« first day (2309 days earlier)      last day (2638 days later) » 

2:00 PM
That would make sense
 
2:13 PM
@Alesana You're using W3Schools... That's the difference...
 
@Alesana for people not used to PHP, or programming languages for that matter, the latter statement would be confusing. for PHP developers, the former statement is weird.
and only after I type that I read what @Gordon says >.<
 
@Tiffany learn 2 read teh manual ya newb :D
(yes, PHP return types are confusing… I always read the doc when I have to use a PHP lib function)
 
Wes
2:30 PM
is it just me or "filter" is a confusing name for a function? "to filter" means both take out / filter out unwanted stuff, and filter in / pass through
 
@Tiffany I would think they both wouldn't make sense for someone who is not used to programming languages
@Wes Well filter_var is used to actually filter/take out, but you can also use it to validate it.
 
Wes
i'm asking in general about english language
i sometimes have black outs and i don't remember if e.g. array_filter must return true or false for the thing to get removed
 
@Wes Filter is confusing because it means (the same) different thing in pretty much every other language.
I mean, even within PHP you have filter_var and array_filter
 
@Wes you're correct. also it's a bad api
 
MASSIVE YACHTS
 
2:33 PM
@Alesana isn't used to programming languages, but is learning them. PHP's behavior with conditionals is a tad different than other languages and may be unusual
 
@Alesana The thing is that filter_var's return type is mixed
Meaning it returns more than one type.
 
Ah, I haven't started learning any other programming languages but it is good to know PHP can act differently than other languages
 
In this case, it returns a filtered string if it passses, or FALSE if it doesn't.
If you just did if (!filter_var(...)) {
filter_var might return an empty string, and the condition would still enter, even though it shouldn't.
For that reason, by the way, you should always try your best to always return the same type from a function
 
@MadaraUchiha yeah, that's what @Gordon said :P
I read it after I said what I did
 
2:36 PM
my statement still applies, but this particular function is different
 
lol
 
Wes
@MadaraUchiha it's the same thing in italian though. if i'm filtering something, filter means take out, if i'm the thing being filtered, filter means pass through. it's hella confusing
 
Your first language is Italian @Wes?
 
Wes
ye
 
happens when you're italian
 
2:38 PM
I forget what "luck out" means
 
Ah you speak English extremely well
 
@Tiffany it's not that unusual, there are plenty more functions that return thing or false
 
Luck out means to have something good happen to you that would require luck
 
Wes
@Alesana ahahahah
 
Where's the humor o.o
 
2:38 PM
you should hear his italian
 
I've heard people use it for the opposite meaning, it gets confusing
 
Hmm, out of luck or luck out I would think :P
 
Wes
@Alesana it's not true. weren't you ironic ? :P
 
it like wayiaiaiaaayyyynneee on your weddding daaaay
 
@Wes No, I always thought your first language was English
lol Gordon
 
2:40 PM
I'm back to my childhood
 
the only ironic thing about the song ironic is that most of the things happening in it are not ironic.
 
Wes
i'm good at pretending to know english - i carefully avoid to write sentences i know i'd write wrong :P
 
@Gordon I saw a Vsauce video on that
 
@Wes eh, I do that too, and I'm a native speaker
 
IDK what Vsauce is
I know Versace
 
2:41 PM
Leave Alanis alone, she's already bat-shit crazy, no need to call her language skills out as well just to make her feel bad.
 
@Wes s/to write/writing
 
Question: an application (symfony 3.2) needs to have a persistent connection with a Saas server. Auth based on oAuth. The application needs to store the oAuth keys etc, but also needs to update the keys with an interface when for some reason the connection fails.

What would be the best place to store they keys in this case? Database feels wrong.. env feels wrong.. temporary config file in var also seems wrong..
Any ideas ?
 
Wes
damn, aren't to write and writing the same in that case?
 
@Gordon oh it's a youtube artist
 
2:43 PM
"youtube artist".. thats such a millennial remark ..
 
@Gordon /me finds Daily Mail article pointing that out and changes citation to that article so it gets removed
 
@Wes sorta, but use writing
 
@DamienOvereem I was thinking that as I was typing it but I didn't know what else to call him haha
 
What exactly is a "youtube artist" .. someone that excels at youtubing?
 
You don't have to excel at your art to be an artist
 
2:44 PM
It's like a piss artist, only nearer rock bottom
 
@Alesana "youtube artist"… I am 40 years old. Calling anything or anyone on YT an artist defies any natural order in my world view
 
39 here.. sharing that view 100%
 
Lol youtube channel, if you will
 
Still don't know where to store my temporary-persistant config though ;p Anyone ? :)
 
2:45 PM
“I've come up with a set of rules that describe our reactions to technologies:
1. Anything that is in the world when you’re born is normal and ordinary and is just a natural part of the way the world works.
2. Anything that's invented between when you’re fifteen and thirty-five is new and exciting and revolutionary and you can probably get a career in it.
3. Anything invented after you're thirty-five is against the natural order of things.”
http://www.goodreads.com/quotes/39828-i-ve-come-up-with-a-set-of-rules-that-describe
 
@PaulCrovella she's not an artist. She's a goddess.
 
@DamienOvereem Just in memory, surely?
 
@Gordon lol
 
2:46 PM
I'm going to get this stuck in my head again
 
$firstName = $_POST['firstName'];
$lastName = $_POST['lastName'];
$username = $_POST['username'];
$password = $_POST['password'];
$email = $_POST['email'];

$md5pass = md5($password);

$sql = "INSERT INTO users (user_id, username, password, first_name, last_name, email) VALUES('', $username, $md5pass, $firstName, $lastName, $email)";

$result = mysqli_query($conn, $sql);
does anyone know why this isnt inserting into my sql database?
 
As stated in the movie "This is the end", everything is art. "Your mom is the canvas and your dad is the paintbrush, bam, you're art"
 
@RachelDockter Please do not use MD5. Please.
 
@RachelDockter You should use PDO
 
Also that ^
 
2:47 PM
and you should use Docker and change your name to it
 
im probably gonna change from md5 after i get it working, its just a uni assignment
 
The specific reason it is failing right now is because of string quoting
 
I keep reading RachelDocker… must be my prolonged exposure to containers
 
@DaveRandom she's been told, refuses to listen
 
whats wrong with the string quoting
 
2:47 PM
@Alesana mysqli is perfectly fine, but not on this manner.
 
did i forget a quotation mark
 
@DaveRandom That would be an issue incase of a reboot for example. Specific case: the application communicates with a bookkeeping Saas application. Its a rather important connection, so when for some reason authentication fails.. it has to be restored. Usually the keys would remain the same, but they could fail.
 
@RachelDockter No-one ever actually does things like that, they always say they will and then don't. password_hash() is no harder to use than MD5 and roughly 1trn times better.
2
roughly
 
so i just replace $md5pass = md5($password); with $md5pass = password_hash($password); ?
 
@RachelDockter Well currently you didn't do any at all. echo $sql;
 
2:49 PM
You're also setting an empty user_id, but with auto_increment on user_id, you shouldn't be necessary to add this to your query.

Also did you try to var_dump(mysqli_query($conn, $sql)) ?
 
@RachelDockter Use a parametrized query
 
its auto incement, im not sure what your var dump does
 
@RachelDockter Yes. well change your var name aswell
 
You have parameters.
 
@RachelDockter Yes, and when you are verifying it you do if (password_verify($userPass, $dbPass)) instead of if ($dbPass === $userPass)
 
2:50 PM
!!docs mysqli_prepare
 
[ mysqli::prepare ] Prepare an SQL statement for execution
 
@RachelDockter please put a //@todo change to password_hash above the md5 line. That's the proper way of annotating something which you will never do.
9
 
@RachelDockter Read the examples there ^
 
@RachelDockter var_dump does exactly what it says, it dumps (like debug) the variable.
 
@DaveRandom ok ill note that, ill do it after i can insert into mysql
sec
 
2:50 PM
@DaveRandom My friend showed me his code and it had a huge mysql injection vulnerability by putting a variable from Ajax directly into his qry. He said "Ah yeah I am gunnu change it after I'm just trying to get it to work now". I know he won't so I am thinking of doing a non-harmful mysql injection attack later just to prove to him
 
@RachelDockter seriously, just echo $sql and look at the SQL string you created, the problem should be obvious
 
looks like the values aren't quoted?
 
!!xkcd bobby tables
 
obligatory
 
2:51 PM
lol @ the alt text
 
this is what it echos
 
I forgot about that
 
INSERT INTO users (user_id, username, password, first_name, last_name, email) VALUES('', user, 1a1dc91c907325c69271ddf0c944bc72, first, second, email)
i dont see a problem
 
@RachelDockter What are those values?
 
Look at the VALUES() part very carefully
 
2:52 PM
just what i typed in the text box fields
 
strings, integers, flying boats?
 
@RachelDockter Values in MySQL of stringy types must be quoted with single quotes
 
those are ' ' and not "
 
@RachelDockter Right, but MySQL is not being told that they are strings, because they are not quoted like strings
 
user should be 'user', etc.
 
2:53 PM
What you did is the equivalent of this in PHP:
 
Hahahaha that comic
 
@RachelDockter alright, thus where are your single quotes?
 
$var = a string;
 
@DaveRandom tip: send everything as a string, the DB knows what the type should be, let it sort it out
 
uhhh hold on
 
2:54 PM
I am coming
 
@Leigh Well I fundamentally disagree with that in many ways but I assume you are trolling me anyway :-P
 
so i put VALUES('', '$username', for example
 
exactly
 
@DaveRandom no
 
Well, not really tbh.
 
2:54 PM
thats weird but ok ill try that
 
it's not safe
 
@Gordon Buses aren't always on time
 
@DaveRandom sorry, I changed the song
 
@DaveRandom I'm not talking about the types when you bind to a stmt
 
then what are you taking about?
 
2:55 PM
it's not, you neither write queries like " select * from users where name = Gordon "

You'd write " select * from users where name = 'Gordon' "
 
ayy it worked
you were right
 
You should still switch it to PDO @RachelDockter
 
Anonymous
!!canon sqli
 
You must let the DB know you're sending him a string value..
@Alesana or mysqli with prepared statements-.-
 
2785
Q: How can I prevent SQL injection in PHP?

Andrew G. JohnsonIf user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example: $unsafe_variable = $_POST['user_input']; mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')"); That's because the us...

 
2:56 PM
@RachelDockter OK. Now see what happens when the person's last name is O'Niel, with an apostrophe in it. Then see the above linked question ^ for an explanation of why and how to avoid that.
 
@MikeM. why would you use mysqli when there is PDO?
 
on a side note: I just realized @PeeHaa's surname consists of two insults in english.
@Rovak async queries
 
@Rovak PDO is more abstract, and sometimes you don't need the extra abstraction.
 
wait a second
 
You have to work harder for true prepared queries, and also, ^ async queries.
 
2:57 PM
Backspaces answer already given.
 
Anonymous
@Gordon with bad spelling or am I missing something?
 
ah didn't know about async queries
 
@MikeM. Ah I wasn't aware
 
so if someone is called o'niel, how would that work
 
@Rovak Warning, mysqli async API is E_USELESS
 
2:58 PM
i looked at the post and its just about sql injection
 
@JayIsTooCommon well, whore and dyke… so phonetically. and yes of course, everything is misspelled in dutch
 
Is there any website which lets me test both php and html codes?
 
@RachelDockter Now please, read about prepared statements.
 
@RachelDockter Right, but it's part and parcel of the same problem
 
@Shafizadeh Why don't you set up XAMP?
 
2:59 PM
so i should encrypt everything so o'neil becomes something like sjd5h34j5h3k43 and then it would work
 
Anonymous
@Gordon i'm telling.
 
no wait cuz then i couldnt read it
 
Why would you do that @RachelDockter
 
PDO does handle prepared statements more easily tho', in mysqli you have to use bindParam(type, value) wheres in PDO I can create named prepared parameters which will then result into sending an array to the execute method which looks like [':id' => 1]
 
@Alesana Xampp is installed on my local computer .. But creating new files is baring :-(
 
2:59 PM
@RachelDockter you should use prepared statements.
 
You should just prepare your statements
 
ok im reading on how to prepere statements
whatever that means lol
i have no idea
 
You should use prepared statements
 

« first day (2309 days earlier)      last day (2638 days later) »