cka php hlp plz

So I taught myself some basic PHP stuff and wrote a script for my site to run from one file and some stuff I put into my SQL server. (I'm still working on the interface to edit my site without PHPMyAdmin.) Anyway, I wanted your opinions on two pieces of code and your help with another that I'm trying to do. Here's the bulk of the PHP; it goes at the top of the file and I was wondering if I did it efficiently or if there's a better way to achieve what I'm intending:

Code:

---

<?php        // calliander.net main php script
        /* Initiate a connection to the SQL server. */
                $sqlconn = @mysql_connect("mysqlserver","myusername","mypassword") or die(require("error.html"));

        /* Select the appropriate database. */
                $dbselect = @mysql_select_db("mydb",$sqlconn) or die(require("error.html"));

        /* Get the data from the table. */
                $myquery = @mysql_query("select * from site_vars",$sqlconn) or die(require("error.html"));

        /* Parse the data from the query. */
                while($row = mysql_fetch_array($myquery)) {
                        $site_css = $row["vars_css"];
                        $site_tagline = $row["vars_tagline"];
                }

        /* Obtain the GET information. */
                $sitearea = $_GET['a'];
                if (!$sitearea) {
                        $sitearea = "home";
                }

        /* Set up for main body display below. */
                $table = "site_$sitearea";
                $bodyquery = @mysql_query("select * from $table",$sqlconn) or die(require("error.html"));
?>

---

The navigation links are an href that goes "?a=areaname", so that's why I used the GET server info. And then to write the body:

Code:

---

<?php        // main body loader
        while($row = mysql_fetch_array($bodyquery)) {
                if ($row[0]) {
                        echo("\t<div class=\"header\">");
                        echo($row[0]);
                        echo($row[1]);
                        echo("</div>\n");
                }
                echo("\t<div class=\"paragraph\">");
                echo($row[2]);
                echo("</div>\n");
        }
?>

---

And my question is something that looks like it should work, but doesn't - I want to have PHP build my navigation links. There's two images - the ones with blue letters for links and grey letters for ones that aren't (because you're already there). I wrote a script that goes like this:

Code:

---

<?php        // navigation links builder
        if ($sitearea = "home") {
                echo(text for home with grey and no link);
        } else {
                echo(text for home link);
        }
?>

---

I'm not sure why it isn't working, but any help is appreciated. Thanks in advance. You can see the site in action at http://www.calliander.net/ (though, I'm still building the pages). When SQL is broken, the die(require.. presents http://www.calliander.net/error.html

First off, SANITIZE THE GOD DAMN VARIABLES if you're passing via the query string. mysql_real_escape_string() for strings and intval() for numbers. You could even setup some sort of cheap globalizing function to do this such as the following:

PHP Code:

---

  function globalize() {
    global $_GET, $_POST, $_FILES;
    $GLOBALS = array();
    // sanitize $_GET
    while(list($key, $val) = each($_GET)) {
          if (is_numeric($val)) { $GLOBALS['GET'][$key] = intval($val); }
          else { $GLOBALS['GET'][$key] = mysql_real_escape_string($val); }
    }
    // sanitize $_POST
    while(list($key, $val) = each($_POST)) {
          if (is_numeric($val)) { $GLOBALS['POST'][$key] = intval($val); }
          else { $GLOBALS['POST'][$key] = mysql_real_escape_string($val); }
    }
    // sanitize $_FILES
    while(list($key, $val) = each($_FILES)) {
          if (is_numeric($val)) { $GLOBALS['FILES'][$key] = intval($val); }
          else { $GLOBALS['FILES'][$key] = mysql_real_escape_string($val); }
    }
    // return sanitized superarray with GET/POST/FILES data 
    // $GLOBALS['GET'] becomes a MD array of GET values, $GLOBALS['POST'] becomes a MD array of POST etc.
    return $GLOBALS;
  } 


---

The next thing that sticks out at me is this:

if ($sitearea = "home") {

It should be this:

if ($sitearea == "home") {

There is a HUGE difference between = and ==, since = sets the variable and == checks it. :bang: Any other questions you have, don't hesitate to ask.


edit: by the way I can fuck your site up by calling index.php?a=home;DROP%20TABLE%20site_home; that's why it's important to sanitize those fucking variables

Concurrage with cka.

*steals sanitize function*





*runs away*

If my site were working, I would modify that shit.

Can I just put the sanitizing part in there without having to call it? Like, toss it in the very beginning?

Absolutely you can. Just change the first 3 lines to this:

if (is_array($_GET) OR is_array($_POST) OR is_array($_FILES)) {

One of my New Year's Resolutions is to finally learn PHP. I have an idea for a little something something I can make so lets see what I can do.

Quote:

---

Originally Posted by cka

Absolutely you can. Just change the first 3 lines to this:

if (is_array($_GET) OR is_array($_POST) OR is_array($_FILES)) {

---

Cool. Thanks for the help. In the back of my mind, I knew that double equals sign thing. Hehe.

Quote:

---

Originally Posted by diffusionx

One of my New Year's Resolutions is to finally learn PHP. I have an idea for a little something something I can make so lets see what I can do.

---

If you go to B&N or Borders any time soon, pick up "PHP For the World Wide Web, Second Edition" by Larry Ullman. It's been invaluable to me AND he recommends Mac OS X. :)

Um, okay, so once again my buddy's lack of updating the version of PHP on the server is killing me. http://www.calliander.net/info.php

Is there any way to sanitize the variables with 4.2.3? Or should I revert it to a POST, maybe? Is POST any more/less secure? Fucking christ.

Quote:

---

If you go to B&N or Borders any time soon, pick up "PHP For the World Wide Web, Second Edition" by Larry Ullman. It's been invaluable to me AND he recommends Mac OS X.

---

Nah, Im not spending money.

Quote:

---

Originally Posted by diffusionx

One of my New Year's Resolutions is to finally learn PHP. I have an idea for a little something something I can make so lets see what I can do.

---

If you don't want to spend money, spend some time in

http://www.free2code.net/
http://www.evolt.org/

to look through some good tutorials. And there's no need for you to buy a PHP reference book when you have

http://www.php.net/

It has a PHP function search engine, along with explanations on how to use each command.