+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Web Development (https://hackforums.net/forumdisplay.php?fid=183)
+---- Thread: [PHP] Php page creation and edit problem (/showthread.php?tid=5030567)
Php page creation and edit problem - StealthThrax - Oct 22, 2015
does anyone see why when I create a new page. That whatever is on the home page is on the new pages and I cant edit the new pages separately?
pages.php
Code
<?php
session_start();
require_once('../config.php');
if(session_is_registered("username"))
{
$username = $_SESSION['username'];
$hash = $_SESSION['hash'];
require_once('../config.php');
mysql_connect($sqlserver,$sqluser,$sqlpass);
mysql_select_db("$sqlname") or die(mysql_error());
$result = mysql_query("SELECT * from users where username='$username' and password='$hash'");
if (mysql_num_rows($result) == 0)
{
header('Location: login.php');
exit();
}
}
else
{
header('Location: login.php');
exit();
}
echo "<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>";
mysql_connect($sqlserver,$sqluser,$sqlpass); // Connect to the MySQL server
require_once('inc.php');
?>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8" />
<meta name="keywords" content="" />
<meta name="author" content="" />
<link rel="stylesheet" type="text/css" href="bulletprooftheme.css" />
<title>Create Page</title>
</head>
<body>
<div id="thetop">
<a id="top"></a>
<p class="hide">Skip to: <a href="#sitemenu" accesskey="2">Site menu</a> | <a href="#maincontent" accesskey="3">Main content</a></p>
</div>
<div id="container">
<div id="main">
<div id="logo">
<h1><img src="../IMG/Bulletproof-vest-logo.jpg" height="200" width="200"></h1>
<span id="tagline">Administration Area:</span>
</div>
<div class="clear"></div>
<h3 class="headerstyle"><a href="<?php echo $path ?>">Home</a> » <a href="<?php echo $path ?>manage">Admin Panel</a> » Create/Edit Pages </h3>
<table style="float: left;" class="center" width="100%" border="1">
<?php
while($row = mysql_fetch_array( $pages ))
{
echo "<tr><td>";
echo $row['formal_name'];
echo ('</td><td><a href="edit.php?name='.$row['name'].'">Edit</a> | <a href="delete.php?name='.$row['name'].'">Remove</a></td>');
echo "</tr>";
}
?>
</table>
<br />
<h3>New Page:</h3>
<form action="create.php" method="post">
<table style="float: left;" class="center" width="100%" border="1">
<tr>
<td>Page Name:</td>
<td><input name="name" type="text" /></td>
</tr>
<tr>
<td>Page Ant:</td>
<td><input name="ant" type="text" /></td>
</tr>
<tr>
<td>Visible in menu:</td>
<td><select name="menu"><option value="1">Yes</option><option value="0">No</option></select></td>
</tr>
</table>
<input type="hidden" name="_submit_check1" value="1"/>
<input type="submit" value="Create Page" />
</form>
<p class="center"><a href="<?php echo $path ?>manage">[Go Back]</a></p>
<br />
</div>
<div class="clear"> </div>
</div>
<div id="footer">
<p><?php echo $copyright ?></p>
<p>Powered by <a href="http://www.///////////">Title</a></p>
<p><a href="logout.php">Logout</a></p>
</div>
</body>
</html>edit.php
Code
<?php
session_start();
require_once('../config.php');
if(session_is_registered("username"))
{
$username = $_SESSION['username'];
$hash = $_SESSION['hash'];
require_once('../config.php');
mysql_connect($sqlserver,$sqluser,$sqlpass);
mysql_select_db("$sqlname") or die(mysql_error());
$result = mysql_query("SELECT * from users where username='$username' and password='$hash'");
if (mysql_num_rows($result) == 0)
{
header('Location: login.php');
exit();
}
}
else
{
header('Location: login.php');
exit();
}
echo "<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>";
mysql_connect($sqlserver,$sqluser,$sqlpass); // Connect to the MySQL server
require_once('inc.php');
include("fckeditor/fckeditor.php") ;
$name = $_GET['name'];
if (array_key_exists('_submit1_check', $_POST)) {
$page = $_POST['FCKeditor1'];
$formal = $_POST['formal'];
$ant = $_POST['ant'];
$menu = $_POST['menu'];
$name = $_GET['name'];
mysql_query("UPDATE pages SET value = '$page' WHERE name='$name'");
mysql_query("UPDATE pages SET formal_name = '$formal' WHERE name='$name'");
mysql_query("UPDATE pages SET name = '$ant' WHERE name='$name'");
mysql_query("UPDATE pages SET navigation = '$menu' WHERE name='$name'");
$name = $ant;
$submit = yes;
}
?>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8" />
<link rel="stylesheet" type="text/css" href="bulletprooftheme.css" />
<title>Administration Area</title>
</head>
<body>
<div id="thetop">
<a id="top"></a>
<p class="hide">Skip to: <a href="#sitemenu" accesskey="2">Site menu</a> | <a href="#maincontent" accesskey="3">Main content</a></p>
</div>
<div id="container">
<div id="main">
<div id="logo">
<h1><img src="../IMG/Bulletproof-vest-logo.jpg" alt="CMS Logo" height="200" width="200"></h1>
<span id="tagline">Administration Area:</span>
</div>
<div class="clear"></div>
<h3 class="headerstyle"><a href="<?php echo $path ?>">Home</a> » <a href="<?php echo $path ?>manage">Admin Panel</a> » <a href="<?php echo $path ?>manage/pages.php">Create/Edit Pages</a> » Edit Page</h3>
<form action="edit.php?name=<?php echo $name ?>" method="post">
<?php
if ($submit != yes)
{
$pages = mysql_query("SELECT * FROM pages where name = '$name'");
$pagerow = mysql_fetch_array($pages) or die(mysql_error());
$name = $pagerow['value'];
echo '<table style="float: left;" class="center" width="100%" border="1">';
echo "<tr>";
echo ('<td><h3>Formal Name:</h3><input name="formal" type="text" value="'.$pagerow['formal_name'].'" /></td>');
echo ('<td><h3>Page Ant:</h3><input name="ant" type="text" value="'.$pagerow['name'].'" /></td>');
echo "</tr>";
echo "<tr>";
echo '<td><h3>Visible in menu:</h3></td>';
echo '<td><select name="menu"><option value="1">Yes</option><option value="0">No</option></select></td>';
echo "</tr>";
echo "</table>";
$oFCKeditor = new FCKeditor('FCKeditor1');
$oFCKeditor->BasePath = '/manage/fckeditor/';
$oFCKeditor->Value = $name;
$oFCKeditor->Create();
}
else
{
echo "<h2>Page Saved</h2>";
$pages = mysql_query("SELECT * FROM pages where name = '$name'");
$pagerow = mysql_fetch_array($pages) or die(mysql_error());
$name = $pagerow['value'];
echo '<table style="float: left;" class="center" width="100%" border="1">';
echo "<tr>";
echo ('<td><h3>Formal Name:</h3><input name="formal" type="text" value="'.$pagerow['formal_name'].'" /></td>');
echo ('<td><h3>Page Ant:</h3><input name="ant" type="text" value="'.$pagerow['name'].'" /></td>');
echo "</tr>";
echo "<tr>";
echo '<td><h3>Visible in menu:</h3></td>';
echo '<td><select name="menu"><option value="1">Yes</option><option value="0">No</option></select></td>';
echo "</tr>";
echo "</table>";
$oFCKeditor = new FCKeditor('FCKeditor1');
$oFCKeditor->BasePath = '/manage/fckeditor/';
$oFCKeditor->Value = $name;
$oFCKeditor->Create();
}
?>
<input type="hidden" name="_submit1_check" value="1"/>
<input type="submit" value="Save Page" />
</form>
<br />
<p class="center"><a href="<?php echo $path ?>manage/pages.php">[Go Back]</a></p>
<br />
</div>
<div class="clear"> </div>
</div>
<div id="footer">
<p><?php echo $copyright ?></p>
<p>Powered by <a href="http:///////">title</a></p>
<p><a href="logout.php">Logout</a></p>
</div>
</body>
</html>* - mothh - Oct 22, 2015
Because you search on the name, when you change the name that entry become invalid.
Try changing it to id.
Something more important, don't use the MySQL extension anymore, it is outdated and deprecated, use PDO or MySQLi instead.
A tutorial for PDO:
https://www.youtube.com/playlist?list=PLfdtiltiRHWHkDwEoZ29Q9FKtWVjA46HC
* - Meowie - Oct 22, 2015
By the way, please fix your edit.php code
It is full of easily-exploitable SQL injections.
Just use prepared statements as the guy above suggested or escape the input.
* - StealthThrax - Oct 22, 2015
(Oct 22, 2015 10:24 AM)Meowie Wrote: By the way, please fix your edit.php code
It is full of easily-exploitable SQL injections.
Just use prepared statements as the guy above suggested or escape the input.
So basically from what i read on PDO is i should make it like this
Code
$sql = "UPDATE pages
SET value = ?, formal_name = ?, name = ?, navigation = ?
WHERE name=?");
$stmt = $pdo->prepare($sql);
$stmt->execute([$page, $formal, $ant, $menu, $name]);(Oct 22, 2015 09:36 AM)mothh Wrote: Because you search on the name, when you change the name that entry become invalid.
Try changing it to id.
Can you quote which section you have referred to above?
* - Meowie - Oct 22, 2015
Yeah, that's what PDO is used for.
No SQLi if used properly.
* - mothh - Oct 22, 2015
Just use PDO and it should fix it, if that doesn't fix it I will help you with the other code.
* - StealthThrax - Oct 23, 2015
(Oct 22, 2015 01:57 PM)mothh Wrote: Just use PDO and it should fix it, if that doesn't fix it I will help you with the other code.
I will give it a shot after work, and let you know. Thanks for all the help.
* - StealthThrax - Nov 5, 2015
(Oct 22, 2015 01:57 PM)mothh Wrote: Just use PDO and it should fix it, if that doesn't fix it I will help you with the other code.
I converted it to Mysqli still something wrong in the php part.