Perl/PHP Thread

[Cromewell]

Please post any questions relating to Perl/PHP here. Please indicate which language you are using and also specify which external libraries, if any, you are using.

You can also use this thread to post code you wish to share.

 

[Ankur]

Just some queries.
1. PHP include

<?php include("header.php"); ?>

I use it in most of my pages to give a connection and select the database. I want to know how secure it is? I have heard that the header.php file is not very secure.

2. How to auto generate/create a page?
Example. When I joined facebook it did not give me specific page for my profile. The one day it asked me to select a page name for it. I selected one name and the page got generated. What is this technique called? How to auto generated such pages?

 

[Cromewell]

Just some queries.
1. PHP include

<?php include("header.php"); ?>

I use it in most of my pages to give a connection and select the database. I want to know how secure it is? I have heard that the header.php file is not very secure.

2. How to auto generate/create a page?
Example. When I joined facebook it did not give me specific page for my profile. The one day it asked me to select a page name for it. I selected one name and the page got generated. What is this technique called? How to auto generated such pages?

1. If header.php isn't very secure that's kind of you own problem, fix the code

There was a security flaw (may have been addressed by now) where if header.php was missing the php start tag it could get printed out in plain text on every page which references it. That may be the security issue you are talking about.

It's possible with recent versions of php to include remote files. Obviously this is a security concern because you are including a file which you likely don't have source control over, someone could be modifying functions you are using to do undesired things.

2. I don't use facebook at all but I'd imagine it's all database driven. They may be using some kind of mvc framework as well.

 

[mihir]

Just some queries.
1. PHP include

<?php include("header.php"); ?>

I use it in most of my pages to give a connection and select the database. I want to know how secure it is? I have heard that the header.php file is not very secure.

2. How to auto generate/create a page?
Example. When I joined facebook it did not give me specific page for my profile. The one day it asked me to select a page name for it. I selected one name and the page got generated. What is this technique called? How to auto generated such pages?

1. What kind of security are you talking about. You can chmod the file. And as cromwell said you can make some changes in the code. What exactly did you hear about header.php being not very secure?
2.You can use php file handling to create a new php page with the profile details as saved as variables. Like you can have a template with appropriate variable to create a php page for every user. Or you can use query strings and url masking. I think facebook uses URL masking

 

[Cromewell]

1. What kind of security are you talking about. You can chmod the file. And as cromwell said you can make some changes in the code. What exactly did you hear about header.php being not very secure?

I think what he is talking about is due to the behaviour of the php intrepreter. Lets say you have a php file which manages your connection credentials and someone were to either make an error or intentionally wanted to mess it up and removed the starting <?php. Any page which was including this file would have the contents displayed for all to see.

 

[Ankur]

I want to know how safe is the header.php file? I put my connection details in it. What if someone gets the code on it? They will hack my whole site. I know the php code isn't displayed on Pages but is there a way to see it? I am not aware of any way, if there is a way then what are the preventions?

2.You can use php file handling to create a new php page with the profile details as saved as variables. Like you can have a template with appropriate variable to create a php page for every user. Or you can use query strings and url masking. I think facebook uses URL masking

I did not really understand that.
Example, if I put some text in a text box, e.g name, then after hitting submit I want it to create a page automatically, like sitename.com/name.

 

[Cromewell]

I want to know how safe is the header.php file? I put my connection details in it. What if someone gets the code on it? They will hack my whole site. I know the php code isn't displayed on Pages but is there a way to see it? I am not aware of any way, if there is a way then what are the preventions?

As long as you have a server with the php parser they can't get the code unless they break into the server itself. At which time that's probably the least of your trouble.

I did not really understand that.
Example, if I put some text in a text box, e.g name, then after hitting submit I want it to create a page automatically, like sitename.com/name.

It can be done a couple ways, one is with URL Rewrite where it's faked (but looks like a real page to a user/search engine) and the other is a script that actually generates the file structure.

 

[mihir]

I think URL masking is the best method, for regular websites.I am not sure what facebook uses. But I won't be surprised if they create new files for every user they have since they own the appropriate server resources needed to get the job done. But something like creating new files for every user would be very heavy for a regular website

 

[Ankur]

I am now good enough at PHP now and started nice little business with it. I just want to be expert in PHP now. Can anyone tell me any good books where I can find advance PHP stuff?
Online I can find only basics.

 

[Ankur]

<?php
$fp=fopen("mywork.doc","w");
$str="Hello";
fwrite($fp, $str);
fclose($fp);
?>

The above code works fine and prints hello properly, can anyone tell me how to print "Hello" in Bold or Italics or any other format?

 

[Troncoso]

<?php
$fp=fopen("mywork.doc","w");
$str="Hello";
fwrite($fp, $str);
fclose($fp);
?>

The above code works fine and prints hello properly, can anyone tell me how to print "Hello" in Bold or Italics or any other format?

You should just be able to add HTML bold tags around it (<b></b>). If you would like to do a lot of formatting and visual things in PHP, it would do you good to learn how to integrate some HTML/CSS into your code.

 

[Ankur]

You should just be able to add HTML bold tags around it (<b></b>). If you would like to do a lot of formatting and visual things in PHP, it would do you good to learn how to integrate some HTML/CSS into your code.

Agreed, but I want to write the string in a word file and not on a webpage. If I put "<b>Hello</b>" in a string and write it in a word file then it will print
<b>Hello</b> in word file.

How I actually I want to print in word file
Hello

How actually it is printing
<b>Hello</b>

 

[Cromewell]

Are you trying to write the doc file with using the word xml format? If so you have to use <w:b/> modifier but it's ugly as anything you've ever seen or ever will again.

If you have some library which is helping you with the word doc format, it should have a method to do what you want.

 

[Ankur]

I have created login page for my website, it checks the username and password and the if successful creates a session for that user.
Example: $_Session['user']=$username;

I want to know if other user logs into my site then will the $_Session['user'] variable be overwritten?
Will there be confusion or any bugs?

Is there a method to solve this problem?
I want to create two different sessions for these two users accessing my site concurrently, how to identify the users?

 

[kobaj]

I have created login page for my website, it checks the username and password and the if successful creates a session for that user.
Example: $_Session['user']=$username;

I want to know if other user logs into my site then will the $_Session['user'] variable be overwritten?
Will there be confusion or any bugs?

Is there a method to solve this problem?
I want to create two different sessions for these two users accessing my site concurrently, how to identify the users?

No, the session table gives unique ids depending on the user accessing the server. So User A cannot see User B's session variables.

But I'm posting because that is not a very effective way to manage the login of users. As soon as they close their browser/navigate away from the site session variables are recycled. Meaning every time they come back to your website they have to log in /again/. Which, if you're running a banking website is secure yes. But regular website, or forums, or anything of that nature will drive the user insane.

You should use cookies.

 

[Ankur]

It is more of a place where security is needed, I am destroying everything after the user leaves the site, thanks Kobaj I needed that reply, I'm feeling positive now.

Okay now I have some security question, what is SSL, HTTPS?
I can google it but can someone explain me nice in short

Other tricks to keep my session safe.

 

[Cromewell]

Using sessions is good for security but depending on what you are doing, it's possible to steal someone's session.

SSL/TLS/HTTPS is a secured connection between the server and client. Basically, it defines how the client and server encrypt their communications. You need a certificate to identify your server. You can use a self signed one but the client will complain that the site may not be secure unless your server is a trusted signer.

 

[Ankur]

How to send mail using php? I am using the php mail() function but it is failing, it doesn't even send the details to the spam folder.
I know I have to edit and set the php.ini file but I am using a shared server so how do I edit the details?
Any Help?

 

[Cromewell]

You need an active mail server to send the mail to or it won't work. i.e. sendmail on a linux box. On windows you just need to set the mail server ini property to something php can push the mail to.

 

[Ankur]

The shared server won't allow me to change the php.ini file, I do have an active mail server, is there a way by which I can set my mail server to the settings?