Going nuts! Need help

filch

Hi all,

I am working on a simple PHP database program with MySQL in order to learn PHP. I have a script that reads the DB and lists the records with two links. One to edit the record and one to delete the record. This all works fine. The DB structure is id, slug, content, contact, timestamp. The idea is that when you click on the delete link, it calls another page and in the older style of doing things, we would have passed the record id in the url to the second script and theoretically, all would have been fine. Now with the newer style with the register_global=off, I cannot figure out how to pass this value on to the next script and have it persist. I have used the following:

<?php

if (mysql_num_rows($result) > 0)
{
// iterate through resultset
// print title with links to edit and delete scripts
while($row = mysql_fetch_object($result))
{
?>
<? echo $row->slug; ?> [<? echo
formatDate($row->timestamp); ?>]

<font size="-2"><a href="faq_edit.php">edit</a> | <a
 href="faq_delete.php?id=<?php (int)$_GET['id']; ?>">delete</a></font>

//originally here in the old style, we used <a
href="faq_delete.php?id=<?php echo $row->id; ?>">delete</a> but with the register_globals=off, this no longer works............................

<p>
<?
}

}
// if no records present
// display message
else
{
?>
No FAQ's currently available

I have tried using the new super globals and I think this is what I have to do but I am not sure. It is either that or combine all of the scripts into one?

Please help if you can.

filch

intenz

Try...

<?
if(mysql_num_rows($result) > 0)
{ 
	while($row = mysql_fetch_assoc($result)) 
	{ 
?> 
		<font size="-1"><b><?=$row['slug']?></b> [<?=formatDate($row['timestamp'])?>]</font>
		<br> 
		<font size="-2"><a href="faq_edit.php?id=<?=$row['id']?>">edit</a> | <a href="faq_delete.php?id=<?=$row['id']?>">delete</a></font> 
		<p> 
<? 
	}
}
else
{ 
?> 
	<font size="-1">No FAQ's currently available</font><p>
<?
}
?>

Then in faq_edit.php and faq_delete.php you use $_GET['id']
Good luck!

filch

intenz,

Thanks for the input. This does work. However, I am wondering. Can you explain to me why this is secure as the id still shows up in the url. My assumption is that it is because if someone decided to modify the url to delete some other record with a different id, the script would not work because the id would not not part of the new arrays (super globals) so therefore would not come from anywhere but outside. Is what I am doing now the proper secure way to do this? Any insight to this would again be very much appreciated.

How are things in Iceland anyway????

filch

adamgeorge

well, you would need to write some sort of function to authenticate the user.

I.e. write a function that requires an administrator to log in. Once they have logged in, store their userid and password (encrypted) in a cookie.

then when performing operations like delete, call your authenticate function to authenticate the current user using the user id and password stored in the cookie:

<?
function is_admin($user){
$sql = "select userstatus from user where userid = $user['id'] and password = $user['password']";

...

if($result['userstatus'] == "administrator")
return true;
else
return false;

}

if(is_admin($user)){
$sql = "delete from ...";
...

}
?>

how you do this is up to you. There's tutorials on this site on how to authenticate users. I myself read through the source code to PHP nuke (a php forum script freely available) and learned about authenticating users that way.

Just find some examples and try and learn how to go about it for your website.

-Adam 🙂

filch

intenz.

In your suggestions to me, which helped me alot thankyou, you used mysql_fetch_assoc($result) as opposed to mysql_fetch_object($result). You also used <?=$row['slug'] ?> as opposed to <? echo $row->slug; ?>. What is going on here that make these two different? You cannot seem to mix these two formats.

Many thanks

filch

adamgeorge

mysql_fetch_assoc returns the result in a associative array. so to access the data you have to provide a key to the array Ie $row['slug'] , where 'slug' is the name or alias of one of the fields you selected in your query.

read about it here

mysql_fetch_object returns the result as an object. If you've ever done OO php programming, you'll know that's how you access methods and stuff in php: $row->slug

read about it here

Use whichever one you want. I'm not sure what the greater advantages or disadvantages of each are, but personally I'd rather use mysql_fetch_assoc . (Just used to it)

hope that helps,
-Adam 🙂

filch

Oh yeah ... now I see. Must have been too tired last night. I used to do a lot of lingo programming and used a lot of similar objects with that, Just never made the connection last night.

Thanks for the reply.

Cheer,

fiilch

intenz

Everything in Iceland is doing very well.
It's getting a little chilly here but despite that, everything's great. 😉