[RESOLVED] Stuck combining POST data with fgetcsv file data

[dmacman1962]

Hi everyone,

I am stuck trying to concatenate POST data with the data from a fgetcsv file for inserting into my table. If I do a straight import, it works fine. When I try to merge the two, I get a:
"Warning: fgetcsv() expects parameter 1 to be resource, boolean given"

...and it inserts the POST data and nothing from the csv.

The CSV is a single column of email addresses, and nothing else. The post data is simply 3 more data columns concatenated to that data.

This is a sample of what the 2 sets of data merged together would look like:

[e-mail] ---- 1 ---- 0 ---- 2008-09-03 08:06:02

Here is my code:

$Kickback = $_POST['Kickback'];
$Date = date("Y-m-d H:i:s");
$Processed = '0';

echo '<table border=0 cellpadding="0" cellspacing="0" width="600">';

$handle = fopen($Filename, "r");
while (($data = fgetcsv($handle, 1000, ",")) !== FALSE) {
    $num = count($data);
    $t++;

$sql ="insert into tempaddresses"; 
	$sql .="(EmailAddress, kickbacktypeID, Processed, Date)";
	$sql .="values('$row[0]', '$Kickback', '$Processed', '$Date')";
			echo '<tr><td><b>Inserting-></b></td><td>&nbsp;&nbsp;</td><td width = "100"
			nowrap="nowrap">' . $row[0] . '</td><td>&nbsp;&nbsp;</td><td width ="75"
			nowrap="nowrap">' . $Kickback . '</td><td>&nbsp;&nbsp;</td><td width ="100"
			nowrap="nowrap">' . $Processed . '</td><td>&nbsp;&nbsp;</td><td width="100"
			nowrap="nowrap">' . $Date . '</td></tr>';
			if(!mysql_query($sql))
			{
			  echo 'There was an error inserting the data into database!<br><br>' . mysql_errno().
			'<br>'.mysql_error().'<br><br>';
			}
}
echo '</table>';
fclose($handle);
	$total = ($t-1);
		echo '<br />The total number of records imported was ' . $total . '<br /><br />';

I believe I will end up needing to make a new array and merge the 2 together to then insert , but I am not sure.

Thoughts?

Thanks,
Don

[sneakyimp]

In this code you try to open a file called $Filename and you haven't defined $Filename. You might want to start there.

[HalfaBee]

I don't see $data being used either.

[dmacman1962]

Sorry, I left this out (I had it defined, just did not include it).

$Filename = $_POST['Filename'];

As far as $data is concerned, I got that code from the site and did not write it, so I don't quite follow the authors logic.

..meaning this part.

while (($data = fgetcsv($handle, 1000, ",")) !== FALSE) {
    $num = count($data);
    $t++;
    for ($c=0; $c < $num; $c++) {
		$row[$c] = $data[$c];
.....}

They did not explain their usage of it, so I cannot elaborate on it.

Does this help?

regards,
Dom

[sneakyimp]

That code is still different from the code you posted above. that loop you are referring to reads a CSV file one line at a time and parses it into an array ($data, in this case). Your code in your original posting refers a few times to $row when no such var has been defined -- at least not in the code you have shown us.

[dmacman1962]

Sorry about that, I had accidentally Rem'd out that code and copied the code without that part. Here is all the code.

$Kickback = $_POST['Kickback'];
$_SESSION['Kickback'] = $Kickback;

$Date = date("Y-m-d H:i:s");
$Processed = '0';

// Select the DB
$db_selected=mysql_select_db("max8");
if(!$db_selected){
die(mysql_error());
} 

$t=1;
$row = array();

echo '<table border=0 cellpadding="0" cellspacing="0" width="600">';

$handle = fopen($Filename, "r");
while (($data = fgetcsv($handle, 1000, ",")) !== FALSE) {
    $num = count($data);
    $t++;

for ($c=0; $c < $num; $c++) {
	$row[$c] = $data[$c];

	//strip out any blank spaces in the phone # and put in a dash
	$replacement = '-';
	$string = $row[7];
	$pattern = '/\s+/';
	$row[7] =  preg_replace($pattern, $replacement, $string);	
}

$sql ="insert into tempaddresses"; 
	$sql .="(EmailAddress, kickbacktypeID, Processed, Date)";
	$sql .="values('$row[0]', '$Kickback', '$Processed', '$Date')";
			echo '<tr><td><b>Inserting-></b></td><td>&nbsp;&nbsp;</td><td width = "100"
			nowrap="nowrap">' . $row[0] . '</td><td>&nbsp;&nbsp;</td><td width ="75"
			nowrap="nowrap">' . $Kickback . '</td><td>&nbsp;&nbsp;</td><td width ="100"
			nowrap="nowrap">' . $Processed . '</td><td>&nbsp;&nbsp;</td><td width="100"
			nowrap="nowrap">' . $Date . '</td></tr>';
			if(!mysql_query($sql))
			{
			  echo 'There was an error inserting the data into database!<br><br>' . 
			mysql_errno().'<br>'.mysql_error().'<br><br>';
			}
}
echo '</table>';
fclose($handle);
	$total = ($t-1);
		echo '<br />The total number of records imported was ' . $total . '<br /><br />';
		echo '<a href="kickback_form.php">Click here to import more records.</a>';

That is the complete code snippet (minus some HTML links that are not important).

Thanks,
Don

[sneakyimp]

If that is 'all' the code, then you still have the problem of $Filename not being defined before you try and open it.

[dmacman1962]

Sorry for being so dense, I did not add:

$Filename = $_POST['Filename'];

Which I am assuming is what you mean by 'not defining.'

And under that assumption, I tried the code with that added and I still got the ...

'Warning: fgetcsv() expects parameter 1 to be resource, boolean given... on line 30' error, which is this line:

while (($data = fgetcsv($handle, 1000, ",")) !== FALSE) {

... and it gave that error, I am guessing, 1057 times. But it did insert the $variable data I tried to assign to the 4 records, but it inserted that data 1057 times.

So, it is caught in a loop and instead of creating 4 rows, created 1057. The good news is that it inserted the correct data with the exception of the email addresses (from the CSV, which is the row[0]).

I hope that makes sense, and I am trying to deduce where you are attempting to lead me without spelling it totally out for me.

Thanks,
Don

[sneakyimp]

You are having that problem because the line that creates the variable $handle in the first place is trying to open $Filename when you have not supplied a value for filename:

$handle = fopen($Filename, "r");

I would change that line to this:

$handle = fopen($Filename, "r")
  or die('Could not open "' . $Filename . '"';

Also, you should be careful trying to get $Filename from a $_POST variable. A hacker might be able to exploit that situation by assigning any value they like for $Filename and they could read a file containing passwords or database logins or whatever.

[dmacman1962]

Doh!

I have 2 similar forms and on this one, I did not change the input name for the form to "Filename". Oops.

Thanks.

FYI, this is only and internal app, so I dont think the security will be a big issue. But for the record, what would you suggest to tighten it up?

Thanks,
Don

[sneakyimp]

If there is only a fixed set of possibilities for $Filename, put them all in an array and make sure the supplied value from the form exists in that array:

$ok_filenames = array('file1.csv', 'file2.csv', 'file3.csv');

if (!in_array($Filename)) {
  die('Invalid Filename!');
}

If the possible filenames are constantly changing, you should probably try to limit all possible filenames to a single directory. Then you can screen the form input for slashes or the parent directory ('..' )

if (preg_match('/(\/|\\)/', $Filename)) {
  die('invalid filename has slashes in it!');
}

I haven't tested any of this code. The basic idea is to prevent malicious programmers from specifying any arbitrary Filename such as '/root/.passwd' or '../../../secret_file.php'