Not sure how to start.

Whyme

I hope to sell an application on the internet using automated serial number generation and checking. I need to produce PHP scripts that will save data from a form I'll produce using Publisher 98 into some sort of file, maybe a CSV format file, just to keep it simple. I need to generate a serial number once they click "enter" and store it in the same user information file. In addition, I need to send the user, somehow, the serial number (an e-mail is the usual means in my experience). I know MySQL is out there, but it seems extremely intimidating right now. I've never set up a database or used one in the past. At the same time, I am aware of the security issue with a CSV file. I also need to get the file backed-up periodically, so it goes to an e-mail address of my choosing.

I know nothing about PHP (not even how to trigger PHP scripts from within Publisher 98, which I think is only designed to accomodate HTML, but then, what do I know?) I really feel kind of foolish for even considering trying to use PHP based upon my lack of knowledge. Can anyone provide some means of developing what I'm after that won't be so time consuming that it becomes an alternate career? (I bought a PERL tutorial book, but it seems that PHP is the way to go by present standards based upon compactness of code.)

Thank you.

etully

Whyme: There's nothing to feel foolish about - you seem to be setting out to use the right tools for the job and you need some practice.

I suggest that you start out with some small projects and you give yourself lots of time to get this bigger project done. It's better to make mistakes on test files while you're learning than to make mistakes while you write a big project like this. Some mistakes will become so entrenched into the project that you'll either have to start over or... umm... you'll just have to start over.

Try making a web page with a form such that when you submit the form, the contents are mailed to you. Then try validating the contents of the form: See if you can make it so that people can't type "betty" as part of their email address. This will help you learn to prevent security problems. Then see if you can write a form, and write contents of the form to a MySQL database. Then learn about SQL injection. Next, try to build a web page that reads that MySQL database and displays the contents on screen. Once you can do those things, then it will be more clear about where you need to start to write your serial number generating project.

You will probably find that it's easier to test PHP pages hosted at a web hosting service than to test viewing them in MS Publisher.

Hexxx

etully wrote:
Then learn about SQL injection.

Hasn't the problem of SQL injection been fixed in the more recent versions of PHP? I think when I started reading PHP/SQL a couple months ago they were, so I didn't use escaping in my queries... I would have to go back and check that....

@: This might be a good quick start: http://php.about.com/od/finishedphp1/ss/address_book.htm

Actually read everything there on http://about.com about MySQL, they give you example and explainations but don't go into alot of dept. I have to make a final big project without any knowledge of PHP and SQL, but hey you always got to start learning something knew from somewhere!

etully

Hasn't the problem of SQL injection been fixed in the more recent versions of PHP?

Hexxx: I try to keep up with lots of different technologies so I don't always have the latest information about what PHP's security levels are but let me say this:

I don't think it has been fixed and I don't think that it can be fixed.
Even if it has been fixed, you don't know for certain that the code you write will always be run on newer versions of PHP

Imagine code that asked me my userid number so I type in 1234 and the PHP code builds a SQL statement like this:

delete from users where id=1234

If a clever hacker suspects that I am not checking my input, they might type their userid as this: 1234 or id < 10000

Now my SQL statement gets built like this:

delete from users where id=1234 or id < 10000

which means that it's going to delete every record under 10,000.

Maybe that's not actually the definition of SQL injection, maybe it's just bad PHP programming... but as far as I'm concerned, something was injected into my SQL statement. And it's something that can't be prevented by PHP - ever - and it's definitely something that Whyme needs to learn about so that he's not sitting around saying, "Ohhh, Why Me?!?!"

Hexxx

I looked back up in the php files and there are something in the PHP.ini called magic quotes that escape out something you enter like ' or ' , but I was also thinking that there won't be able to escape out words like delete and select etc. Anyway, incase WhyMe didn't find any good information there is some here what I use (all the time) http://www.tizag.com/mysqlTutorial

Whyme

Wow... I'm still trying to get that data from the HTML code!

The problem is this: I have Publisher 98, so it doesn't introduce additional expense to acquire. I can't produce web pages without it and its graphical interface. My research this afternoon suggests that I must embed PHP in HTML pages. This is contrary to the Publisher 98 graphical interface mode of function at the surface. Publisher will let me insert a button and apply either GET or POST methods to it, but apparently this is meant to work with CGI scripts, and I don't know how to get it to work with my AutoEmail.php (text) file. It says it can't find the page (AutoEmail.php). I don't know if this should work, or if I've just got some error in my path statement (which I did check in the address window of Internet Explorer, and it seems to be right). Is it the .php extension? Should I change it to some form of HTML "wrapper" and give it an html extension? (If so, how would I generate that "wrapper" - perhaps with just a few more lines in the text file?) I'm sorry to trouble you again (sincerely), but as you all seem to know, getting started is slow going. (I didn't choose the "Whyme" monicker without good reason...)

Thank you very much for any assistance.

etully

Whyme:

Do you have a copy of notepad? Do this:

open notepad
type the following:

<html>
<head><title>Why Me's Page</title></head>
<body>
<form action="page2.php" method="post">
First Name: <input type="text" name="first_name" size=20><br>
<input type="submit" value="Go">
</form>
</body>
</html>

Now save the file. Call it page1.php
Close that file and start a new file in notepad
Type the following:

<?php
$firstname = $_POST['first_name'];
print "Hello $firstname";
?>

Now save that file. Call it page2.php
Upload both of those files to the same directory on your web server
(If you don't know how to do that, get an FTP client and call your web hosting company for help. It's an important skill to have.)
Once they are both uploaded to your server, use your web browser to view the first file like this:

[url]http://www.your_domain_name_here.com/page1.php[/url]

Fill in your name and press the "Go" button. Study everything you have learned and memorize it. These are the absolute basics to writing PHP to do what you want.

ps. MS Publisher is not needed. By anyone. Ever.

Whyme

It was the web address. I fixed it and it ran the following code, that I found on the internet. It's supposed to send an e-mail with the 'Email' and 'Name' fields, or so I thought, but apparently someone wrote it to hijack your browser and send it to: http://www.YourDomain.com/thankyou.html. I checked my e-mail and received no message. It does catch when I don't fill in the "name" field. I suppose that's what I get for trusting internet tutorials. Is there a way to fix this so that it does send the e-mail?

<?php
$to = $REQUEST['Email'] ;
$from = $REQUEST['Email'] ;
$name = $_REQUEST['Name'] ;
$headers = "From: $from";
$subject = "Web Contact Data";

$fields = array();
$fields{"Name"} = "Name";
$fields{"Company"} = "Company";
$fields{"Email"} = "Email";
$fields{"Phone"} = "Phone";
$fields{"list"} = "Mailing List";
$fields{"Message"} = "Message";

$body = "We have received the following information:\n\n"; foreach($fields as $a => $b){ $body .= sprintf("%20s: %s\n",$b,$_REQUEST[$a]); }

$headers2 = "From: noreply@YourCompany.com";
$subject2 = "Thank you for contacting us";
$autoreply = "Thank you for contacting us. Somebody will get back to you as soon as possible, usualy within 48 hours. If you have any more questions, please consult our website at www.oursite.com";

if($from == '') {print "You have not entered an email, please go back and try again";}
else {
if($name == '') {print "You have not entered a name, please go back and try again";}
else {
$send = mail($to, $subject, $body, $headers);
$send2 = mail($from, $subject2, $autoreply, $headers2);
if($send)
{header( "Location: http://www.YourDomain.com/thankyou.html" );}
else
{print "We encountered an error sending your mail, please notify webmaster@YourCompany.com"; }
}
}
?>

etully

Whyme:

That script will work. You just need an HTML form pointing at the script
That script is very old and nobody uses it anymore because it has a major security flaw.
That script is not hijacking your browser. Redirecting to a "thank you" page is normal after the email is sent
In order to learn PHP, you have to read the code and determine what the commands are doing and why they are there. The script you posted works fine... except for that nasty security flaw I mentioned. (Bonus points if you can discover what the security flaw is).
I strongly suggest that you learn PHP a step at a time by typing small scripts and FTP'ing them to your web server instead of using Publisher to upload untrusted scripts that you find on the Internet/

Whyme

The subsequent PHP works up to a point, that point being actually sending an e-mail that I receive. A reference was made "pointing" an HTML form at at. Right now, I have a "submit" button on an HTML form. That button uses "POST" to initiate "AutoEmail.php", and it works up to a point, that point being where it actually e-mails the data. Is there a workaround for this that permits me to retain the "submit" button and external "AutoEmail.php" text file approach? I don't want to start mingling PHP in the HTML generated by Publisher because I very much want to keep my approach to changing the HTML forms and the "front end" apppearance as clean and efficient as possible by using Publisher for all such changes.

Is this a matter of needing an HTML form in some "E-mail" format that contains the information of the "array" and the "body"? Is it feasible to tack such a form onto (or into) the following code without linking it to the web sites main index?

As for security, I realize that the big bad wolf could easily visit my web site and use the input fields to write some nasty code into the PHP that could do a great deal of damage, but I need to get the basics working first, even with security issues. I can only hope to later learn the "magic words" or logical structures that keep the wolf at bay by checking the inputs. More fundamentally, at present, I want to find a way to integrate a Publisher development front end into the use of PHP, with only a few exceptions in terms of the HTML files, such as this e-mail page (or pages) that might have to be crow-barred into the PHP code below, if that is possible. One other consideration is how I then integrate this e-mail page (or pages) that the PHP code fills out into the "index" page for the web site, or do I not need to do that, because it can stand-alone as a dead-end form loaded in a separate browser window on top of the calling, indexed page? (I hope I'm making sense here, this is a brand new area to me.)

NOT eliminating Publisher is a high priority in terms of my web site development effort. A few, simple HTML code fragements to produce specialized pages that I can keep in text files in a special directory are not a big deal, particularly if I know how to intermingle PHP and HTML, I just don' t want to disrupt my ability to use Publisher to update or change pages later by directly inserting PHP into the HTML generated by Publisher. I want the PHP in separate text files.

The problem of intermingling PHP in HTML generated after a page has been designed in Publisher shouldn't arise if I'm only calling text files that lead to dead end pages, like an e-mail form, that are loaded in addition to the last form that is navigable from the index and controlled from a form that is navigable from the index. It seems I need to find a way to introduce creation of a web page on which the various defined fields and e-mail text body can appear, but I don't know how to do that from within php in a text file, unless I should simply alternate between php and HTML, but then I don't know how to generate the HTML without creating a form in Publisher, then generating the HTML, which is possible if I create fields with names corresponding to "body", "name", "e-mail", "subject", "header", but Publisher will then automatically link it to the index page (making it browsable by the user). (Note that it appears that I would need two pages, each sent via e-mail to two different people with different content, per the intent of the following code.) I would also need to call each of the two new pages up before filling in the fields and the body (or so it would seem).

Thank you in advance to anyone who can take a few minutes to answer these questions. This seems to be responding in a manner that does get data from the two fields ('Email' and 'Name').

<?php
$to = $REQUEST['Email'] ;
$from = $REQUEST['Email'] ;
$name = $_REQUEST['Name'] ;
$headers = "From: $from";
$subject = "Web Contact Data";

$fields = array();
$fields{"Name"} = "Name";
$fields{"Email"} = "Email";

$body = "We have received the following information:\n\n"; foreach($fields as $a => $b){ $body .= sprintf("%20s: %s\n",$b,$_REQUEST[$a]); }

if($name == '') {print "You have not entered a name, please go back and try again";}
else {
if($to == '') {print "You have not entered an Email, please go back and try again";}
else {
$send = mail($to, $subject, $body, $headers);
$send2 = mail($from, $subject2, $autoreply, $headers2);
if($send)
{header( "Location: http://freeprohost.com/testproject/page6.html" );}
else
{print "We encountered an error sending your mail, please notify webmaster@YourCompany.com"; }
}
}
?>

Whyme

Just checked with the site hosting service. They disabled PHP email services to prevent spam. Se la vie... (whatever that means...) I suppose I now need to get on with the data entry checking and the creation of the MySql database information, including that serial number that I ultimately need to send via...uh..yes...e-mail, or at least put on a web page for that user.