« first day (730 days earlier)      last day (4444 days later) » 

00:06
Right, I have work in the morning, I'm gonna have to go
Night all
00:59
hello every1
anyone active?
01:16
@qwertymk Read the top sidebar text (right) ;)
quertymk seen 23s ago, talked 23m ago
Funny coincidence :-)
sry bout that
anyway...
I has a question about php and mysql
if I wanted to escape a column name or table name is this enough?

"`" . str_replace('`', '', $input) . "`"
or better yet

"`" . preg_replace('#`|--#', '', $input) . "`"
is that good enough?
@qwertymk Why would you need to do that? Your table names should be hard-coded.
then not the column names
@qwertymk Do you have a lot of database code written already?
01:26
I'm building a class that can be extended
@paul not really
@qwertymk You will want to use either PDO or mysqli. If you don't have a clear preference between the two use PDO because it can also be used with databases other than mysql.
Jun 30 at 13:28, by tereško
Please, don't use mysql_* functions to write new code. They are no longer maintained and the community has begun deprecation process. See the red box? Instead you should learn about prepared statements and use either PDO or MySQLi. If you can't decide which, this article will help you. If you pick PDO, here is good tutorial.
@Paul I'm already using pdo and it doesn't let you escape table or column names
oh, ok, cool.
so how would i escape it then?
@qwertymk Just put ` around all of your table/columns when you code the application, then you don't have to worry about it :-)
01:32
@ShaquinTrifonoff So this is safe:

$sql = "SELECT * FROM table where `" . preg_replace('#`|--#', '', $REQUEST['column']) . "` = 23 "
@qwertymk NO
why not?
you forgot to use prepare.
@qwertymk You are putting user input in your query. I'm typing a longer answer right now...
huh? I can't prepare column names
@ShaquinTrifonoff goody I can't wait
01:43
I haven't tested it, but here it is:
<?php
// Set the allowed column names
$columns = array(
    'foo',
    'bar',
    'blah'
);
// Set default column
$column = $columns[0];
// Set the current column to a different one if $_REQUEST['column'] is in $columns
if(in_array($_REQUEST['column'], $columns)) $column = $columns[$_REQUEST['column']];
// Set up database as $db
$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$query = $db->prepare('SELECT * FROM table_name WHERE `' . $column . '` = ?');
$query->execute(array('23'));
$result = $query->fetchAll(PDO::FETCH_ASSOC);
@qwertymk ^
@ShaquinTrifonoff Can you put that here
@qwertymk You have two issues:
1. not using prepared statements (you need to use them like Shaquin's example)
2. working out how to escape arbitrary column names - [read this answer](http://stackoverflow.com/questions/1542627/escaping-column-names-in-pdo-statements)
@Paul no. he's using a hardcoded value of 23, so binding that value would be kinda pointless
@qwertymk as for the column names, as the answer to your question stated, ask INFORMATION_SCHEMA for the valid ones
and use that as a whitelist
cache the list if an extra query is such a big deal
but why, may i ask, can users specify columns that should go straight into a query?
@Petah I need to be able to use this class after I add more tables without having to constantly be updating a whitelist — qwertymk 2 hours ago
@qwertymk My example uses a whitelist...
@Lusitanian they can't but since the class I'm making can inherit from mine I need to worry about bad input
01:48
wait, what?
@Lusitanian I'm trying to make a base class for all tables in my db, some of the functions can take ui and do querys with them
So why can they take user input for column names? I'm a bit confused by that...
Regardless, just use information schema to whitelist and cache --- that'd be the cleanest way.
Alternatively, what you have will probably be fine --- but read the answer that @Paul linked to be sure and then you can just escape...
Even then, though; I don't see how allowing users to access that part of a query is a good thing --- not that it's vulnerable to SQL injection necessarily but could be vulnerable to information leakage.
@qwertymk Do you still want me to post my answer? It uses a hard-coded whitelist.
@ShaquinTrifonoff Not really, this was really what I was after
I have to figure out how to implement it now
Another way is to use $column = preg_replace('/[^0-9a-zA-Z$_]/', '', $column);.
01:54
If I take bobince's option `a` is this good enough?


"SELECT * FROM table where `" . preg_replace('#`|\\|\0#', '' $input) . "` = 23"

?
@ShaquinTrifonoff based on bobince's answer in that link will what I posted work?
@qwertymk It's better to have a whitelist of characters that are allowed in a column/table name, rather than try to exclude some bad ones.
I'd just be conservative as hell and force it to be alphanumeric but hypothetically speaking that's fine.
@Lusitanian @ShaquinTrifonoff but is there anything vunerable with what I have?
@qwertymk Not off the top of my head... but still...
Tbh it should be okay --- that being said --- I'm still somewhat concerned that you're allowing user input to determine the columns you are selecting...
01:59
what are utf7 attacks and would that be an issue?
7 mins ago, by Shaquin Trifonoff
Another way is to use $column = preg_replace('/[^0-9a-zA-Z$_]/', '', $column);.
Depends on MySQL, actually; I don't pretend to be familiar enough with every single possible attack
and that's why I'd just either whitelist it or force it to alphanumeric, $ and _
^^ Just remove all non-alphanumeric/$/_ characters.
u guys freaked me out enough that I may do that
is this an issue if the default charset is utf8?
@qwertymk The only allowed characters are listed on the MySQL site, why keep any disallowed characters in column names?
02:08
@ShaquinTrifonoff Which ones are they and where are they listed?
> Permitted characters in unquoted identifiers: ASCII: [0-9,a-z,A-Z$_] (basic Latin letters, digits 0-9, dollar, underscore)
That's in unquoted identifiers though
@Lusitanian What does that mean?
if it's quoted it can be anything from U+0080 to U+FFFF ?
 
2 hours later…
04:23
hello guys, can you look at this code http://codepad.viper-7.com/9RUQjo
in my directory folder ClassLib there is class1.php and class2.php . . i loaded a class that is not existing, question? will the other classes be not loaded to? is there any way the not existing class be skipped if it does not exist? and proceed to the next class initilization?
04:42
@tomexsans I think you would want to use class_exists.
@Paul, ahh that's it, thank you ..
05:29
Hello Everyone
I need some help with "E" (escape) of Postgres.
Anyone known to it ?
@qwertymk sorry jumped out of room abruptly
i'm not exactly sure which characters it then allows --- but it's a significantly wider range
06:19
morning
06:47
morning
wake up room
you're on page 2 of the chat list!
07:09
Hello
Need help ... Any CakePHP developer around?
Page 2 of the chat list? lol... wait... there is a page 2?
@NikiC page 2? You mean I'm a page 2 boy?
how are you telling Cake which note the comment is to be associated with? Does your user view a note and then add a comment to the note? I don't know how I can make this any clearer. — Ross 18 hours ago
Morning all
morning people
08:19
morning
08:39
posted on October 15, 2012 by Lorna Mitchell

This is the first in a series of articles about using PHP to do objected oriented programming, or OOP. They were originally published elsewhere but are no longer available at that location, so I'm reposting them here. Since the introduction of PHP 5 in 2004, PHP has had an object model worthy of that description and became a truly modern language for use on the web. Earlier PHP scripts would

@Feeds that "article" sucks!
Pretty much everything Lorna does is out of date by 4-5 years.
I get the impression she just wants attention
@PeeHaa @Leigh It doesn't contain enough to be good or bad, it's just sort of nothing. I wonder if you might be being a little harsh, it's hard to read the basics when you already know that and a thousand times more. It would be like doing a mental arithmetic workbook targeted at 5 year olds. Having said that, it's not as if there aren't enough identical articles floating around already.
I can't see anything wrong in it...
@DaveRandom I guess after seeing many of her posts + conference speeches, it becomes easy to condemn her without even reading,
08:51
@DaveRandom The database example in the PHP world is too outdated. PDO allows that with three lines, assignments to objects can be done on the fly.
I'd consider that problematic if you give an introduction not updating that if the article was old. Because if it is that outdated, it should not be re-published just because it disappeared elsewhere. I'd say, having it disappeared might have been the better choice.
@hakre True, but I'm reserving judgement until I see the rest of the series. It may be that she covers OO MySQL later on. I think that if the target audience is people who are completely new to OOP, berating them for using ext/mysql from the outset is counter productive. If you introduce too many ideas in one sitting people will switch off and they will never learn.
@DaveRandom using mysql_. Extending instead of using an interface (sort of personal preference)
If it would have been an answer on SO I would have downvoted :)
btw something else. I'll build the cv plugin this night @DaveRandom
:D
http://stackoverflow.com/questions/12892331/so-i-need-to-restart-apache-after-changing-the-php-ini-file
09:12
@PeeHaa No worries, I'm going to be sit down and properly look at the porting to FF this week, if and when I get 5 mins to think. I'm going to look at the FF extn architecture, refactor cv-pls so that the browser specific stuff is wrapped in a module/some modules that can be injected so it'll just be a case of packing a different bootstrap and it'll be easier to keep the two in line.
@DaveRandom Nice. I'm thinking about going through all the open issues next weekend
@PeeHaa Like I say, I'm reserving judgement till I see the rest of it. To me it's a bit nothing at the moment, it could be taken in a decent direction where all these things are explained and it could not. If it is not I will happily join you on the nay-saying side of the fence.
@DanishIqbal Absolutely positioned element positioned off the side of the screen, with mouseover/mouseout event handler(s) that animates it.
09:18
thanks @DaveRandom
09:28
@PeeHaa This is done I would say, and if it's referring to the options pages I would say this is done as well
@DaveRandom Could you close them? I forgot my password for github and otherwise I will forget to close the issues :| Thanks
@PeeHaa Done :-)
Great
Hello from Paris...
Bonjour...
Wrong page, ignore me
09:58
how to append a specific element to existing array without overwriting whole array
@shihon $existingArray[] = 'specific element'?
@PeeHaa: yes this one, but i am doing this stuff in foreach iteration, as it is necesaary for me, so it blank out value of previous array elements and append new one with perfect value
Sorry. But I'm having a hard time interpreting what above means :P
@ircmaxell bonjour. baguette. oui oui.
lol
10:06
morning
au secour au secour un serpent
@tereško morning
@ircmaxell if you are willing to spend some money (100+) on fine dining, I can recommend lepergolese.com
Hello every one please help me ...stackoverflow.com/questions/12893417/…
10:22
0
A: how to append data in existing array without overwrite whole array

Barry ChapmanYou have a few options: array_push() array_merge( $curr_array, $new_array ) $array[] = $newValue Good luck!

@shihon , please , get a book about PHP and read it
i would recommend "Beginning PHP 5.3"
array_merge would destroy the array keys and reindex the array. From the question I get the impression the array keys carry some meaningful information that would be lost
Could be wrong though, it's not a very well-written question.
@teresko: how can you say?
what ?
@teresko: that i have to read a php book
because arrays are one of the most used part of php
if you do not understand them, you have not really learned php
A temporary space-time fluctuation around your server that causes time to move faster within it? — deceze Sep 12 at 10:36
lol
@hakre If you look through his answer history you'll see this guy is a danger to himself and others
10:34
Thanks
how to copy all files from one directory to another in same website
cp -R /path/to/sorce/directory/* /path/to/destination/directory/
@GordonM rm -rf /
thanks guys
let me try this
You really shouldn't try mine.
actually i dont have much knowledge of these but i have some similar script who delete files from outside of www directory i will put ur function and thn his function on that script clone
10:58
@DanishIqbal One final warning; that command clears your main partition from all files.
i didnt get ur point and which command ur or Gordon
No, mine.
@Christian You're not nice...
Here's an explanation:
rm -rf /
[remove] [recursively] [without confirmation] [on root]
@DaveRandom Well, I feel bad when the rmrf joke goes bad. But I can't help it if I did warn the guy before.
so y u tell me this
11:01
1. First rule of using Linux: do not blindly trust commands from online references.
^ especially when you ask for them
0. Rule of using a computer: Know what you do.
@hakre :D
@Christian People who run commands without finding out what they do you deserve everything they get.
rm -rf /usr/bin/laden
@hakre -1: Trust everything on the internet, implicitly.
11:03
@DaveRandom I feel bad for the linux drive, not the user. :D
@Leigh Yes that's a fine strategy to come to 0. pretty fast ;)
@Christian Well rm only unlinks it, it wouldn't be that hard to undo
@DaveRandom Right good point. testdisk to the rescue.
@DaveRandom I did rm -rf /, but control-z no undo?!
@Leigh Y U NO UNDO MY STUPIDITY?
11:05
rm -rf / shouldn't do irreversable damage to non-user files unless you sudo it or are idiotic enough to be logged in as root
Of course it will still eat yoru user files for lunch, so don't do it either way.
@GordonM But if I don't log in with root, I can't edit /etc/php.ini!
True!
I'd imagine most shells won't let you do it, it's too well known and I cannot imagine a non-malicious use case. Then again...
PHP should run as root too, because otherwise how is file uploading meant to work?
@DaveRandom. it's not the shells job to protect you from idiocy, the command will work, as its a legitimate command
11:07
Just run everything as root. It's less complicated.
@DaveRandom I wouldn't bet my life on it. :) The philosophy of the shell in *IX systems seems to be "The user knows what they're doing, otherwise they wouldn't be using a shell in the first place"
hello
is there any one who help me?
@GordonM what about *UX systems?
i want to pass some text in select query with single quote without using addslashes function
That's what prepared statements are for
finding a good PHP question on stack overflow shouldn't be this hard :(
^--- if you think you've seen all kinds of question, then you haven't
@DaveRandom: hello, i want to pass some text in select query with single quote without using addslashes function
11:20
@hakre So it's not just PHP getting an avalanche of dumb questions? I almost feel better to hear that.
That's what prepared statements are still for.
A small question... how to effectively manitain timestamps across all timezones in my application ?
Coordinated Universal Time (UTC) is the primary time standard by which the world regulates clocks and time. It is one of several closely related successors to Greenwich Mean Time (GMT). For most common purposes, UTC is synonymous with GMT, but GMT is no longer precisely defined by the scientific community. Background The UTC standard was officially standardised in 1961 by the International Radio Consultative Committee, having been initiated by several national time laboratories. The system was adjusted several times until leap seconds were adopted in 1972 to simplify future adjustments....
Suppose i add a record in to the database at 5PM India local time (with a date time: 2012-10-15 17:00:00)
Now if someone from my country views the record at 6PM, it should show "Added 1 hour ago"
If another person views the record from Los Angeles (GMT - 7.00), then it should show "Added 12.5 hours ago"
@dskanth Look at the difference between DATETIME and TIMESTAMP columns
@dskanth you need to store the timezone information with it (and if daylight savings time was on there or not).
So you can display in which timezone and at which offset the stored data was.
11:35
@hakre Can i store the GMT timestamp value into the database, and then display the time based on the timezone of end user ?
@dskanth Also if you are saying "added <unit of time> ago" instead of "added at <absolute time>", surely you don't want it to show different figures in different locations. If I add something on this chat now, you don't want it to show "12 hours ago" or whatever because that's not true - I only just added it.
Subversion needs to die in a fire.
It's more fragile than a supermodel's ego
@dskanth Yes you can do as well. That would be UTC then. However you will then loose the information about the local time (but UTC is fine for those added X YZ ago)
@DaveRandom yes, you are right
@hakre If i add the UTC timestamp in my database, and then to display the time for another timezone, i need to convert the time as per the end user's timezone ?
@dskanth you normally have UTC time on the server, so there aren't such hassles.
11:39
@hakre So i can just calculate the timestamp difference and display it ?
I read in some forums on stackoverflow that it is better to store the timestamps in UTC
Then probably there would be no point of timezone conversions across all countries
Because a timestamp value remains same at a particular time across the world
And now it's working again. For no apparent reason.
Can we add an elevnth commandment, "Thou shalt not useth Subversion, lest et be smote by commit locks that aren't"
11:56
I am getting seriously f*cked off with the company hosting our backup mail server, they keep blacklisting my IP every time I force a scrape more often than once an hour.
What's up with the retarded flags in this room
@DeadCicada ?
Also maybe Off Topic -> Programmers.SE?
12:30
@GordonM Ah, the "login as root" story.
I just wish I could install/move root stuff without being root.
Alas, I can't.
Of course, there's sudo.
But sudo mv /a /b; sudo rm -rf /mymistake meh...
Hey guys
Anyway, I had a question about singletons and static classes. I'm a bit serious about this, anyone care to discuss? (yeah, I know about the usual mantra in this topic, so please, please, save it.)
I've got a class I'm using both as a static class and for instances. Now, the class has both the callstatic() and call() functions to handle anonymous functions in both methods of approach.
However, after adding the callstatic, I cannot create an instance anymore, and instead get this error: "[error] [client 127.0.0.1] PHP Warning: The magic method __callStatic() must have public visibility and be static in"
@Sommer Well, your function decleration is wrong.
Does anybody have clues for a workaround?
Oh wait hahaha
12:37
It should be: public static function __callStatic(
Yeah it was a public function, not public static
@Sommer :D
@Sommer Should have talked to the duck :)
@Sommer Are you sure that is how you want to solve your problem? Have you read about why many people consider static to be evil?
@Paul, I have my reasons. Bear with me.
Suffice to say that this is (1.) thought out and (2.) subject to change.
It's all part of a stack that lets me treat resources and models in a Ruby-esque way syntactically.
user50049
12:46
static is the love child of eval and magic quotes in PHP
Depends on what you do with it.
In this case, as a rule of thumb, instances are resources whereas static classes are resource collections.
So if I want to register a user for instance, to quickly sketch something up, I'd write this:
$user = new User();
foreach ($_POST['form'] as $index => $value) $user->$index($value);
$user->save();
0
A: How to check history of a Global variable in PHP?

hakreAs already outlined this is not easily feasible. I suggest you pick yourself xdebug and work with it as a remote / step debugger. That being said, you can at least somehow do some tracking your own, but it comes with a price. I give an example, starting with output first (here a CLI script): GL...

Sup Timmy
Then if I want to find the user named Joe, I do:
$joe = User::by_name('joe');
Catch my drift?
Now as a component, this is going to tremendously expediate the construction of API's and resource interfaces via REST or whathaveyou.
I'm thinking of using Rails' approach to this i.e. jotting down for confirmation which objects can be treated as uniform resources in a configuration file, but essentially any entities one makes in the system could be handled out of the box.
user50049
@Leigh South Park reference?
12:52
Anyway, gotta run.
@TimPost Only if you want it to be :D
@Sommer Then, where you call User::by_name your code is coupled to a User class with method by_name. That is tighter than what I would call: $this->user->by_name('joe'). (Loose coupling, one of the benefits of OO).
ok, good luck.
I would be coupled to an interface or specific object.
@Paul Uh, didn't understand that. Interface are not implementation?
Or are you using it as type-hinting?
I would typehint for the interface in my constructor, yes.
@Paul Sensible approach.
12:58
hey any one can answer my question?
hello, i want to pass some text in select query with single quote without using addslashes function
@Crazy4Php why don't you use PDO and its prepared statements?
@Paul: but i don't know how to use that
It is a good time to learn, because:
Jun 30 at 13:28, by tereško
Please, don't use mysql_* functions to write new code. They are no longer maintained and the community has begun deprecation process. See the red box? Instead you should learn about prepared statements and use either PDO or MySQLi. If you can't decide which, this article will help you. If you pick PDO, here is good tutorial.
^someone has got to add that to the room description or something...
@Paul: instead of that can we use str_replace function to replace " ' " with " '' "?
13:11
@Crazy4Php Aren't you worried about SQL injections?
@Paul: actually i used this and its working properly in my script
@Crazy4Php You didn't answer my question. Maybe you are choosing to ignore security?
I guess it may have appeared that I didn't answer yours, but my answer was that question.
@Paul: you mean to say whatever i do is not secure, isn't it? so which type of problems can be occured?
@ShyamK I count 97 stars for different versions of that message.
@Crazy4Php Search for: bobby drop tables.
@Paul really? then why doesn't someone actually do something about it?
13:18
posted on October 15, 2012 by Rafael Dohms

So last week I published my review of PHPNW12 and instantly my whole server went down in flames. My current WP setup has a few issues with multi-lingual plugins which I can’t get over yet, as it requires a bit more of invested time. But this can’t go on, I needed a solution, a fast and simple one to give my blog a fighting chance. As it stood I already had caching, but i’m guessing that was no

@ShyamK We need to kill the old internet and all of the junk tutorials first.
we need to kill w3schools first...
half of the problems arise from that one site...
user50049
@ShyamK Wow, kill it? It was hard enough blocking all of their many subdomains from search results
search for anything coding related and w3schools is at the top of the list and its common belief that Google search engine is perfect And that The first link on Google is the best link for your query
@TimPost If possible, yes.
user50049
@ShyamK I thought the last 'panda' round knocked them down quite a bit
user50049
13:31
"Yes, I'm certified. I'm certified by w3schools" .. Interview ends ...
12
did you make sure to hit him with your keyboard as well?
lol... certified by w3schools...
"w3schools............ GTFO"
user50049
13:33
runs
Hi. Do you know if it is possible to login to Facebook programmatically? I'm thinking about using a cron job to achieve an automatic poster with Facebook, but I've been thinking that I need to be logged in on the server.
@ShyamK Guys got issues
13:45
@hakre That is a candidate for every close reason available.
@hakre 1 dupe vote, 1 not a real question and 2 too localized
user50049
13:59
My little assertion class is coming along nicely. I might put it on Github at the end of the week
user50049
Nothing really spectacular about it, just a lot of code you don't have to write in order to add some hot sauce to your tests

« first day (730 days earlier)      last day (4444 days later) »