« first day (1344 days earlier)      last day (3830 days later) » 

23:00
We like helping people who help themselves.
@Fabien Ok will keep that in mind, I'm just new to PHP so I have a lot of questions towards it.
@PeeHaa nothing special. regular sf stuff. basically all calls call to /api have to be secure. with the exception of one route: /api/login. That one uses a different authenticator.
You're new so a lot of issues you will face have been faced by a lot of people out there already.
I just also realised @PeeHaa, I just read the manual and it said to use %'s. Maybe thats why.
@Gordon I believe Mr Maxell would say that security checks like that should be done in the services that the controllers call...he hasn't been able to provide a link to a demo of what that would actually look like.
23:01
BTW @Gordon you may want to ask @GoldenJoe to chillout and open a beer: stackoverflow.com/questions/24346487/…
i.e. no matter who is calling the service, the security check is done by the service, as only it can be sure what it's security requirements are.
@Fabien Looks like @ircmaxell's dp.
It's his channel.
Oh wow, 3k subs nice.
Make it 3001.
23:03
I will if I like the video.
:D
@Danack But in case of symfony the firewall thing handles that
@PeeHaa Yeah, the problem is that you've then got to keep the security things in sync, and not ever forget to update the firewall settings.
@Danack i trust the sf firewall to handle whatever I configured it to handle. However, I do not trust the configuration. if someone changes it and all of a sudden my precious resources are accessible without authentication, it would be a problem
@Danack True, but that answers @Gordon's question I think for exactly that reason. Yes you would have to test the security for all the things
@Gordon Isn't there a way you can simply test the configuration instead?
My code currently works like symfony that and it sucks having to keep things in sync.
23:06
Well it's one way to use an Arduino :P
@Gordon "if someone changes it and all of a sudden my precious resources are accessible without authentication, it would be a problem" Yeah, which is why having it on the service makes it a lot less likely to fark up i think.
As if you change a service to do something more dangerous, it's a lot easier to modify the permissions required there, rather than track down everywhere that service is used.
@PeeHaa I could probably create a testcase that checks all calls to /api are protected except that one. but that's basically what I am doing already. Just that I am putting the check into the various controller testcases.
@SecondRikudo Security guard at my local shop has the hidden lead tattooed on his forearm :P.
@PeeHaa I'm quite nice when people are nice to me. I don't have time any patience for smartasses, however. This site has gotten so much worse in the last year, I wonder where the helpful half of the community fled.
@GoldenJoe They ran of because of people like you I'm afraid
I mean, how is:
> Since some idiot marked it as a duplicate
in any way meant to get people motivated to help you?
Or this:
25 mins ago, by GoldenJoe
Honestly, this room is such a waste of time.
23:10
@PeeHaa I think i'm getting closer, execute(['downloadID' => "'%".$_GET['id']."%'"]);
Or any of your comments
@PeeHaa "The beatings will continue until morale improves."
@RahulKhosla You know what % does?
@Danack :)
@Fabien I read a article that says it helps the LIKE query by searching a part of a word or phrase?
I assume it meant that.
23:12
Oooooor even this:
Would you like a copy of my browser history? What kind of comment is this? — GoldenJoe May 24 at 1:45
So you if your id is 7 you want to grab anything with a 7 in it?
Searching 'part of a word or phrase'.
Yes.
@Fabien Eg; My row says "buttons vector psd art solid modern" I can search for "buttons" and i'd get the result.
Is thats correct
Right. So as I mentioned. What happens when someone uses ID 7
I assume ID is an int
23:15
Yes
I don't have an id 7.
So it would show a blank page.
I haven't grasped error handling with PDO yet.
Ok. Let's assume at some point you have a lot of IDs with many containing 7
What happens then?
When you want ID number 17
Nonono you got my result wrong, gime a sec.
@bwoebi you here?
@Fabien $downloadStmt = $db->prepare('SELECT * FROM items WHERE id = :downloadID');
$downloadStmt->execute(['downloadID' => $_GET['id']]); ?>
<?php foreach ($downloadStmt as $row) { ?>

$relatedStmt = $db->prepare("SELECT * FROM items WHERE tag = (select tag from items where id = :downloadID)");
$relatedStmt->execute(['downloadID' => "'%".$_GET['id']."%'"]); ?>
<?php foreach ($relatedStmt as $row) { ?>
Ow wait. @Danack you are also a apple guy right?
You have an iphone ?
23:16
@Danack @PeeHaa so did I get you right that these tests are not unneccessary?
yes.
Sorry for not using pastebin.
user924016
Its evil
How many tags do you plan on having?
@Gordon I would say test that shit if there is no other way to confirm that everything that is secured is secured
23:18
@Fabien Roughly about 1–10+ on each ID. Heres my table so far gyazo.com/db7d851f485cd8bff96a8a2680a4ba03
user924016
@RahulKhosla still troubled with a blank screen?
@RonniSkansing Haven't done the error handling yet.
thanks guys. thats what i wanted to hear.
@Danack I might ping you later to test something for me :)
and good night
23:18
@RonniSkansing But yes, troubled.
night @Gordon
user924016
@RahulKhosla well for one the argument is passed as a string
user924016
your probably want it as a int
@Gordon yeah I think they're definitely necessary if you're doing security like that. And that's why I don't like doing security like that especially as it's how I'm currently doing it.
@PeeHaa cool.
user924016
also you are missing a : in there
23:19
@RahulKhosla So if you have 11 tags. And you want Tag number 11 what would your last query look like?
user924016
anyways try
$downloadStmt->execute([':downloadID' => $_GET['id']]);
@Fabien You see the first query and foreach? This displays the product. The Second query and foreach will display the related products.
@RahulKhosla The ID is unique yes?
user924016
else try and use prepare and then bindValue with third arg PDO::PARAM_INT
23:21
So why are you using a search wildcard that means 'anything'. the %
[ANYTHING] $_GET['id'] [ANYTHING]
It's a unique ID so you want an exact number
So for example, if first query and foreach is displayed, the second query and foreach will use the data from the first one to search for the related tags.
@Fabien can I just pastebin the code?
No. You're not understanding what % is for.
to explode the tag column.
As it uses spaces
$relatedStmt->execute(['downloadID' => "'%".$_GET['id']."%'"]); ?>
that isn't the tag column
So I would be searching "button" rather than the full thing ("button vector psd........")
@Fabien $relatedStmt = $db->prepare("SELECT * FROM items WHERE tag = (select tag from items where id = :downloadID)");
23:25
select tag from items where id = :downloadID
You're not searching the tag column
tag =..
Select the ID to find what id the tags are in.
Ok. Just run the subquery by itself.
It will use that '1' to gather the data to display the product, and then use that data to also find the relevant tags to display the related products.
What would the query look like if you were using mysql? Just the subquery
Im assuming you're meaning this one right? "SELECT * FROM items WHERE tag = (select tag from items where id = :downloadID)"
23:28
No. Show me just the sub query as if it was mysql.
"SELECT * FROM items WHERE tag LIKE id = 1"
So use download ID 7
id would be the get
Where have your %'s gone?
"SELECT * FROM items WHERE tag LIKE id = {%$_GET['id']%}";
I can't remember how I had it before.
23:30
You on windows? What OS are you on?
Do you know what the * wildcard does when searching stuff on your mac?
* = ALL
Same as %
So *.jpg would return all your jpg files yes?
* is for SQL.
23:34
It's for a lot of things
So you're query
select tag from items where id = '*7*'
Which returns anything with a 7 in it
Btw this is my search query
$searchStmt = $db->prepare('SELECT * FROM items WHERE tag LIKE :usersearch');
$searchStmt->execute(['usersearch' => "%".$_POST['search']."%"]);
This returns 1 result also, but it's the correct result.
user924016
remember the : in the execute
user924016
or is it not needed?
23:36
It makes no difference.
user924016
oh
So the last query ^ is for my search, it successfully breaks down the tag column.
So I can search for 'button' and it would find the result with the tag that has the word button. But the problem in this, is that it only will display one result.
Where as two of my rows use the word button.
What is this doing then? $relatedStmt->execute(['downloadID' => "'%".$_GET['id']."%'"]); ?>
My attempt to find latest products.
Based on a download ID provided? Which is the unique ID of the items table
23:49
items table
So You want them to potentially grab more than 1 ID?
if the get changes.
so yes.
No. We're on about a single request
You are using %'s
So you're saying grab anything with THIS number as part of the ID.
So if the ID was 1 it'd grab any ID with 1 in it.
Thought it would break down the "buttons vector psd art solid modern" to "buttons" "vectors" .....
Which is 1, 10-19, 21, 31, etc.
23:51
ID has nothing to do with it
I just want the tags.
ID is a way to find the tags.
26 mins ago, by Fabien
select tag from items where id = :downloadID
ID has everything to do with it
Yes but I use it to find the tags
That ID you use downloadID which uses %s yes?
Oh... I get what you meen now!!!
@webarto HAH. Nigeria!
23:53
It should be more like (select %tag% from items where id = :downloadID)");
No. I am in a very LONG winded way telling you to learn what % does and how to use it.
In this case the answer is not at all
Because % is the same as *
@Fabien That stolen goal could change much but after seeing Iran play today against Argentina I would bet much on Bosnia - Iran...
Right, so far I have
$relatedStmt = $db->prepare("SELECT * FROM items WHERE tag = (select tag from items where id = :downloadID)");
$relatedStmt->execute(['downloadID' => $_GET['id']]); ?>
@webarto TBF my other team Ghana just drew with Germany too. Who'd thought Ghana and Nigeria would end up such good picks :p
This displays one result, because "buttons vector psd art solid modern" is not broken down to "buttons" "vectors" .....
23:55
@RahulKhosla Better. Now what does an example result from your subquery look like?
Yup exactly
So what I need to do is find out how to break these down?
Correct
Easily done in PHP.
Any ideas? :D
So I assume I need to use explode();?
If it fits your cause yes.
But the question is, how do I explode the full column, not just of one row
23:58
You'll figure it out. But stop making sub queries till you know they do what they're supposed to.
I need that sub query.
To explode later.
You need a set of tags. You don't need a sub query.

« first day (1344 days earlier)      last day (3830 days later) »