Strange PHP/MYSQL firefox BUG

lucky-8

hey guys,

i have writen some php scripts for a website which transacts with mysql database..... now i have used classes, lets say i defined all basic repetitive methods like connect, select db, and stuff like that in a file called mysql.php and i have written it as a class.

Now when i define an object for it in my script like the followiing:

<?php
//form elements from previous page
$name=$POST['name'];
$address=$POST['address'];
$zip=$_POST['zip'];

$obj=new db();

$obj-> connect("root","","scp");//the problem occurs in this line

$query="insert into client_info values(null,'$name','$address','$phone','$zip','$login_name_email','$pwd',0,now())";
$result=$obj->query($query);

this works absolutely fine in IE, but in firefox it just prints the code as it is starting from connect all the way to the end of the script and doesnot even make a connection with my DB. This to me seems very strange because the browser, acc wat i though never sees php code coz it cannot ready php.... my server is supposed to be rendering the browser only with Html code and formats which my browser can understand............

I hope i have explaiined wats rong clearly..... some pointer of assistance will be very helpful.........

thanx guys
cheers
Lucky

Piranha

First a question: What evidence do you have that it is a bug with PHP/MYSQL and firefox as you say in the headline? Lots of people have probably got this to work, so it could not be a bug.

I can't say what is causing your problem, but I can say that it have got nothing to do with firefox, PHP or MYSQL. It have to do with your code. I think it might be the space you have in the row where the problem occurs, but again I'm not sure.

A tip when you see something strange is to look at the code from the web page, and not on the page itself. Often you can find things there that you can't see on the page itself.

What you should think about is to avoid sql injection. Your code is vunrable to it as it is now, and it could make it possible for people to see things from your database they should not have access to or even change or delete from it.

troybtj

Can you post both the file you are using for connect (The one with db class) and then the file you have the snippet of above?

Use {php}...{/php} tags around each code block, it does syntax highlighting and makes it much easier to read. (replace }{ with ][ )

halojoy

$obj=new db();
$obj-> connect("root","","scp");//the problem occurs in this line

So, what does the PHP error_reporting say?
Because I assume you have turned on full DEBUG notices using
function [man]error_reporting[/man]

Other, I should have a look into 'Class db()'
if there is such a function connect()

🙂

lucky-8

Firstly thanx for the apt response,
Alrite wat leads me to think its a fire fox bug is the same piece of code works absolutely fine with Internet explorer. Yes i did open up the code from the browser, but woz wondering how does my browser know the php code, coz the browser doesnt understand it, the webserver is supposed to be rendering it with html or other formats which the browser can understand..... but anyways i did see the code from the browser and i could not figure out anything wrong.......

Could u please throw some more light on how i could avoid sql injection and make it more secure..... thanx

lucky-8

halojoy wrote:
$obj=new db();
$obj-> connect("root","","scp");//the problem occurs in this line
So, what does the PHP error_reporting say?
Because I assume you have turned on full DEBUG notices using
function [man]error_reporting[/man]

Other, I should have a look into 'Class db()'
if there is such a function connect()

🙂

My php does not report any error...........as i said it works perfectly fine with internet explorer.... the problem turns up only in firefox......
thx

halojoy

lucky-8 wrote:
Firstly thanx for the apt response,
Alrite wat leads me to think its a fire fox bug is the same piece of code works absolutely fine with Internet explorer. Yes i did open up the code from the browser, but woz wondering how does my browser know the php code, coz the browser doesnt understand it, the webserver is supposed to be rendering it with html or other formats which the browser can understand..... but anyways i did see the code from the browser and i could not figure out anything wrong.......

Could u please throw some more light on how i could avoid sql injection and make it more secure..... thanx

You get it working in IE
but Firefox just shows 'plain text' = the php code.

Sounds like some setting in Firefox, to serve .php extension as text.
I am not sure this can be fixed in Tools->Options->Content
File types, Configure how Firefox handles certain types of files

When code works in one browser and not in another, and these browsers are IE and Firefox
it is really not easy to say what is a matter.

lucky-8

halojoy wrote:
You get it working in IE
but Firefox just shows 'plain text' = the php code.

Sounds like some setting in Firefox, to serve .php extension as text.
I am not sure this can be fixed in Tools->Options->Content
File types, Configure how Firefox handles certain types of files

When code works in one browser and not in another, and these browsers are IE and Firefox
it is really not easy to say what is a matter.

I did check the setting in firefox but the php extension doesnt even figure in there..... im not sure if this could be causing the problem coz firefox has a pretty good market share and shuld be able to load such scripts as i have visited lotta websites which had php scripts in them and they worked fine in firefox..... but if there is some way i could get to change settings in the firefox browser, as it does not give me an option or something like that to load in another extension......

scrupul0us

halojoy wrote:
Sounds like some setting in Firefox, to serve .php extension as text.

the server renders the PHP... the browser just interprets what the server sends

if everything works in IE but things are wrong in FF then i'd start with FF

any plugins installed?
what version FF?
have you checked KB articles that might indicate similar problems?

when you view source on the page what do you get?
are you sending any headers?

let us see your mysql.php object class

halojoy

scrupul0us wrote:
if everything works in IE but things are wrong in FF then i'd start with FF

any plugins installed?
what version FF?
have you checked KB articles that might indicate similar problems?

when you view source on the page what do you get?
are you sending any headers?

let us see your mysql.php object class

the server renders the PHP...
the browser just interprets what the server sends
Yes, you are right. I was wrong 🙂

bradgrafelman

When you're viewing the script in IE and FireFox, you are actually using a webserver, right? In other words, you're typing in something like http://localhost/your_script.php and not just attempting to open the .php file with FireFox or IE?

scrupul0us

bradgrafelman wrote:
When you're viewing the script in IE and FireFox, you are actually using a webserver, right? In other words, you're typing in something like http://localhost/your_script.php and not just attempting to open the .php file with FireFox or IE?

i had to laugh b/c ive done this... my first bout with ajax all i returned was unprocessed php code 😉

Piranha

lucky-8 wrote:
Could u please throw some more light on how i could avoid sql injection and make it more secure..... thanx

Sure

bradgrafelman

Also see the manual page for [man]mysql_real_escape_string/man - this should be used on all user-supplied data used in a SQL query.