Bizarre insert form behavior

Anon

I've posted this in the php.db mailing list, but also thought I'd post it here in case any of you don't subscribe. This problem's driving me nuts and I don't know if it's PHP or IIS:

I posted a message yesterday about what I thought was an ODBC connection
hang. We had the problem for several hours yesterday, but our host could
see no problems with our connection. (php3, odbc, ms sql 7)

Today, it was working for a while. In fact I used the form below to
populate the "people" table over 60 times. I had it freeze on one
person, but then work a few minutes later. I then had it freeze again
later on another person and that's when I noticed the strangeness in a
different light.

[As you can see the form uses PHP_SELF to reload so that it inserts the
SQL statement and then is ready for the next entry. When I say it
freezes, I hit submit, the form doesn't reload and the server dishes up
an empty html page.]

OK. I had it freeze while entering [Peta] [Wilson]
[http://www.digitalhit.com/petawilson.shtml] in the input boxes.
The form wouldn't reload. I tried again and again. Didn't work.

I entered another performer's name and URL. It worked. Tried Peta's info
again. No luck.

On a whim I entered [Peta] [Wilson]
[http://www.digitalhit.com/petawilsonblah.shtml] into the input boxes.
Adding the blah to the celebrityrowurl variable worked. I began to think
this wasn't a SQL problem.

I added the echo $step; $step++; to the code to see if I could see where
it failed. I entered another name and URL combo and received the 1 2 3 4
5 6 7 steps echo. I tried entering the original [Peta] [Wilson]
[http://www.digitalhit.com/petawilson.shtml] again.

Not one step number was printing, so the page was halting right after
the if ($REQUEST_METHOD == 'POST') {

Is there any way that PHP can be freezing on the POSTed variables? That
changing the variables being POSTed allows the process to continue but
trying the same variables again causes the freeze? And it's not these
specific variables. I might be able to go and submit Peta's info a few
hours from now without any problem.

Call me confused.

<head>
<title>Celebrity Row Inserter</title>
<?php
include('connect.inc')
?>
</head>
<body>
<h1>Digital Hit's Celebrity Row Inserter</h1>
<?php
if ($REQUEST_METHOD == 'POST')
{
$step="1";
echo $step;
$step++;
$celebrityrowurl = substr ("$celebrityrowurl",25);
echo $step;
$step++;
$sql="INSERT into people (firstname, lastname, celebrityrowurl) VALUES
('$firstname', '$lastname', '$celebrityrowurl')";
echo $step;
$step++;
$sql = str_replace("\'","''",$sql);
echo $step;
$step++;
$sql = stripslashes($sql);
echo $step;
$step++;
$result = odbc_exec($connect, $sql);
echo $step;
$step++;
@odbc_close($connect);
echo $step;
$step++;
}

?>
<form action="<?php ECHO $PHP_SELF ; ?>" method="POST"><br />
<b>First Name:</b><input type="text" name="firstname" size="15"
maxlength="30" value="" />
<b>Last Name:</b><input type="text" name="lastname" size="15"
maxlength="30" value="" /><br />
<b>Celebrity Row URL:</b><br />
<input type="text"
name="celebrityrowurl" size="100" maxlength="200"
value="" /><br />
<input type="SUBMIT" value="Insert Data" /><input type="RESET"
value="Reset" /><br />
</form>

[p.s. don't fret over the $sql = str_replace("\'","''",$sql); $sql =
stripslashes($sql); lines. It's a weird workaround caused by ms sql and
the way our host has the shared php.ini set. It works.]

Anon

Just because "not one step number was printing" is not confirmation that those statements never executed. Each time, you are only echoing one character which may not be enough to flush the buffer if your program is hanging somewhere further down the line.

Place the step markers inside html containers like:

<? print "<p>Step One</p>"; ?>

Then put a flush after each one so it sends it to the browser straight away:

<? flush(); ?>

This will give you a more accurate view as to where your program hangs.

-- Rich Rijnders
-- Irvine, CA U.S.

Anon

Richard A. Rijnders wrote:

This will give you a more accurate view as to where your program hangs.

Well I did that (thanks) and the problem is still a real bang-head-on-desk. Here's the new code so you can see the step numbers and then my comments after:

<h1>Digital Hit's Celebrity Row Inserter</h1>
<?php
print "<p>Step One</p>";
flush();

if ($REQUEST_METHOD == 'POST')
{
print "<p>Step 2</p>";
flush();

$celebrityrowurl = substr ("$celebrityrowurl",25);
print "<p>Step 3</p>";
flush();

$sql="INSERT into people (firstname, lastname, celebrityrowurl) VALUES ('$firstname', '$lastname', '$celebrityrowurl')";
echo $sql;
print "<p>Step 4</p>";
flush();

$sql = str_replace("\'","''",$sql);
print "<p>Step 5</p>";
flush();
echo $sql;
$sql = stripslashes($sql);
print "<p>Step 6</p>";
flush();
echo $sql;
$result = odbc_exec($connect, $sql);
print "<p>Step 7</p>";
flush();

@odbc_close($connect);
print "<p>Step 8</p>";
flush();

}

?>

Tried the code just now. Tried the name that was tripping me up.

Peta Wilson http://www.digitalhit.com/petawilson.shtml

It stopped after displaying step 4. Which is right before:

$sql = str_replace("\'","''",$sql);

I entered a fake entry Bob Smith http://www.digitalhit.com/bobsmith.shtml and it worked. Entering a name shorter gets entered. Longer gets entered. Same length, different letters, hangs. I changed her first name to "petar" and it entered.

What on Earth could be causing it to hang on that length? I have another script we use to post news articles. Many more fields, long textarea entries. It'll do the same thing. It'll sometimes refuse to submit an article. I can write another article (shorter/longer) and it'll get posted. Try to repost the one that froze and it won't.

I'm getting a major bruise here from the head banging.

Thanks for any insight.

Anon

Since you are replacing escaped single quotes with double-single quotes and later running stripslashes(), I am guessing that your server has "magic-quotes" turned on. That's ok as far as your incoming variables are concerned, but...

You are substringing your $celebrityrowurl prior to removing any escapes (slashes) that were put in by magic-quotes. This means that you could potentially be breaking up an escape sequence (ie a slash+quote combination will end up just being the quote). You should run stripslashes() over all the incoming variables before you start manipulating or converting them.
I don't know why, but your substring is only taking the end of the $celebrityrowurl variable; everything from the 25th position to the end. If you want the first 25 characters of the variable use "substr($celebrityrowurl,0,25)"
I have never heard of the str_replace() function (not php?). If it is an in house function you use, then I assume it is using eregi_replace() to perform the substitution. This being the case, passing it \' would be equvalent to passing it a singe quote since you are just escaping the single quote. This might be why your program hangs there; it is trying to replace every single quote with two single quotes (including the single quotes around each variable!). Since the eregi_replace() function is greedy, it may loop until it stacks out. If you really want it to only replace actual escaped-single-quote sequences with two single quotes, then I think you should be passing it \' instead of \'
You are running stripslashes() and your str_replace() function over the entire concatenated $sql variable. You should probably apply stripslashes() to the variables before manipulating them, then use addslashes on each variable when you are done, then run your string replacement on each variable to replace escaped single quotes with two single quotes, then concatenate your $sql string.

-- Any one or any combinations of these could be causing the problem you are seeing. I would address each of the issues one at a time so you can see what difference they make, but you should eventually address all of them to avoid future problems.

-- Hope This Helps.

-- Rich Rijnders
-- Irvine, CA US

Anon

Since you are replacing escaped single quotes with double-single quotes and later running stripslashes(), I am guessing that your server has "magic-quotes" turned on.

Yep, the way our host has the shared php.ini set up the single quotes get turned into \' which the SQL Server 7 won't accept. So we have to change those to ''.

I don't know why, but your substring is only taking the end of the $celebrityrowurl variable; everything from the 25th position to the end.

The entry form accepts the full URL to our profile pages. The substring gets rid of the http://www.digitalhit.com part.

I have never heard of the str_replace() function (not php?).

Yep, it's PHP. http://php.net/manual/function.str-replace.php

What's truly confusing me is why that one combo is tripping it up. I just tried commenting out the stripslashes (actually a holdover for an article form that needs to handle html href's to pages in the articles) and it still tripped. But just for Peta Wilson http://www.digitalhit.com/petawilson.shtml or a name that exact length. Shorter or longer and it works.

Very confusing. Thanks for all your help.

Anon

That's interesting; the function does not appear in the manual on this site.

It still looks like you should be using \' instead of \' though...