NO book i read did sticky form correctly

[Summercool]

the sticky form is that if validation didn't pass, re-display the form
with the value in the text input again (and for other input field as
well...)

no book I read did it correctly so far. (just for the text input)

to reduce the problem, how about write a PHP program that will submit
to itself, so that

typing in

foo "bar" foo

and click "Submit" and the form will re-display the form with

foo "bar" foo

already typed in, kind of like what Google will behave.

Of the few books I read, none of them has a correct solution. If you
know which book has a correct solution to this, please point me to it.

[Summercool]

On Oct 13, 5:18 am, Summercool <[e-mail]:

>
typing in

foo "bar" foo

and click "Submit" and the form will re-display the form with

foo "bar" foo

and that

foo 'bar' foo

should work too.

[Michael Fesser]

..oO(Summercool)

>the sticky form is that if validation didn't pass, re-display the form
with the value in the text input again (and for other input field as
well...)

no book I read did it correctly so far. (just for the text input)

to reduce the problem, how about write a PHP program that will submit
to itself, so that

typing in

foo "bar" foo

and click "Submit" and the form will re-display the form with

foo "bar" foo

already typed in, kind of like what Google will behave.

Of the few books I read, none of them has a correct solution.

What makes you think that they're not correct? What have you tried so
far? What problems do you have?

Actually this is a pretty simple task, in fact the PHP code for a single
input field could be reduced to a single line if necessary. So I'm quite
curious how it's done in your books.

Micha

[Summercool]

On Oct 13, 5:29 am, Michael Fesser <[e-mail]:

Actually this is a pretty simple task, in fact the PHP code for a single
input field could be reduced to a single line if necessary. So I'm quite
curious how it's done in your books.

<form action="self.php" method="get">
<input name="val" type="text" value="<?= $_GET["val"] ?>">
<input type="submit" value="Post it">
</form>
</div>

usually they do something like this...

GET and POST are just the same...

none of them work for foo "bar" foo
and foo 'bar' foo

[Michael Fesser]

..oO(Summercool)

>On Oct 13, 5:29 am, Michael Fesser <[e-mail]:

>Actually this is a pretty simple task, in fact the PHP code for a single
input field could be reduced to a single line if necessary. So I'm quite
curious how it's done in your books.

<form action="self.php" method="get">
<input name="val" type="text" value="<?= $_GET["val"] ?>">
<input type="submit" value="Post it">
</form>
</div>

usually they do something like this...

OK. Even if the PHP code there is quite small, it contains 3(!) errors,
one of which is critical:

1) It relies on short open tags, which is a bad idea in general, because
it's an optional feature.

Fix: Use <?php echo ... ?to print something out. This will work on all
servers and configurations.

2) It doesn't check if there's a submitted value at all. The first call
of that page would throw a notice.

Fix: Check with isset($_GET['val']) if there is something at all before
using it. Such checks should be done for _all_ submitted variables.

3) The worst is the missing escaping of special HTML chars, which not
only breaks the form if such chars were entered (which is the problem
you encountered), it also allows for cross site scripting attacks.

Fix: Use htmlspecialchars() to escape any special chars in $_GET['val']
before printing it out. See the manual for details about the possible
parameters.

Micha

[Jerry Stuckle]

Summercool wrote:

On Oct 13, 5:29 am, Michael Fesser <[e-mail]:

>Actually this is a pretty simple task, in fact the PHP code for a single
input field could be reduced to a single line if necessary. So I'm quite
curious how it's done in your books.

<form action="self.php" method="get">
<input name="val" type="text" value="<?= $_GET["val"] ?>">
<input type="submit" value="Post it">
</form>
</div>

usually they do something like this...

GET and POST are just the same...

none of them work for foo "bar" foo
and foo 'bar' foo

Other than the fact they're using short tags, it should work fine.
They're assuming short tags are on, and your server probably has them
off. It doesn't mean they are wrong - just that the configuration on
your server doesn't match what the book assumes.

Change

<input name="val" type="text" value="<?= $_GET["val"] ?>">

to:

<input name="val" type="text" value="<?php echo $_GET["val"] ?>">

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Summercool]

On Oct 13, 6:20 am, Michael Fesser <[e-mail]:

>
Fix: Use htmlspecialchars() to escape any special chars in $_GET['val']
before printing it out. See the manual for details about the possible
parameters.

so you think using that will make it work? i don't know why but i
tried that and it didn't work in Firefox and IE. the foo "bar" foo
will come back as foo \"bar\" foo and click once more will get more
"\".

[Summercool]

On Oct 13, 6:20 am, Michael Fesser <[e-mail]:

2) It doesn't check if there's a submitted value at all. The first call
of that page would throw a notice.

Fix: Check with isset($_GET['val']) if there is something at all before
using it. Such checks should be done for _all_ submitted variables.

it would? i thought it would just evaluate to nothing and prints out
nothing.

[Summercool]

On Oct 13, 6:25 am, Jerry Stuckle <[e-mail]:

Change

<input name="val" type="text" value="<?= $_GET["val"] ?>">

to:

<input name="val" type="text" value="<?php echo $_GET["val"] ?>">

one essential thing is to make foo "bar" foo
and foo 'bar' foo both work

[Jerry Stuckle]

Summercool wrote:

On Oct 13, 6:25 am, Jerry Stuckle <[e-mail]:

>Change

<input name="val" type="text" value="<?= $_GET["val"] ?>">

to:

<input name="val" type="text" value="<?php echo $_GET["val"] ?>">

one essential thing is to make foo "bar" foo
and foo 'bar' foo both work

It will work. Michael's comments are also valid, but aren't stopping
your code from working.

It sounds like you're running with magic_quotes enabled. It's a setting
I wish they would have never had, and I recommend you turn it off.

If you can't turn it off, check the stripslashes() call.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Summercool]

On Oct 13, 7:05 am, Jerry Stuckle <[e-mail]:

>
It sounds like you're running with magic_quotes enabled. It's a setting
I wish they would have never had, and I recommend you turn it off.

i checked phpinfo()

yes, magic_quotes_gpc is on, and it is said that it is the default
setting.

magic_quotes_runtime is off by default.
magic_quotes_sybase is off.

so shouldn't we work with the default setting? like if i use a
hosting company like Dreamhost, we can't ask them to turn off just for
us.

[Jerry Stuckle]

Summercool wrote:

On Oct 13, 7:05 am, Jerry Stuckle <[e-mail]:

>It sounds like you're running with magic_quotes enabled. It's a setting
I wish they would have never had, and I recommend you turn it off.

i checked phpinfo()

yes, magic_quotes_gpc is on, and it is said that it is the default
setting.

magic_quotes_runtime is off by default.
magic_quotes_sybase is off.

so shouldn't we work with the default setting? like if i use a
hosting company like Dreamhost, we can't ask them to turn off just for
us.

I always run with magic_quotes_gpc off. If a host is running with it
on, just find another host. They're a dime a dozen.

You can check to see if they are on or off with get_magic_quotes_gpc().

But I always run with them off - why add slashes if you just need to
take them away again? And if I want to add them, I can (and will).

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Summercool]

On Oct 13, 7:05 am, Jerry Stuckle <[e-mail]:

>
It sounds like you're running with magic_quotes enabled. It's a setting
I wish they would have never had, and I recommend you turn it off.

i checked phpinfo()

yes, magic_quotes_gpc is on, and it is said that it is the default
setting.

magic_quotes_runtime is off by default.
magic_quotes_sybase is off.

so shouldn't we work with the default setting? like if i use a
hosting company like Dreamhost, we can't ask them to turn off just for
us.

[Jerry Stuckle]

Summercool wrote:

On Oct 13, 7:05 am, Jerry Stuckle <[e-mail]:

>It sounds like you're running with magic_quotes enabled. It's a setting
I wish they would have never had, and I recommend you turn it off.

i checked phpinfo()

yes, magic_quotes_gpc is on, and it is said that it is the default
setting.

magic_quotes_runtime is off by default.
magic_quotes_sybase is off.

so shouldn't we work with the default setting? like if i use a
hosting company like Dreamhost, we can't ask them to turn off just for
us.

I already answered you once. Did you read the answer?

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Rik Wasmus]

On Sun, 14 Oct 2007 16:43:09 +0200, Summercool <Su************@gmail.com>
wrote:

On Oct 13, 7:05 am, Jerry Stuckle <[e-mail]:

>>
It sounds like you're running with magic_quotes enabled. It's a setting
I wish they would have never had, and I recommend you turn it off.

i checked phpinfo()

yes, magic_quotes_gpc is on, and it is said that it is the default
setting.

magic_quotes_runtime is off by default.
magic_quotes_sybase is off.

so shouldn't we work with the default setting?

Not neccesarily, that's why they're called settings. The only thing one
should do is trying to create code as independant from settings as
possible.

like if i use a
hosting company like Dreamhost, we can't ask them to turn off just for
us.

PHP settings in Apache can easily be set per virtual host, no other client
on the server need ever be troubled by them. Apache even supports setting
them in a per directory .htaccess files (which I often use on little
project on third-party servers to whip them into shape).

Prices for hosting as they are now, I can recommend anyone being
moderately serious about their site just to pay for a VPS. It's still dirt
cheap and one has close to total control.
--
Rik Wasmus

[ELINTPimp]

On Oct 14, 10:43 am, Summercool <[e-mail]:

On Oct 13, 7:05 am, Jerry Stuckle <[e-mail]:

It sounds like you're running with magic_quotes enabled. It's a setting
I wish they would have never had, and I recommend you turn it off.

i checked phpinfo()

yes, magic_quotes_gpc is on, and it is said that it is the default
setting.

magic_quotes_runtime is off by default.
magic_quotes_sybase is off.

so shouldn't we work with the default setting? like if i use a
hosting company like Dreamhost, we can't ask them to turn off just for
us.

PHP6 will no longer support magic quotes,along with register globals
and "safe mode". Some of these may be enabled by default on some PHP
versions, but you should disable them and not rely on them
whatsoever. Take a look at the link below for these changes as well
as reasons why they are going this way from the PHP hackers
themselves.

http://www.php.net/~derick/meeting-notes.html

[Lars Eighner]

In our last episode, <11*********************@q5g2000prf.googlegroups.c om>,
the lovely and talented ELINTPimp broadcast on comp.lang.php:

If you read a little of the discussions at the link I provided above,
perhaps you will have more appreciation for the work that goes on,
mostly unpaid, behind the scenes to make your life better.

I did read it. The summary is: morons won't read the manual so we have to
save them from themselves by getting rid of this stuff.

--
Lars Eighner <http://larseighner.com/ <http://myspace.com/larseighner>
Countdown: 463 days to go.
What do you do when you're debranded?