newbie question about global

jshea

I am building a basic shopping cart while trying not to utilize MySQL for the time being.

Therefore, I am passing variables along via post from the different stages of the checkout process.

My problem is that I've quickly integrated an open-source "fedex rate request" class and haven't learned enough about classes yet to know how to pass (extra?) variables through.

Hence, I cannot access other (not fedex related) POST variables after requesting the output of the fedex class.

So, as a quick fix, I have made many (close to all) of the variables in the script "global".

The script is working properly thus far, however it's got "WRONG" written all over it.

My concerns:

Could two or more simultaneous users change the values in their checkout? (Are global variable values stored via sessions or something?)

Are there any security issues?

Please excuse my ignorance.

superwormy

All variables are per script execution, ie multiple users cannot access each others variables.

We havn't seen your script, so I have no idea if there are security issues.

In general, its aweful for code to have a ton of global varialbes, just makes things confusing.

I see no reason why a Fedex class should be destroying POST variables... if I found a class that did that... I wouldnt' use it.

jshea

Thanks for the tips superwormy.

I've made things a bit more complicated than they need to be with my script, however, I will try to explain:

order.php is a sort of "container" for all the parts of the sript.

All forms reside in order.php and POST to it as well.

fedex.php (class) is include()d when the third part of the checkout process is POSTed. (the fedex servers are communicated via curl)

The following is a copy of the fedex class. I could not get it to return $fedprice[1416] (commented out at the bottom), therefore I include()d my own page (fedextra.php) within the class, and retrieved necessary variables from there:

//////////////////////////////////////////////////////////////////////////////

<?
/-------------------------------------------------------------------------------------
fedex_class.php version 1.0

Copyright (c) 1999-2002 Koen Bok
Email: koen@mac.com
Website: http://www.koen.nu/scripts/phpfedex/
Licensed under the GNU GPL. For full terms see http://www.gnu.org/licenses/gpl.html.
-------------------------------------------------------------------------------------
*/

class fedex
{

YOU MAY WISH TO SET THESE STATICLY

// URL to send request to
var $postServ        ='https://gateway.fedex.com';
var $postHost        ='fedex.com';

var $companyName    ='Engrave-a-remembrance';
var $accountNumber    ='259302900';
var $shipperNumber    ='1532317';


// Transaction Info

// Shipper Info
var $shipperCountryID     = 'US';

// Destination info
var $destZip             = '32817';
var $destCountryID         = 'US';

// Package info
var $packWeight         = '14.1';
var $packWeightUnit     = 'LBS';
var $packTotal             = '1';

// Payment info
var $payValue             = '0.00';
var $payValueCur         = 'USD';
var $payType            = 'CC';

// Service Info
var $packageType         = '01';
var $rateIndicator				='2';
var $homeDeliveryType			='1';



##########################################################################

function BuildQuery()
{
$this->query_array = array(    
    0 =>     "025",                    // r Start transaction
    498 =>   $this->shipperNumber,    // r Shipper Meter Number
    3025 =>  $this->carrierCode,     // r Carrier Code
    9 =>     $this->shipperZip,         // r Shipper Zip Code
    8 =>     $this->shipperState,     // r Shipper State
    10 =>    $this->accountNumber,    // r FedEx Account Number
    16 =>    $this->destStateAbb,     // r Destination state abbreviation
    17 =>    $this->destZip,         // r Destination Zip Code
    50 =>    $this->destCountryID,     // r Destination Country Code
    117 =>   $this->shipperCountryID,// r Shipper Country Code
    1401 =>  $this->packWeight,        // r Total Package Weight
    75 =>    $this->packWeightUnit,    // r Weight Units
    23 =>    $this->payType,            // o Pay Type (Default: Bill Sender)
    24 =>    $this->transactionDate,    // o Shipping Date (Default: Today)
    116 =>   $this->packTotal,        // o Package Total Count
    1415 =>  $this->payValue,        // r Carriage Value
    68 =>    $this->payValueCur,        // r Value Type
    1273 =>  $this->packageType,        // r Packaging Type
    1274 =>  $this->serviceType,        // r Service Type
    1529 =>  $this->rateIndicator,			//
    440 =>   $this->residentialDelivery,			//
    3020 =>  $this->homeDeliveryType,			//
    99 =>     ""                        // r Ending Tag, required for every transaction.
);

    foreach ($this->query_array as $key => $val)
    {
        $this->query .= "$key,\"$val\"";
    }

    // Debug information
    $this->debug[] = array("Generated Query",$this->query);

}
##########################################################################    
function Post()
{

    // Init the Curl engine.
    $this->ch = curl_init ();

    // Set curl options
    curl_setopt ($this->ch, CURLOPT_URL,"$this->postServ");             // set the post-to url (do not include the ?query+string here!)
    curl_setopt ($this->ch, CURLOPT_HEADER, 1);                         // Header control
    curl_setopt ($this->ch, CURLOPT_POST, 1);                              // tell it to make a POST, not a GET
    curl_setopt ($this->ch, CURLOPT_POSTFIELDS, "");                      // put the query string here starting with "?"
    curl_setopt ($this->ch, CURLOPT_RETURNTRANSFER, 1);                 // This allows the output to be set into a variable $xyz

    $len = strlen($this->query);
    $custom_header = "POST /GatewayDC HTTP/1.0\nReferer: $this->companyName\nHost: $this->postHost\r\nAccept: image/gif, image/jpeg, image/pjpeg, text/plain, text/html, */*\nContent-Type: image/gif\nContent-length: $len\n\n$this->query";
    curl_setopt ($this->ch, CURLOPT_CUSTOMREQUEST, $custom_header);

    // Get the results
    $this->result = curl_exec ($this->ch);

    $this->err_nr = curl_errno($this->ch);

    // Close the connection
    curl_close ($this->ch);

    // Debug information
    $this->debug[] = array("Query Result",$this->result);
    $this->debug[] = array("Query Error",$this->err_nr);

}
##########################################################################
function ParseReply()
{

    preg_match_all ('/([0-9]+),"([^"]*)"/' ,$this->result ,$this->result_tmp ); 

    $n = "0";

    foreach ($this->result_tmp[1] as $val)
    {
        $this->result_array[$val] = $this->result_tmp[2][$n];
        $n++;
    }

// THIS IS IT, BELIEVE IT OR NOT, THE PLACE THAT IM SPITTING OUT THE RESULT. //
// IT IS A WORK AROUND, AND WILL PROBABLY NOT WORK IF FEDEX REARRANGES THEIR CODE. //
// I AM ADDING MY CODE FOR ENGRAVE'S SHIPPING/HANDLING COSTS HERE //
include ("fedextra.php");
// Debug information
$this->debug[] = array("Result Array",$this->result_tmp);
$this->debug[] = array("Clean Result Array",$this->result_array);

}
##########################################    function Go()
{
    $this->BuildQuery();
    $this->Post();
    $this->ParseReply();

    return $this->result_array;
}    
##########################################    function Debug()
{
    print "<table border=1>";
    foreach ($this->debug as $val)
    {
        print "<tr><td nowrap><b>$val[0]</b></td><td><pre>";
        print_r($val[1]);
        print "</pre></td></tr>";
    }
    print "</table>";
}

}

//* Usage Example

// Let's create a new object
$fedex = new fedex;

if ($method=="92"){
$gnd_or_express="FDXG";
}else{
$gnd_or_express="FDXE";
}

// Pass the object some required variables
$fedex->destZip = $shipzip;
$fedex->shipperZip = $shipperZip;
$fedex->serviceType = $method;
$fedex->carrierCode = $gnd_or_express;
$fedex->rushdelivery = $rush_delivery;
$fedex->homeDeliv = "2";
$fedex->packService = $gnd_or_express;
$fedex->residentialDelivery =$residentialDelivery;
$fedex->home_extra = $home_extra;

$fed_counter=1;
while ($fed_counter<=$qty){
$fedex->$ThirdLineglass[$fed_counter] = $ThirdLineglass[$fed_counter];
$fed_counter++;
}

// And execute the queries
$fedprice = $fedex->Go();

// THIS DOES NOT WORK //
// Field 1416 contains the base rate price
//echo $fedprice[1416];

// This is for optional debugging
$fedex->Debug();

///////////////////////////////////////////////////////////////////////////

And here is fedextra.php:

<?
include ("includes/config.php");

$base_fedex_GND=$this->result_tmp[2][8]; // GROUND SERVICE
$base_fedex_EXP=$this->result_tmp[2][15]; //Fedex Express Service

if ($gnd_or_express=="FDXG"){
$display_rate=$base_fedex_GND;
}else
if ($gnd_or_express=="FDXE"){
$display_rate=$base_fedex_EXP;
}

if ($residentialDelivery=="Y"){
$total_shipping=$display_rate+$signature_fee+$padding+$rushfee+$home_extra;
} else
if ($residentialDelivery=="N"){
$total_shipping=$display_rate+$padding+$rushfee;

}
//echo $method . " ";

//echo "Baserate: " . $display_rate . " ";
//echo "Sig Fee: " . $signature_fee . " ";
//echo "Padding: " . $padding . " ";
$s_h=$display_rate+$signature_fee+$padding;
echo "$" . $s_h . " ";

if ($residentialDelivery=="Y"){
echo "$" . $home_extra . " ";
}else if ($residentialDelivery=="N"){
}

if ($rushfee>0){
echo "$" . $rushfee . " ";
}else{
echo "  ";
}

echo "$" . $total_shipping . " ";
?>

//////////////////////////////////////////////////////////////////////

cont'd, see next message ->

jshea

order.php also require()s config.php where I have sloppily set global variables just to get the thing to work quickly:

config.php:

<?php

$maxlength=30; // MAXIMUM LENGTH OF TEXT BOXES FOR LINES OF ENGRAVING //
$rate='0.35'; // COST PER EXTRA CHARACTER //
$rateG='0.35'; // COST PER EXTRA CHARACTER ON GLASSES //
$charge_for_spaces="yes"; // CHARGE FOR SPACES IN TEXT OPTIONS ARE "yes" AND "no" //

// ERROR MESSAGE FOR NOT MAKING A SELECTION OR CHOOSING A QUANTITY //
$no_select_err_message=" <center>Sorry, there has been an error. Please go <a href='javascript:history.back()'>BACK</a> to make a selection and choose a quantity.</center>";

// SHIPPING OPTIONS
// MAKING THESE VARIABLE GLOBAL, ALLOWS THEM TO BE ACCESSES VIA fedex.php
global $shipperZip;
global $rushfee; // MAKING THIS VARIABLE "GLOBAL" MAKES IT POSSIBLE TO CARRY IT THROUGH THE CLASS IN fedex.php AND THEN USE IT IN fedextra.php
global $gtotal; // MAKING THIS VARIABLE "GLOBAL" MAKES IT POSSIBLE TO CARRY IT THROUGH THE CLASS IN fedex.php AND THEN USE IT IN fedextra.php
global $method;
global $gnd_or_express;
global $signature_fee;
global $padding;
global $residentialDelivery;
// FEDEX HOME DELIVERY OPTIONS//
global $datecertain;
global $evening;
global $appointment;
global $home_extra;
global $total_shipping;

$carrier="fedex"; // SHIPPING CARRIER OPTIONS ARE "ups" AND "fedex" //
$shipperZip="48088"; // ZIP CODE THAT PACKAGE WILL BE SENT FROM //
$signature_fee="2.00"; // HIDDEN AND SET VARIABLE - FEDEX HOME DELIVERY (ONLY) SIGNATURE FEE. MAY NEED TO EXPAND FOR BUSINESS //
$padding="2.50"; // HIDDEN AND SET VARIABL - HANDLING
$rush_fee="7.50"; // RUSH FEE ONLY APPLIED IF CUSTOMER CHOOSES
$datecertain="3.00";
$evening="7.00";
$appointment="15.00";

//////////////////////////////////////////////////////////////////

Is it possible that the "depth" of the includes is a problem?

order.php
- fedex.php
- fedextra.php
order.php

I think my next step will be to go back and try to get the original code to work. (http://www.koen.nu/scripts/phpfedex/)

Thanks again for your input!