion of a larger mysql library that I've grown accustomed to coding with.
1
Date Submitted Thu. Aug. 28th, 2008 9:33 AM
Revision 1
Scripter Fordiman
Tags buffering | errors | Output | PHP | template
Comments 0 comments
Best use of ob_, custom error handling, and variable variales evar: simple templating.

_parse($filename[,$locals])
includes $filename and renders its output to the return value. $locals, if used, will add a set of variables to the included context.

Parse($template[,$locals])
Same as above, but allows you to define a base template folder and omit the .php - just for cleaner code.

t($template[,$obj])
...
t()
Same as Parse, but any output between the opening call and the closing call (no arguments) will be buffered intot he $content variable of the template.

Play around with t(..) to find out more; I don't feel like documenting it.
9
Date Submitted Thu. Feb. 22nd, 2007 5:20 PM
Revision 1
Beginner fleft
Tags File | Files | management | PHP | upload | uploader
Comments 4 comments
This is a Tiny PHP Uploading script. It SHOULD be safe from both really large files and non-image files.
11
Date Submitted Sun. Sep. 17th, 2006 9:05 AM
Revision 1
Helper ffxfiend
Tags "images" | PHP | phpcode
Comments 3 comments
You can use this function to dynamically generate html "width/height" for use with displaying a thumbnail image usingthe original image. This will help save in making dup images just for display as a thumbnail.

It takes two arguments, the path to where the image is stored and the desired width or height.

Please comment or improve this code .
10
Date Submitted Mon. Sep. 18th, 2006 7:26 PM
Revision 1
Helper ffxfiend
Tags mysql | PHP
Comments 0 comments
Here is a pair of function to use in combination. The first one will change newlines into tags to store into a database. The second one does the reverse so you can edit the content of the database without having the tags show when you edit the content. If you can find improvements or have comments please let me know
26
Date Submitted Fri. Sep. 22nd, 2006 7:06 AM
Revision 1
Helper ffxfiend
Tags "Random Generation" | PHP | phpcode
Comments 5 comments
This is a simple function to generate a random ID of letters and numbers however long you want. All you do is pass it how many parts you want and then how many pieces(chars/numbers) per part you want.

I hope you enjoy
« Previous 1 2  ...  9 10 11 12 13 14 15 16 17 Next »