last day (21 days later) » 

user652649
18:31
haha
Feel free to invite people over.
user652649
@DarkAshelin will surely be a regular member
user652649
talking about php, i'm refactoring the persistence layer of one of my appz. when you update an entity do you use to keep track of changes locally using two arrays $original and $new and flush all the changes all together in the database, or you write directly to db?
user652649
that wasn't a novice question, is it? :D
18:47
@Wesabi I often write directly to storage.
Although it depends.
It's generally accepted to map all domain objects to storage after all changes were done on them.
user652649
atm i'm using two repositories, one that holds the original state of the entity, one that keeps the changes made, when the transaction is finished, i call $this->flushChanges()
user652649
i want to get rid of this, but i'm not sure :\
This is a question I'd actually recommend that you ask on the regular PHP room
There are a lot of users there that can help you better than I can.
user652649
ok. going to buy beer then. will need it
user652649
xD
19:00
Hi
Whats wrong with this? $user_first_name = echo ($row->first_name);
You're using () with echo
I tried without
echo $user_first_name = $row->first_name;
19:01
Also don't put echo there at all
I need to echo it
What @bjb568 said
Im wanting to do just <h1>$title</h1>
Rather than <h1>echo $title</h1>
<h1><?php echo $row->first_name; ?></h1> then
or <?php $user_first_name = $row->first_name; ?> <h1><?php echo $user_first_name; ?></h1>
Im using this before:
while ($row = $userStmt->fetchObject()) {
$user_first_name = echo $row->first_name;
$user_last_name = echo $row->last_name;
$user_download_limit = echo $row->download_limit;
}
19:03
<h1><?=$user_first_name=$row->first_name?></h1>
Then
<h1>Welcome <?php echo $user_first_name; ?></h1>
I can't use $row again, its within my while.
You're putting the echo in the wrong place
echo $user_first_name = $row->first_name; < correct, $user_first_name = echo $row->first_name; < incorrect
echo '<h1>Hello, ' . ($user_first_name = $row->first_name) . '</h1>' This?
Ok take a look:
<h1>Welcome <?php echo $user_first_name=$row->first_name; ?></h1>
Notice: Trying to get property of non-object in /Applications/XAMPP/xamppfiles/htdocs/photo/account.php on line 11
Well you defined $user_first_name already, so no need to use $row anymore, right?
so then just echo $user_first_name;
19:05
So I DO need the while right?
yes
I can just use $row outside.
while ($row = $userStmt->fetchObject()) {?>
    <h1>Welcome <?=$user_first_name = $row->first_name=?></h1>
<?php }
I'd recommend using a ORM
Ok thanks, im doing it a bit differently.
Im a novice.
19:06
<?php echo ORM::for_table('some_table')->where('user_id', $id)->find_one()->first_name; ?>
while ($row = $userStmt->fetchObject()) {
$user_first_name = $row->first_name;
$user_last_name = $row->last_name;
$user_download_limit = $row->download_limit;
}
?>
<h1>Welcome <?php echo $user_first_name=$row->first_name; ?></h1>
<?php } ?>
I don't want to be querying all the time for each thing.
Why are you defining $user_first_name twice?
Thats why I have
$userStmt = $db->prepare("SELECT * FROM users WHERE email = :email");
$userStmt->execute([':email' => $_SESSION['email']]);
first and last
Oh thats a mixup
thats what I had to show you before.
It's just
<h1>Welcome <?php echo $user_first_name ?></h1>
how about function userFirstName() { // the while code and return $row->first_name; }
then just <h1><?php echo userFirstName(); ?></h1>
So I'd make 10 functions for each thing from 1 db?
19:09
or just function user($key) { return $row->$key; }
then you can use one function, like <h1><?php echo user('first_name'); ?></h1>
$user = getUser();
echo '<h1>Welcome ' . $user . '</h1>';
I like the $key
Ok, so any guides to set this up?
user652649
it's no time for php now. WC final!
user652649
later
Watching it :P
19:11
@RahulKhosla laravel.io/bin/PxraP
something like that
hope you understand the picture
yeh thanks
But the problem is..
I don't want to query all the time
One query would sort it out?
user652649
while ($row = $userStmt->fetchObject()) {

return $row->$key;

}
I don't know the best practices for that, but why not run the query into $_SESSION?
user652649
why not just return $userStmt->fetchObject();
$userStmt = $db->prepare("SELECT * FROM users WHERE email = :email");
$userStmt->execute([':email' => $_SESSION['email']]);
function {//stuff}
------
@Wesabi
while ($row = $userStmt->fetchObject()) { im doing that now.
I think
19:14
something like that?
So far:
<?php
while ($row = $userStmt->fetchObject()) {
$user_first_name = $row->first_name;
$user_last_name = $row->last_name;
$user_download_limit = $row->download_limit;
}
?>
<h1>Welcome <?php echo $user_first_name ?></h1>
<?php } ?>
Haven't tested it of course, just wrote it fast, but something to give you basis on.
Probably test if there is a user too... laravel.io/bin/qYEWO
@bjb568 This worked thanks!
$userStmt = $db->prepare("SELECT * FROM users WHERE email = :email");
$userStmt->execute([':email' => $_SESSION['email']]);
$user = $userStmt->fetchObject();
?>
<h1>Welcome <?php echo $user->first_name ?></h1>
Follow up question, is that safe?
$userStmt = $db->prepare("SELECT * FROM users WHERE email = :email");
$userStmt->execute([':email' => $_SESSION['email']]);
$user = $userStmt->fetchObject();
if ($user)://Don't welcome if there is no user?>
<h1>Welcome <?php echo $user->first_name ?></h1>
<?php endif;?>
Yeah, probably.
19:21
if ($user): needed?
Im having a full page check, if isset $_Session.
Yeah, if the email isn't found in the database but is still sent.
Ok thanks.
@bjb568 What is if $user doing?
It's the user that came out of $userStmt->fetchObject(). You can access $user->first_name and $user->first_name and whatever else any time you want after line 3.
I always assumed I needed to sanitize table data by putting it into a var.
echo $user->first_name is just direct.
Oh yeah, XSS if the first name happens to be <script>alert('pwnd')</script>.
19:26
That's not sanitizing data if you write one variable to another
Oh
I dont think people can XXS
I've used PDO
<h1>Welcome <?php echo htmlspecialchars($user->first_name) ?></h1>
@bjb568 Also if $user means, yes ok, it will allow all table data I set, but whats the else???
@RahulKhosla PDO doesn't prevent bad things going into your HTML. It just prevents bad things happening to your DB.
Oh, so htmlspecialchars is needed on all my echos from user input?
19:28
Yes.
It makes <script>alert('pwnd')</script> (which is bad if it gets into your HTML) &lt;script&gt;alert('pwnd')&lt;/script&gt; (which is just harmless text)
Unless you actually want to display html, then you need a bit more complex sanitizing
Its only user info.
And emails.
@RahulKhosla Nothing else.
Ok thanks...
:D
OFFSIDE FFS
Anyone watching this?
@bjb568 Should I be using htmlspecialchars for user input into database?
19:38
You could either HTML-sanitise before or after putting it in the database. As long as you don't do it twice, or not at all, it doesn't really matter.
I personally prefer doing it while displaying instead of before putting it in the DB.
Ok thanks, well PDO will handle that anyways for db as one of you said.
user652649
@RahulKhosla in the database you should store the plain data
@Wesabi Just as the user enters it?
user652649
yes, even if it's dangerous
I use PDO anyways.
user652649
19:50
<input value="<?=html($record->name)?>">
user652649
that's the good way to do it
@RahulKhosla Think about it this way
Also do I need htmlspecialchars($user->account_creation); if its not user entered? If its just generated time like ':account_creation' => date('Y-m-d h:i:s'),
When the user enters the data for the first time, do you know where it would be outputted?
19:51
Nope.
The user's name could be outputted in HTML, that's true.
user652649
:D
But tomorrow it may be in an Android application
user652649
^ that
Or in a REST API
Or in a desktop
So what should I be doing??
user652649
19:51
in the database you always store the plain original data, even if it looks dangerous
@RahulKhosla Escape only when you know for sure where the data is going to
I've got ':first_name' => ucfirst($_POST['first_name']),
That's generally right before you actually output.
Thats for PDO so no one an drop tables.
For output I have echo htmlspecialchars($user->first_name);
Excellent.
That's exactly what you need.
I'd argue that you don't need ucfirst either, but that's your choice.
19:53
Why? should I do that when outputting?
@RahulKhosla Well, you might want to get the raw data sometime.
It's best not to alter anything until you absolutely need to.
Why its just for a first name
Welcome rahul or Welcome Rahul
Like I said, it's your choice.
I would have done it on output.
Ok I'l do that.
thanks
It doesn't matter like HTML escaping though.
19:55
The follow up: do I need htmlspecialchars($user->account_creation); if its not user entered? If its just generated time like ':account_creation' => date('Y-m-d h:i:s'),
@RahulKhosla It wouldn't matter anyway.
So should I not?
htmlspecialchars affects only 5 characters:
& ' " < >
So thats a no :D?
Ok its a no. thanks.
It doesn't matter.
I like to escape anything and everything
Not for security, but for maintainability.
So you don't have to think "Should I escape this? Maybe I can skip it this time?"
Escape everything and that's it. No extra thinking required :P
20:08
(& - &amp; - &ampamp; - &ampampamp; - etc.)
user652649
i'm already starting to think that this room will not go well
Php...
user652649
gn going to see the match
21:10
Woah, go away for a few minutes and come back to buttload of spam
21:57
:D
 
2 hours later…
23:41
Ass cactus soup.
Ok.
@zerkms Line 73 header ("Location: ".$row['link']);

  last day (21 days later) »