« first day (2313 days earlier)      last day (2626 days later) » 

5:00 AM
Yeah I'm about to give up and go to the gym lol
 
function CreateTheUser() {

//Current Timezone stamp
date_default_timezone_set("Australia/Brisbane");

//Grab Data

$username = test_input($_POST['input_useN']);
$mirname = test_input($_POST['input_name']);
$date = date("d/m/Y");
$email = test_input($_POST['input_emai']);
$area_user = test_input($_POST['input_area']);
$password = test_input($_POST['input_pass']);
$enrypted_password=md5($password);

//=================================


// create user

$Exsistingqry = "SELECT * FROM user WHERE username = '$username'";
sorry for the huge stuff, but nobody is around, and you need to understand.
$conn is not in the CreateTheUser function
 
"need to understand" - how lovely :)
 
if that was the function running, you would not even get to that point
 
isnt $conn a global variable?
 
I feared as much
well, basically no, it isn't. unless this is not the script you are effectively executing
 
5:02 AM
no
 
ok, 1 sec. let me try something
 
good luck lol
 
Oh oh, I don't know if this is the right timing. But, do not use md5() to hash passwords, use password_hash() and password_verify() instead!
 
hahaha
yeah, there's that too
one life changing realization at a time, shall we?
 
Haha, this made me laugh really hard
 
5:04 AM
This is coming from a form, you have to validate the data too.
 
Yep, so moved the $conn into the function and it worked as implied. Will researchthe password_hash/verify now as well. thanks.

So, if I wanted to make it $conn a global variable for this script could I or is that a big non o?
 
How do you know the email is actually an email.
 
In case you are interested, here is a class I wrote, that is somewhat clean ( I know about the depency injection, yes yes. ).. Take it with a grain of salt, but yeah... pastebin.com/M3A3jSP7
I wrote it for someone else as an example, I haven't actually tried or overlooked what I did there
 
@SalOrozco: email verification done at javascript side it looks for a @ and a ._somethign.

If the user wants to put a fake email in then thats their beef for now.
 
5:06 AM
You cant be so trusting.
 
if (filter_var($email, FILTER_VALIDATE_EMAIL)) { ?
 
yeah
they can access your script directly.
 
Is that to me?
 
probably to me
 
well, to be fair, the test_input function is stripping slashes
 
5:07 AM
lol
 
but all of this would be unnecessary would you use PDO
 
I used the test_input to remove anybody trying to insert code into the input but will review the pdo as suggested
 
Prepared statements, you should learn that
PDO or mysqli_
 
@SalOrozco @Nytrix will use the filter_validate_email
 
You also want to allow the script to run if, it's $_POST
 
5:11 AM
so check if its $_post and if true then only run script?
 
In all honesty, this script is very questionable, but then also very.. As it stands right now you can disarm it from the left, right, top, bottom, sideways, who knows what else.
 
if($_SERVER['REQUEST_METHOD'] === 'POST')
 
@SalOrozco do you use routing?
 
@Nytrix : Learners curious question.

Without the PDO what damage could you do to the db with this script?
 
SQL injection
 
5:13 AM
Barely
 
"barely" - is still very questionable. "I barely killed this man", you still killed him.
 
haha
 
haha
 
lol. in this case, barely could mean once a year :p
 
maybe like 3 times a year.
 
5:14 AM
Once a year I could potentially be hit with SQL injection?
 
lol. sorry for confusedness
 
No routing is something else.
 
I mean, it's not a statistic how many times you will be hit if you are open to SQL injection. The fact is, you still are, and you shouldn't
 
Ok, so the PDO will improve on the SQL injection and all round better security
 
5:15 AM
\o
 
hi
 
No.., you can do this with mysqli_ aswell
 
Correct
 
You just need to use prepared statements
 
*parameterized statements
 
5:16 AM
Yes, what he said
 
you can still prepare a statement containing concatenated unsafe values
 
It won't do anything though...
 
wrong
it will totally be executed and inject sql
$stmt = $pdo->prepare("SELECT * FROM bar WHERE id='$id'");
$stmt->execute();
^ injected
 
Yes yes, I get your point
Obviously don't do it like that while you are at it
 
out of another curious question.

What SQL injection would you do? Delete all my users? Add yourself as a user? Im just wondering what the hackers mind would think if he played in my db.
 
5:18 AM
You can make it return true, so you get logged in, always.
Or delete everything
Or, many other things
Just think what happens what someone can do with a free range through your database
And also, what it returns
 
"$stmt = $pdo->prepare("SELECT * FROM bar WHERE id='$id'");" Wouldnt the htmlspecialharcars remove the >?
 
It will make your queries like SELECT * FROM Users WHERE UserId = 105 or 1=1; which is always true and let hacker get in
 
morning
 
o/
 
\o
 
5:20 AM
It's not literally like that, but to give you an idea. It's not like that because you escape the string.
 
busy now a days?
 
yeah
 
maybe. the point is that using parameters, such as SELECT * FROM bar WHERE id=:id prevents any kind of injection, and you don't have to manually try and escape values
 
New job ha?
 
yeah right
 
5:21 AM
How it's going?
 
@FélixGagnon-Grenier I've been trying to convey this message al along.. pff
 
it's around 10 to 11 hrs job ..
 
Im reading your messages. Im getting you. Im also just probing to learn more from you
:)
 
Oh my god
 
5:22 AM
yes?
 
heh. what a shark ;)
 
Thanks for your help, Im going to afk from here and go mess around with my code some more. Again, thanks for the help
 
great. have a nice day
 
ui,laravel,php...
 
Have a good one
 
5:23 AM
Im still online here if you want to insult me from a distance tho. Haha. Just not on my main screen
 
Haha, I will try my best :)
 
morgen
 
hey
 
o/
 
5:43 AM
hi @Akshay checked your profile.. hows PHP scene in Ahmedabad ?
 
Hello @Vamsi It's awesome
here Most companies are relying on PHP now a days!
 
yeah. noticied .
 
Where are you from?
 
Bangalore
 
I was in Bangalore previously
Awesome city to be!
 
5:49 AM
depends :D
if you are close to work place, it can be
 
Yes obviously! I was traveling 4 hours a day
from j.p.nagar to dasarahalli
:p
 
lol
 
hahaha!! traffic sucks !
 
6:17 AM
posted on February 14, 2017

New Cyanide and Happiness Comic

 
6:46 AM
moin
 
Hi guys
Is there a way to give a name to open with window when click on a download link ?
am using javascript to export the table data to excel sheet
 
add a target="_blank" attribute in the a tag
(from memory)
 
That open with pop up window is there coming but the name is some sort of random
window.open('data:application/vnd.ms-excel,' + encodeURIComponent(tab_text));
and the above is last line of my script code
 
7:04 AM
wat are u doing?
 
7:14 AM
generate a excel sheet of some data in html table on clicking download button
want to download html table data as excelsheet
that's exactly what I want
@RonniSkansing
 
okay, So I guess that worked?
 
7:52 AM
^ read it and if you got wp account complain to core.trac.wordpress.org/ticket/39309#comment:20
@ScottArciszewski I think maybe getting alot of security peeps commenting on the post might be a way forward
 
ugh. looks like I'll definitely have to get rid of my gf's wordpress…
 
tl;dr wordpress makes security mistake, also sky is blue and water wet
 
@PaulCrovella "sky is blue and water is wet" => depends on the conditions kiddo
in the evening it's more purple-ish, and frozen water is not wet
BUT, wordpress security mistake is a constant for sure
 
Let me rephrase that
tl;dr wordpress makes security mistake, also light travels in vacuum at 299792458 meters per second.
There. That's better.
 
thanks for physical correctness
<this conversation has been moved to chat.physics.SE>
 
7:58 AM
@ScottArciszewski Honestly though, in the few cases where I need a wordpress website, security is the last thing I care about.
 
^ well only if it's not online I hope?
 
It's usually a set-and-forget kind of deal where I set up a landing page or whatever, and forget about it.
Nothing mission critical.
 
hmm that seems problematic
 
@MadaraUchiha you could put a static landing page, couldn't you?
 
The thing about security is that things need to be secure enough, else you can spend infinity money on security.
 
7:59 AM
each forgotten wp instance becomes a security issue that hurts other people at some point (maybe, probably)
 
there's good stuff here blog.mozilla.org/feed
 
You secure your bank account (hopefully) more than you do some random wordpress installation
@Trucy Depends on my needs, it was just an example.
 
@MadaraUchiha I'll have you know that my bank account is protected by a full four digits password
much sercure
very saefe
 
@Trucy To be fair, bank accounts have other protections
But yes, I agree that the state of passwords in banks is deplorable.
 
@MadaraUchiha I'm aware of that, but why only authorize a 4 digit number when you can let the user put whatever they want
 
8:02 AM
@Trucy Because database from the 1980s
 
Also: "password cannot be longer than 20 character"
 
8:18 AM
@MadaraUchiha it doesn't have to be a mission critical site to endanger its users (when you suddenly find it serving up malware) or others on the internet (when it turns out to be part of a botnet)
 
@PaulCrovella That's true, but it's a risk-reward kind of thing
You do the minimal, cheap actions to make it as secure as possible without putting too much time into it
And then it's safe against most common wideshot attacks
It wouldn't last long against a determined attacker, sure, but I'm counting on there not being one because the site isn't interesting enough.
 
That's only because you dont have to pay the risk
 
meurning
 
The risk is free. oh my site DDoS or spread malware whatever
 
@RonniSkansing That's also true.
 
8:25 AM
It's like throwing garbage in nature =)
or not really
but yea [=
 
@RonniSkansing Not exactly
It's like someone sabotaging your car to release toxic gasses into nature
Who's fault is it? Yours, for not protecting your car? Or the attackers'?
On the one hand, I'm all for holding websites to a higher security standard by law
 
hah, metaphors and parallels never work as intended
 
On the other, it's unfair to punish a website owner for the actions of a malicious person.
 
Yes it's clearly problematic, I dunno who's fault it is, I dont like pointing fingers unless at my self
 
8:57 AM
moin
 
it's little different from running an open mail relay - you might not be the spammer, but you're still negligent
 
morn @DaveRandom
 
9:20 AM
A website lists "French Antartic lands" as a country they can send their products
I guess even hardcore scientists need their dose of MtG
 
Moin
 
ThW
Morning
 
o/
 
\o
 
@Trucy Send them a couple of fuzzy socks.
 
9:34 AM
@MadaraUchiha it's a tabletop store
 
@Trucy Send them a fuzzy tabletop then.
 
"So err, you don't have warm socks or sweatshirts, but HEY look, a booster box of the lastest MtG expansion!"
 
@PaulCrovella wut
 
Anonymous
Happy Valentine's day @rdlowrey <3
8
 
Anonymous
9:38 AM
moins
 
Mornings
 
Why did Google Car switch from MD5 to SHA512? *They wanted to reduce collisions.*
 
Happy Valentine's day @all
 
!!dad
 
9:42 AM
I bought shoes from a drug dealer once I don't know what he laced them with, but I was tripping all day
 
haha, classic Jeeves
 
Does anyone have anything they need to/ready to push to php-src?
We should definitely commit a change to a widely used programming language just so I can test lxr
 
Every time I see Jeeves' dad jokes, I'm tempted to kick him before looking at the username.
 
@MadaraUchiha is "telling dad jokes" a good reason to kick someone? :D
 
I'm not entirely sure what will happen if you kick Jeeves but please lets not test that right now :-P
 
9:44 AM
!!version
 
@MadaraUchiha ya gotta do what ya gotta do
 
@Sean I will fux my fick up today
 
God, Jay.
 
Im not sure, what the bad part was?
 
9:44 AM
 
talking about drugs?
 
@DaveRandom Thanks! I'm not sure how or why it broke but I'm happy you do :P
 
I'm with Dor, some of those jokes are offensively bad
@Sean I haven't looked yet
yesterday, by DaveRandom
@Sean put it this way: I haven't tested either of these two at all, yet I still have just pushed them to master BECAUSE THAT'S HOW COOL I AM
 
Cool guys don't look at deployments 🎶
 
I was expecting this to happen probably, I just couldn't be bothered setting up a test env (by which I mean: finding the user/pw for my test user)
 
Anonymous
9:47 AM
@DaveRandom please stop quoting this.. I'm still trying to pretend I know what I'm doing
 
@DaveRandom AzureDiamond / hunter2
 
@JayIsTooCommon :-P
@PaulCrovella I'm sure that's a reference to something that I don't get
 
@PaulCrovella Classic.
 
My SO password is *******
 
9:49 AM
@Trucy Hey! How do you know my password?!
 
@PaulCrovella wut I have never seen that one
 
you're a filthy liar
 
@MadaraUchiha u g0t pwnd
 
!!xkcd lucky 10000
 
9:50 AM
@DaveRandom ^
 
\o/
@LeviMorrison so nuking the box sorted out the \o/ disk space issue \o/ although there's still weird shit going on with it, I can't check out anything over ssh failed: (publickey) on public github repos, and when I initially generated the key it didn't actually add it to ssh-agent, I did it manually and it now seems to be sending the key and still failing
so that's weird but it doesn't really matter for now, I've just used https checkout instead
 
mornes! o/
 
Anonymous
o/
 
10:10 AM
For a smaller site, reckon it's fine to just generate and upload stuff straight to S3 in the same page load? I'm not particularly sure how to handle fire and forget requests to queues when the user has to wait for the stuff to be uploaded anyway.
 
it's fine until it isn't
 
I get queues and how they're useful, but I'm finding it difficult trying to figure out an actual implementation
At least without running your app on websockets lol.
And even then I wouldn't be sure on what to send over as queue data. The file ID in a database so you can track / update the status? The file path? So many questions hahah
 
Anyone know how to pass array as method parameter when using symfony's expression language? ie: "@=service('router').generate('some-route', ['someVar'=>'someValue])".
This one gives a syntax error (Uncaught Symfony\Component\ExpressionLanguage\SyntaxError: Unexpected character "=" around position 8)
 
@Sean I think that's it github.com/Room-11/Jeeves/commit/…
@DamienOvereem missing ' at the end
 
True, but wasnt the problem. Did find it though, seems it likes a json format when using arrays
 
10:23 AM
oh that also makes sense
I don't know much about symfony in general
 
Happy Valentine's day @@rdlowrey
 
Anonymous
eh works
 
ffs @PeeHaa
wait the <3 disappeared as well
That may be some weirdo edge case because HTML
I really have no idea how that happened
 
@ is "shift+2" and 2 is less than 3 so it took <3 and shifted it
 
10:29 AM
:-P
 
Anonymous
@DaveRandom or an after ping thing
 
@PaulCrovella shift + 2 is "
you nutter
 
OK @LeviMorrison so web01 is now refusing my ssh connections after a reboot and web02 is timing out :-S
 
@DaveRandom Thought it might be, but I tried it last night removing them and it still broke. I think I've got Jeeves on my work PC, I can give it a test over lunch.
 
Anonymous
eh :s It must be that? The line on 79 won't get hit if it's null?
 
Anonymous
10:40 AM
or was it a different break when you removed them?
 
Anonymous
 
Anonymous
!!issue Remove tweet - Remove old tweet plugin
 
@JayIsTooCommon Issue created - github.com/Room-11/Jeeves/issues/163
 
of course it has two twatter plugins...
 
Anonymous
10:45 AM
:P
 
And it used the wrong one?
 
10:57 AM
@DaveRandom also blame rdlowrey for including the @ in his twitter handle on his profile page (may want to ltrim that)
 

« first day (2313 days earlier)      last day (2626 days later) »