« first day (2311 days earlier)      last day (2644 days later) » 

5:00 AM
$response = 0;
if (isset($_POST['id'])) {
	include '../db.php';
	$stmnt = $dbh->prepare("DELETE FROM table WHERE id = :id");
	$stmnt->bindParam(":id", $_POST['id'], PDO::PARAM_INT);
	$stmnt->execute();
	if ($stmnt->rowCount() === 0) {
		$response = 1;
	}
} else {
	$response = 1;
}
echo $response;
If ajax gets 1 error it displays an error saying it could not be deleted
If it was a string, the query will not delete anything as it won't be able to find anything in the table with that id
if it didn't exist, the same will apply
 
Like I said before someone can manipulate your form, your html you can't just trust the data.
 
I understand but how could it go wrong?
 
first make a call to the database to check if the id exist.
Form spoofing.
 
That seems like an unnecesary step
 
cross site request forgery
 
5:02 AM
If they spoof the form then it will simply not delete anything and return 1, which will display an error
 
after you make the first check if($_POST['token'] === $_SESSION['token'])
 
You still aren't telling me what can go wrong with my code
 
They can alter the data.
coming in.
From your html
 
I know
But what would go wrong if they did?
That's what I'm asking
 
Delete a user they want
 
5:05 AM
Incorrect, I bind the value with PDO therefore it could not be SQL injection
 
Its not inejection
 
They could not delete a user
 
they change the value to say
23
when u had passed id of 2
now they are deleting user 23
You don't see anything worng with that?
 
What? The code you provided does nothing to prevent that
 
if($_POST['token'] === $_SESSION['token'])
this does.
 
5:06 AM
For my purpose no because the person who has the power to delete 2 can also delete 23
 
You pass along a token
 
I don't understand
 
look up
csrf
 
How would that prevent someone from changing the value?
 
is easy to understand.
 
5:10 AM
I understand csrf but I don't understand how that would prevent someone from changing the value
And I don't understand why these are necessary..
 
I dont thikn you understand.
 
:35618483
 
<?php $_SESSION['token'] = md5(uniqid(mt_rand(), true));?>
in your html
 
> if (isset($_GET['id']) && filter_var($_GET['id'], FILTER_VALIDATE_INT, array('min_range' => 1)))
> Then you first would check if that id exist in the database.
 
You don't understand that?
 
5:12 AM
Why are those necessary?
That's what I was talking about
 
Thats a get variable right?
in the url
ppl can alter the values.
into anything strings booleans.
 
God I understand that
If you try to delete an ID that does not exist nothing will happen
 
You are only proccessing the delete request
if id is set
and if get id is a integger
 
Read my last message
 
if that integger is greater then 1
 
5:14 AM
Read it twice
 
can someone explain how this example actually works? stackoverflow.com/questions/13633954/…
 
you will get an error
lol in your query
 
Incorrect
You do not get an error
 
or it wont return anything
but still is best practice to check what is coming in
 
It will not return anything, but $stmnt->rowCount() will be 0
So it is less expensive to just check $stmnt->rowCount() after attempting to delete it
 
5:16 AM
no you are wrong
On a delte query it will be an error
It will not return anything on a select query.
You are asking it to DELETE A ID THAT DOES NOT EXIST
 
No it does not
It will not return an error
 
You have errors turned off?
 
I have strict reporting
 
You are right, I was thinking of something else.
But what if it did exist
You want to give that power to users?
to be able to minipulate your data?
 
You told me to check if it exists before deleting it.....
Now you're asking me what would happen if it did exist?
 
5:22 AM
yes that is true.
 
Checking if it exists before attempting to delete it is unecessary and will result in an extra query than needed
As you can check if it exists after deleting it
 
When you log in.
 
Also checking if it is a string is unnecessary as if it is a string it will not exist if ids are only numerical
 
You are so trusting.
 
I am not trusting
 
5:24 AM
People can acesss your script directly
 
It's just that nothing bad can happen
 
Yes
You need to study more about security.
 
I do
That's why I am telling you this
 
get variables can be minipuated
is a simple aswer you have to check.
 
It's a post variable but it comes from AJAX so it can be manipulated anyways, you are right about that
 
5:25 AM
Ajax can be minipulated.
 
> you are right about that
 
And forms can be minipulated
get varaibles can be mipulated lol
come dude this is like begennier stuff.
 
It's like I'm talking to a wall
 
Why we even having this conversation.
 
I understand it can be manipulated but in my case (an admin panel) the admin can delete anything, so instead of manipulating the form to delete an id that exists they would just do it the proper way
 
5:27 AM
Session fixation
lol
a normal user can gain access to amin pri
lol
Do you know what that is?
 
amin pri?
I have no idea what amin pri is
 
admin privileges
 
Okay so how did anything you say prevent session fixation?
 
I'm saying session fixation or hijacking can allow a malicious user to gain access to an admin account.
You have to still protect admin pages.
 
I know, that's why I have proper methods in place to prevent session hijacking
 
5:32 AM
What you have in place?
 
But I still don't understand what is wrong with the way I delete the id?
 
It's just like an alert box
if it exist then delete
if not direct the user to an error page
 
So what is wrong with it?
Mine does the same thing..
Well, doesn't redirect the user just pops up an alert
 
you are assuming that it exist.
 
No I am not
I am checking after I execute the query
via..
	if ($stmnt->rowCount() === 0) {
		$echo "ERROR";
	}
Dude I don't even know why I am discussing this there is nothing wrong with my code and it is more efficient than the code that you provided
 
5:39 AM
It's not good practice to just delete nothing. That is you are assuming that I'd really exist.
But if that works for you. There are more ways to do things.
I would validate the data though.
 
It doesn't just delete nothing it returns an error
Which comes up in an alert
If nothing was deleted, it will report back and say nothing was deleted. That is good practice
 
I don't know bro the guy I learned from works at stripe.
Who did you learn from?
Larry Ullman.
 
I don't remember from who I learned to delete rows from
1
Q: Should I check if rows exist across tables before deleting in MyISAM?

iakkamLet's say I have 5 MyISAM tables in my database. Each table has a key, let's call it "id_num" ... "id_num" is the field which I use to connect all the tables together. A certain value of "id_num" may appear in all tables or sometimes only a subset of the tables. If I want to delete all instanc...

Ah that's not MySQL but the same thing applies
> To answer your question about first running SELECT, there's no advantage to doing so. If there's no row in a given table, then the DELETE will simply affect zero rows. If there are matching rows, then doing the SELECT first and then the DELETE would just be doing double the work of finding the rows. So just do the DELETE and get it over with.
 
not really if you know your sql
you can do a conditional in sql
and do it all in one query
Take a login for example
you type in your email and password
 
Fuck man I'm done talking about this
 
5:51 AM
lol
 
I don't know why you can't accept that making sure it exists before deleting it is more efficient and not "bad practice"
 
@Alesana this is good though.
 
stackoverflow.com/questions/24728133/… Here is another one that says the same
 
I don't think that is an acceptable answer. He didn't get any points lol
 
6:09 AM
lol
 
6:30 AM
wsh?
 
 
2 hours later…
8:01 AM
posted on February 12, 2017

New Cyanide and Happiness Comic

 
mornings
@LeviMorrison $ sudo apt install dart and so it starts again
 
8:27 AM
@Danack at what point did you get that? docker run or during build?
@Danack ubuntu. I'd rather be using CentOS but for what I'm doing it doesn't make a huge amount of difference and I already figured out the magic apt-get recipe so I went with the easy option
 
 
1 hour later…
9:43 AM
There are 255 stars missing to Ruby github.com/showcases/programming-languages?s=stars
 
 
1 hour later…
10:52 AM
mornin
 
Good morning! Maybe someone here can help: I have an MySQL script on a server, but after some time i get "lost connection".
github.com/mwvent/WattzMCPE-MyPlot theres the code, and disconnect happens at
[191] $helpers, $plot->biome, $plot->locked
[192] );
[193] }
[194]
[195] if ($bind_result === false) {
[196] $err = $this->db_statements [$thisQueryName]->error;
[197] $this->criticalError("Could not bind to query " . $thisQueryName . ":" . $err);
[198] return false;
[199] }
[200] $exec_result = $this->db_statements [$thisQueryName]->execute();
[201] if ($exec_result === false) {
[202] $err = $this->db_statements [$thisQueryName]->error;
[203]
[204] /* check if server is alive */
Error: Error while sending STMT_EXECUTE packet. PID=3060 thats the warning. :( i tried to set timeout limit in the mysql packet, re-ping the database to "awaken" the connection etc
 
11:16 AM
If I include a file that includes another file will it include both? for some reason it's saying a variable is undefined but I know it's not :|
 
lxr.php.net not working :(

There was an error!
Java heap space
java.lang.OutOfMemoryError: Java heap space
 
@brzuchal it happens a lot
a little out of date though
(about 2 weeks I think)
opengrok01.lxr.room11.org:8080/source <-- latest version of opengrok, but I haven't finished building the indexes yet so it doesn't have php-src on it yet
 
@DaveRandom Thank you!
 
11:56 AM
@Alesana yes it will
 
@Alesana are you sure both files are included? from which file do you try to get the variable, the one that is imported or the one that does import the other
 
@thebigsmileXD I have a file "filetojson.php" (file1) that calls a function that includes a php file (file2) and returns a function in file2. File2 includes file3 but not inside the function, so I try accessing it through $GLOBALS.
So I include the file in filetojson.php (this first file) and I can access it through $GLOBALS
 
Wes
12:11 PM
hodor \o
 
I was looking at NGINX module to PHP https://github.com/rryqszq4/ngx_php it uses `php_execute_script` and prepares all `$_` tables and runs script, the question is would it be practical and efficient to prepare implementation where PHP app run's in compiled in NGINX module and just handles sort of `Request` objects and returns `Response` objects which will be then used by NGINX to serve content?
I mean app is being started once and just passed to some NGINX internal request handler for every request so there would be no need to bootstrap PHP app every request.
@Wes o/
 
Moin
 
I can imagine situation where my PHP script bootstraps my app and passes callable to handle requests, like this:

$app = new class () { public function __invoke(Request $request) : Response { /* handlling request and produces response */ } };

NGINX::handle($app);
\o
Any thoughts?
It probably would have much implications but same as app build on ReactPHP WWW server.
 
12:31 PM
Hey guys
 
ThW
@brzuchal I prefer a non sharing env for the most apps, makes it more stable and easier to scale.
 
@ThW Yes it's easier, but I suppose not as much performant
 
Hey guys, I am using a dropdown list (Select with option values in html). If I want to use an integer value for each option, should I put the integer with, or without quotation marks?
 
ThW
@brzuchal So how do you use more then one CPU core?
 
For instance: <option value=3.5>3,5 hours</option> or <option value="3.5">3,5 hours</option>
it is going to be stored in mysql as a floa
float
 
12:35 PM
@ThW I suppose I'll need few threads
 
is it more correct to do it without or with quoatation marks?
 
@tomSurge Use quotes due to HTML standard
 
ThW
@brzuchal and here you need to have a data exchange between different processes or bootstrap in each of them.
 
Even if I am going to store it as a float in my database?
 
ThW
So you just moved the problem
 
12:37 PM
It doesn't costs you as much as 2 bytes more for one option
@ThW Yeah
 
Anonymous
Moin
 
@ThW There is a changce I could use one app instance per NGX worker
Well, that may be completely nonsence then :/
\o
 
ThW
@brzuchal not completely, here are reasons for using sharing env. But switching to it is not without cost, and people tend to forget that.
And keep in mind - development time is usually a lot more expensive then cpu time :-)
 
You're right.
 
@Alesana in my oppinion this should work.. is it in the globals? try to var dump it
 
12:45 PM
What's the meaning "somebody endorse you for something" ?
 
@ThW I just thought it would be more performant when no need for FastCGI all those headers coding from NGX context to FactCGI request, then on app side all those request data again from $_ arrays to request object to handle and throw response object producing HTTP response which then again FasctCGI passes to NGX and then NGX throws as HTTP Response then.
@Shafizadeh You mean like endorsing skills like on LinkedIn ?
 
yes exactly
but sadly I don't know English very well and I cannot understand what's supposed to mean !
 
I take it like someone confirms you have or suppose you have knowledge in that skill
 
ah I see
thx
 
But there are also plenty of people clicking blindly on those endorsements
So theirs value is not as much as you might think
 
12:47 PM
Ah .. I got it
 
I've got few recruiters connected which blindly clicks whatever I had on profile and that's completely nosence then
Their endorsement hasn't got any value
 
why they do that then?
 
ThW
@brzuchal Might be in some special cases, but CPU is usually not the problem, I/O is. And generally that means caches or message queues.
 
@Shafizadeh I think they do that to get back some endorsements on their profiles.
 
12:57 PM
@brzuchal well having endorsements on the profile is a good thing?
 
I hink yes, many recruiters match your top endorsed skills with profiles they're looking for to match profile with a job position.
 
Oh, I see
then endorse me please :-)
 
Well I can endorse some basic skills, I do not tend to endorse blindly, and am sorry fo that :)
 
I was just kidding ;-)
 
/me afk
 
1:35 PM
@Wes "bad air scare" .... riiiight
 
Wes
prozac effect in reverse? someone was sick and everybody thought they were sick too?
 
more like "emm ... there is something fucky in the air ... it would be quite a lawsuit if we accidentally gassed out visitor ... or if someone pulled a Tokie-subway on us"
I find that headline somewhat irresponsible
 
Wes
tokie subway? :B
 
sarin gas attacks some years ago
 
Wes
i've completely removed that
 
1:43 PM
"removed"?
 
@Wes Coordinated chem strike on multiple locations in the Tokyo subway
 
did you mean "forgotten" ?
 
Wes
i remember something now :B
yeah forgotten. doesn't remove work too?
 
not in english
 
@Wes Removed usually means detached, spaced out
"The scene looked totally removed from reality"
 
Wes
1:47 PM
til. i thought it would work too, yeah we say "i've completely removed whatever happening from my mind"
 
then again, it was in 1995 .. unnervingly large portion of people here were not old enough to remeber those
 
2:04 PM
Morngin all
 
2:21 PM
\o
 
2:52 PM
Should you only use Doctrine Migrations for updating the schema and if I want to put actual data in the database use Doctrine Fixtures?
 
3:35 PM
does anyone know why i cant bind these parameters?
nevermind im just really stupid
 
@RachelDockter It's called a PEBCAK, it happens to the best of us.
 
yeh thats it lol
actually i still dont think its working
should this work?
$sql = "UPDATE posts SET votes_up = ? WHERE user_id = ?";

$stmt = $conn->prepare($sql);
$stmt->bind_param("ii", $votes_up, $userId);
$stmt->execute(); //Execute the query
im not getting any errors but the value isnt changing in the db
 
you need to use :ii and not ?
 
no sorry it was me just being stupid again, i didnt declare $user_id
 
3:41 PM
Don't listen to whatever that ^ is @RachelDockter
 
that code does work
 
@nicarpe No.
 
lmao @tereško do u remember when i asked u if u can make google with php or something and u thought i was joking
 
Using ? instead of named parameters is valid.
 
Does the question mark follow the regular structure just like named parameters?
 
3:42 PM
@nicarpe Yes.
 
Ah, my bad.
Cheers, good to know
 
@RachelDockter are you starting to understand, why I thought so?
 
In fact, PDO will translate the names back to ? because that's the only way MySQL understands (IIRC, might be wrong here)
 
also shouldn't you adding votes per post and not per user?
 
yeh haha
i am yeh
 
3:43 PM
@RachelDockter I once thought that I could make a web browser using mIRC scripts
Didn't take me long to go fully NOPE on that one.
 
oh wait hold on
 
you can always get the total user's vote count with something like SELECT SUM(votes_up) - SUM(votes_down) AS total FROM posts GROUP BY user_id
 
If your votes only increments by 1 each time, you could just use AUTO_INCREMENT and you won't have to set a new value each time.
Or perhaps that's only for new columns?
 
@nicarpe stop trying to help , it's not workinf
 
yeh it was meant to be post_id instead of user id, it only worked because they were the same in this instance
 
3:44 PM
I'm not too sure, new to PHP haha
Yeah probably shouldn't @tereško
 
i dont think it should auto increment it lol
 
depends on what you need to use it for I guess
 
say if one person could only up vote the same post once, would u store an array of all the user_id's that have upvoted it in the post table
 
@RachelDockter you actually should have a separate table, called "PostVotes" (or something) which contains each separate vote. That way you can compensate when user cancels the vote ... or user gets removed entirely
 
oh do it that way, thats a better idea
 
3:47 PM
@tereško do you have any knowledge with utilizing the PayPal API?
trying to create an automated deposit system
 
it also would help with "1 vote, for 1 use on 1 post" - you can use UNIQUE KEY at DB table level, that enforces it
@nicarpe no. I have managed to always avoid using PayPal
 
ah alright
damn I like this chat feature on here
lol
 
what dont u use paypal? i always thought it was really useful
 
@RachelDockter the integration is terrible
 
it's very problematic, your account gets limited all the time from personal experience
 
3:50 PM
oh right, i use ebay sometimes where i pretty much need paypal
otherwise nobody will do business with u
 
you are looking at it from user's point of view, not as a developer
 
still here? @tereško
I have a little question
 
4:07 PM
any good xampp alternatives?
 
Wes
get the apache binaries from apache lounge, then php from windows.php.net, then install mysql? :B
 
^
 
Aug 22 '16 at 7:24, by DaveRandom
Get an apache build from apachelounge, get a PHP build from windows.php.net, get a mysql build from Cthulhu, and you're set
 
Wes
once you learned how to do it it becomes super easy
 
4:27 PM
For the record though, my actual advice would be to set up a CentOS VM with nginx instead
 
Hello, I have phpunit question in code review site, maybe you could take a look:
0
Q: PhpUnit data provider - is it better to full array with irrelevant data or have relevant data and construct full array in the test?

Darius.VLets say we have a function which calculates from this input: [ ['id' => 1, 'hours' => 2, 'type' => 'presence', 'some irelavant data' => 'a'], ['id' => 2, 'days' => 2, 'type' => 'presence', 'some irelavant data' => 'b'], ['id' => 3, 'hours' => 3, 'type' => 'presence', 'some irelavant data' =>...

 
!!issue Jeeves mayhaps want to check itself for room permissions before attempting certain actions (e.g pinning, moving, etc.)
 
4:44 PM
any developers here willing to take a look at my code and see why it fails to retrieve a query?
 
@Sean Where is there a missing check?
 
Looking at somewhere between RFC <-> PinOrUnpinMessageAction
 
ah i see
 
morning
 
Evenings
 
yo
 
waddup!
 
5:16 PM
@RonniSkansing May the type checker be with you!
 
are the expansions for Shadow of Mordor any good?
based on reviews, the answer is "no"
/me needs to decide on the next game
any suggestions?
 
5:51 PM
I really like to write a suggestion for you.. But I'm not able !
 
http://stackoverflow.com/questions/42191053/paypal-ipn-returning-invalid-on-deposit
anyone here willing to take a quick look?
 
@Sean Yes I always meant to do that, not sure why I didn't
we already have logic for getting the room owner user IDs
Actions that require RO should just throw
And probably there should be a ChatClient#isBotUserRoomOwner()
 

« first day (2311 days earlier)      last day (2644 days later) »