Anybody run into problems upgrading?

[hrhenry]

Sorry for the possibly misleading subject. The complete question is ¨Anybody run into problems upgrading apache/php?
Here's my problem:

I run several glossary databases using apache/php/postgresql. My queries worked fine with apache 1.3/php4/postgres7.2, but since I upgraded apache to 2.0 my queries return the entire table, instead of select results.
Here is the code used (easy on me... I'm not a coder. I know it's messy :-))

<?
$db = pg_connect("dbname=glossary user=nobody");
$search_query = "SELECT frase, phrase FROM glossary";
if (($frase != "") && ($phrase == "")) {
$search_query .= " WHERE frase ~ '$frase'\;";
}
if (($frase == "") && ($phrase != "")) {
$search_query .= " WHERE phrase ~ '$phrase'\;";
}
if (($frase != "") && ($phrase != "")) {
$search_query .= " WHERE frase ~ '$frase' AND phrase ~ '$phrase'\;";
}
$result = pg_exec($db,$search_query);
...
etc.

I tried playing around with ¨elseif¨ on the second and ¨else¨ on the last if statement, but no luck (in fact, I get an error using ¨else¨ as the last).
No matter what I've tried, I get the entire table returned. This must be something simple, yet I don't really understand why in one version it would work and in another it wouldn't.

Thanks for any help/info.

R.

[Sxooter]

check for global variables being turned off, and either turn them on (not recommended due to security issues (that said, I use global vars... 🙂)) or use the $_POST[] array to get your var.

[LordShryku]

check for global variables being turned off, and either turn them on (not recommended due to security issues (that said, I use global vars... )) or use the $_POST[] array to get your var.

Mental note: hack Sxooters sites....

[Sxooter]

Originally posted by LordShryku
Mental note: hack Sxooters sites....

Sorry, Sxooter's not stupid enough to write code like:

if (someting) $admin="true";

....

if ($admin){
do something.
}

If you can't write safe code with global vars on, you likely can't write it with it off either. 🙂

[LordShryku]

damn

:p

[Sxooter]

But seriously folks, (ba dump dump...)

I'd say it's more important to have magic quoting turned on than global vars turned off in terms of keeping newbies from writing dangerous code. You don't know how many times I've looked at code that was ripe for SQL insertion hacking...

[LordShryku]

Agreed. You'll be bummin pretty bad after a little SQL Injection wipes out a million rows or so of your data. Of course, this really should probably be in another thread. It also brings up the need to back up your code and data on a regular basis.

[hrhenry]

Thanks for your reply. I took a look at the differences between my old php.ini file and the new. There were a few.
Again, thanks.

R.

[kenhess]

if you want to leave register_globals=Off
then you can put:

extract($HTTP_POST_VARS);

at the beginning of your current pages and they will act as if register_globals=On.

At least it worked for me on a Solaris 8 Server with the newest versions of MySQL, PHP, and Apache.