firewalls and form submission

robinjohn

Hi everyone, is there any issues about the values of form elements getting through firewalls?

I say this because I wrote up this page with a form on it, a large number of form elements whose values eventually make up a SQL insert query.

The confuing thing about it all is that it seems very temperamental, I'm not recieving any MySQL error messages, the values are passed to the relevant PHP page but the query doesn't seem to be evaluated...though if it didn't it should throw error messages....

Confused as hell, oh well there goes the weekend /o:
I'll bet it's one of those lousy mionr errors that are easily overlooked.

Any ideas?
Rob.

rebelo

I cannot think of any reason that a firewall would cause problems. If the user is viewing the site and submitting the form, etc, then there shouldn't be any issues related to that. When you say there are no mysql errors, have you used the mysql_error function to make sure? ( http://www.php.net/mysql_error ). Also, you might try echoing the query that is being passed to mysql to the page so that you can see exactly what's making it through. Maybe it's not being formed correctly due to missing variables or something??

If you can show the code, that would make it easier to tell what's wrong..

diego25

Also, have print statements in your code, like

print 1;

// code

print 2;

So that you can now where your script gets to and where it fails.

Diego

planetsim

Firewalls. Hmm ive actually heard of this Happening before, I forgot what firewall it was.

Anyway it affected the SuperGlobals. So $POST, $GET etc.
Now if i find it i might be able to help you fix this problem.

robinjohn

Hi everyone,
well the code involved is literally a massive sql insert statement - it's quite a large table - what gets me is that it works perfectly from home when I test it out with values that I'm told will not go through from work. I just can't understand it.

The way it works is that there's some initial Javascript, to make sure that the form elements are filled correctly on the client-side, then the values of the form are simply submitted to another PHP page where the POST values are used as the components of the query.
I'm using mysql_error...or at least I'm doing this :

if (!mysql_query($query)){
echo "something wrong " . mysql_error();
}

and, well, so far no errors to report at all. I'm beginning to think my boss is winding me up as he seems to be the only one that has come across this problem...and it's not even April yet!

A promising possibility is something to do with the superglobals, as mentioned by planetsim. Every test I put the script through seems to work on my own localhost, I'll let everyone know what I find - if anything! Thanks (o:

Duey

you may need a mysql parser or something. i use the one from phpbb ill attach a file with a simple installer that uses the sql parser 🙂 you will need to edit install.php with your db vars etc. place your querys in SQL/schemas.sql
hope it works for ya

Weedpacket

Try chucking a few var_dump() calls in here and there - see what variables have which values when. In fact, go the whole hog and var_dump(get_defined_vars()) at the start and see exactly what the script has to work with when it starts. If the form values are getting to the script then it can't be a firewall thing, 'cos they're already through the firewall by that stage (unless a firewall has to be traversed to get to the database...?)

Oo, here's a thought - it's not a difference between your browser and your boss's that's stopping him? Browser-specific implementations of Javascript? Javascript not enabled? The first sounds pretty unlikely for a form-validation script, I admit, but hey....

And I'd be interested if you can find what you read about firewalls and superglobals, planetsim - it sounds like the sort of server bug that one needs to be aware of. Heh, just writing that I seem to recall that Microsoft's Personal Web Server is hopeless when handling form submissions. But I'm pretty sure we're talking about a real server in this case...

Duey

what version of php does your work have? maybe its old and doesnt have $POST etc. in there 🙂 try using $HTTP*_VARS etc.

robinjohn

Wow, thanks so much for the replies - they give me hope a solution can be found! I'll have to wait 'tll Monday before I get a chance to return to the office and try these solutions at their source though - until then I can't be 100% sure that the tests I run at home correspond exactly to the issues at work - my setup at home is not an exact clone of the server over there )o:

Regarding the differences between browsers? I can't rule it out, yet. I don't know which version he has so indeed it could very easily be a javascript fault of some kind. I did send him an email asking him that very question, however I've heard no reply yet.

The server we use is Apache 1.3.7, haven't moved to Apache 2 yet, the version of PHP is 4.3.0 so there should be no out of date issues related to scripting...I think

So, I guess I'll keep going, reading and drinking a lot of tea, somewhere between the computer and the kettle a solution will no doubt be found (o:

var_dump(get_defined_vars())? You know I never even knew of this functions' existance? This site is just so great. More time at the manual I think.

Thanks again everyone, I'll give the mysql parser a lash, any new ideas are better than ruminating over the same old evaluated ones. Like I said, I won't be able to know for definite whether the issues I come up with at home are identical to the office but what the heck eh?

Duey

i beleive 4.3 removes the HTTPVARS functions and replaces them with $_ functions