Forum PHP.pl

Witam.
Mam tablice:

[PHP] pobierz, plaintext 
Array
(
    [save] => 1
    [title] => Monika Krzysiowa
    [contactUser] => Array
        (
            [0] => 29
            [1] => 11
            [2] => 17
        )
 
    [email] => kontakt@mail.com
    [phone] => 12345678
    [description] => opis
1
2
3
4
    [enable] => 1
)
[PHP] pobierz, plaintext 

lub

[PHP] pobierz, plaintext 
Array
(
    [save] => 1
    [title] => Monika Krzysiowa
    [email] => kontakt@gmail.com
    [phone] => 12345678
    [description] => opis
1
2
3
4
    [enable] => 1
)
[PHP] pobierz, plaintext 

i taką funkcję w php:

[PHP] pobierz, plaintext 
public function secureSave(array $string): array
    {
        foreach ($string as $key => $value) {
            $string[$key] = htmlspecialchars_decode($value, ENT_COMPAT);
        }
        return $string;
    }
[PHP] pobierz, plaintext 

Powyższa funkcja pracuje poprawnie dla 2 tablicy. W 1 mam problem i daje wynik:

[PHP] pobierz, plaintext 
Array
(
    [save] => 1
    [title] => Monika Krzysiowa
    [contactUser] => 
    [email] => kontakt@gmaail.com
    [phone] => 123456788
    [description] => opis
1
2
3
4
    [enable] => 1
)
[PHP] pobierz, plaintext 

[contactUser] - problemem jest pusta wartość.

Jak naprawić powyższą funkcję tak żeby była uniwersalna?

Mam różne tablice, nazwy mogą być różne

W momemecie gdy wartoscia jest kolejna tablica, to musisz powtorzyc operacje. No i tak kolejna tablica moze miec znowu tablice itd itd - rekurencja sie tutaj klania

ps: no i najwazniejsze pytanie: po co ci w ogole to robic? Skad pochodza te dane i gdzie je potem zapisujesz?

Czyli coś takiego:

[PHP] pobierz, plaintext 
$string[$key] = htmlspecialchars_decode($value, ENT_COMPAT); => $string[$key] = is_array($value) ? $this->secureSave($value) : htmlspecialchars_decode($value, ENT_COMPAT);
[PHP] pobierz, plaintext 

?

Chcę kodować znaki wpisywane przez userów w formularzach przed zapisem do bazy (typu '. '', "" itp). Mam po drodze PDO i bindowanie, ale chcę dodatkowo to jeszcze dodać

Napisz ten kod jeszcze raz bo nie ma prawa sie w ogole odpalic bo ma PARSE ERROR


Totalnie bez sensu. Raz ze htmlspecialchars_decode nic nie koduje tylko DEKODUJE a dwa ze to bez sensu. takich rzeczy sie nie robi, tylko sobie zycie utrudniasz a nic nie zabezpieczasz

[PHP] pobierz, plaintext 
public function secureSave(array $string): array
    {
        foreach ($string as $key => $value) {
            $string[$key] = is_array($value) ? $this->secureSave($value) : htmlspecialchars_decode($value, ENT_COMPAT);
        }
        return $string;
    }
[PHP] pobierz, plaintext 

Jako taka funkcja działa poprawnie

W jaki sposób sugerujesz żeby kodować html przed zapisem do bazy?

Zdaje sie juz napisalem: w zaden. To nie ma zadnego sensu co probujesz tutaj zrobic. Po co ci to? Co ci da to kodowanie? Nic, zupelnie nic. A tylko same problemy potem, chocby z ewentualnym wyszukiwaniem.

ps:

array $string
I na milosc pierszego zalozyciela php - nazywaj zmiennej jakos z glowa. Zmienna jest tablica a ty ja nazywasz string..... To tak jakbys zrobic zmienna:
$true = false;
$false = true;

W tym przypadku powinno byc np
array $data

Hmmmm.... tylko jak nie dodaję tego "zabezpieczenia" to taki wpis:

'';fwefewfpew'f'wef'wefew.''fewvdsniu*&&^&^@^7ef125e2'



wywala mi błąd:

[PHP] pobierz, plaintext 
Fatal error: Uncaught PDOException: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'f'wef'wefew.''fewvdsniu*&&^&^@^7ef125e2''' at line 1 in /Applications/XAMPP/xamppfiles/htdocs/um_rumia/apps/core/utilities/DbClass.php:78 Stack trace: #0 /Applications/XAMPP/xamppfiles/htdocs/um_rumia/apps/core/utilities/DbClass.php(78): PDOStatement->execute() #1 /Applications/XAMPP/xamppfiles/htdocs/um_rumia/apps/core/utilities/DbClass.php(139): Core\Utilities\Db->Init('SELECT COUNT(ti...', NULL) #2 /Applications/XAMPP/xamppfiles/htdocs/um_rumia/apps/core/models/ModelClass.php(24): Core\Utilities\Db->row('SELECT COUNT(ti...') #3 /Applications/XAMPP/xamppfiles/htdocs/um_rumia/apps/backend/models/GalleryModel.php(230): Core\Models\Model->createSeoUrl(''';fwefewfpew'f...', 'title_pl', 'psGalleryCatego...') #4 /Applications/XAMPP/xamppfiles/htdocs/um_rumia/apps/backend/controllers/GalleryList.php(14 in /Applications/XAMPP/xamppfiles/htdocs/um_rumia/apps/core/utilities/DbClass.php on line 78
[PHP] pobierz, plaintext 

Moja klasa od połączeń wygląda tak:

[PHP] pobierz, plaintext 
class Db
{
    private $_hostname;
    private $_database;
    private $_username;
    private $_password;
    private $_port;
    private $_pdo;
    private $_sQuery;
    private $_bConnected = false;
    private $_parameters;
    private $_config;
    private $_psException;
 
 
    public function __construct()
    {
        $this->_config = Registry::register("Core\Utilities\Config");
        $this->_psException = new PsException();
 
        $this->_hostname = $this->_config->db_host;
        $this->_database = $this->_config->db_db;
        $this->_username = $this->_config->db_user;
        $this->_password = $this->_config->db_pass;
        $this->_port = $this->_config->db_port;
 
        $this->Connect($this->_hostname, $this->_database, $this->_username, $this->_password, $this->_port);
        $this->_parameters = array();
    }
 
 
    private function Connect($hostname, $database, $username, $password, $port)
    {
 
        try {
            $options = array(\PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES 'utf8'");
            $this->_pdo = new \PDO("mysql:host={$hostname};dbname={$database};port={$port};charset=utf8", $username, $password, $options);
 
            $this->_pdo->setAttribute(\PDO::ATTR_ERRMODE, \PDO::ERRMODE_EXCEPTION);
            $this->_pdo->setAttribute(\PDO::ATTR_DEFAULT_FETCH_MODE, \PDO::FETCH_ASSOC);
            $this->_pdo->setAttribute(\PDO::ATTR_EMULATE_PREPARES, true);
            $this->_pdo->query('SET NAMES utf8');
            $this->_bConnected = true;
        } catch (PDOException $ex) {
            $this->_psException->registerError("Failed to connect to the database: " . $ex->getMessage());
        } catch (Exception $e) {
            $this->_psException->registerError("Failed to connect to the database: " . $e->getCode() . "." . $e->getMessage());
        }
    }
 
 
    public function CloseConnection()
    {
        $this->_pdo = null;
    }
 
 
    private function Init($query, $parameters = "")
    {
        if (!$this->_bConnected) {
            $this->Connect();
        }
        try {
            $this->_sQuery = $this->_pdo->prepare($query);
 
            $this->bindMore($parameters);
            if (!empty($this->_parameters)) {
                foreach ($this->_parameters as $param) {
                    $parameters = explode("\x7F", $param);
                    $this->_sQuery->bindParam($parameters[0], $parameters[1]);
                }
            }
            $this->success = $this->_sQuery->execute();
        } catch (PDOException $e) {
            $this->ExceptionLog($e->getMessage(), $query);
        }
        $this->_parameters = array();
    }
 
 
    public function bind($para, $value)
    {
        $this->_parameters[sizeof($this->_parameters)] = ":" . $para . "\x7F" . ($value);
    }
 
    public function bindMore($parray)
    {
        if (empty($this->_parameters) && is_array($parray)) {
            $columns = array_keys($parray);
            foreach ($columns as $i => &$column) {
                $this->bind($column, $parray[$column]);
            }
        }
    }
 
    public function query($query, $params = null, $fetchmode = \PDO::FETCH_ASSOC)
    {
        $query = trim($query);
        $this->Init($query, $params);
        $rawStatement = explode(" ", $query);
 
        $statement = strtolower($rawStatement[0]);
 
        if ($statement === 'select' || $statement === 'show') {
            return $this->_sQuery->fetchAll($fetchmode);
        } elseif ($statement === 'insert' || $statement === 'update' || $statement === 'delete') {
            return $this->_sQuery->rowCount();
        } else {
            return null;
        }
    }
 
    public function lastInsertId()
    {
        return $this->_pdo->lastInsertId();
    }
 
 
    public function column($query, $params = null)
    {
        $this->Init($query, $params);
        $Columns = $this->_sQuery->fetchAll(\PDO::FETCH_NUM);
 
        $column = null;
        foreach ($Columns as $cells) {
            $column[] = $cells[0];
        }
        return $column;
 
    }
 
    public function row($query, $params = null, $fetchmode = \PDO::FETCH_ASSOC)
    {
        $this->Init($query, $params);
        return $this->_sQuery->fetch($fetchmode);
    }
 
    public function single($query, $params = null)
    {
        $this->Init($query, $params);
        return $this->_sQuery->fetchColumn();
    }
 
    private function ExceptionLog($message, $sql = "")
    {
        $message .= 'Unhandled Exception. $message';
        if (!empty($sql)) {
            $message .= "\r\nQuery SQL : " . $sql;
        }
        $this->_psException->registerError($message);
    }
}
[PHP] pobierz, plaintext 

Czyli błąd jest po stronie Db?

jak debuguję tutaj:

[PHP] pobierz, plaintext 
$this->_sQuery = $this->_pdo->prepare($query);
echo "<pre>";print_r($this->_sQuery);echo "</pre>";
 
[PHP] pobierz, plaintext 

to mam zwrotkę:

[PHP] pobierz, plaintext 
PDOStatement Object
(
    [queryString] => SELECT COUNT(title_pl) AS count FROM psGalleryCategories WHERE title_pl = ''';fwefewfpew'f'wef'wefew.''fewvdsniu*&&^&^@^7ef125e2'';
)
[PHP] pobierz, plaintext 

i tutaj jakby widzi za dużo '


Bindowanie mam w:foreachu this->_sQuery->bindParam($parameters[0], $parameters[1]); ;

Jak sam widzisz twoje zapytanie zawiera tekst ktory wkladasz do bazy a nie zadne bindowanie. Nic wiec dziwnego ze sie wywala.

Jak juz mowilem: klasa ta to sieczka jakas - sorki, jestem poprostu szczery

Pokaz jeszcze jak tej klasy uzywasz. Moze tez i tam robisz blad.

[PHP] pobierz, plaintext 
$queryValue["enable"] = $dataValues['enable'];
$queryValue["number"] = $dataValues['number'];
$queryValue["description"] = $dataValues['description'];
$queryValue["date"] = $dataValues['date'];
$queryValue["visible_on_the_front"] = $dataValues['visible_on_the_front'];
$queryValue["id_category_page"] = $dataValues['id_category_page'];
$queryValue["visible_on_the_front2"] = $dataValues['visible_on_the_front2'];
$this->_db->query("INSERT INTO psGalleryCategories  (visible_on_the_front2, id_category_page, visible_on_the_front, date, description, enable, number) VALUES (:visible_on_the_front2, :id_category_page, :visible_on_the_front, :date, :description, :enable, :number);", $queryValue);
[PHP] pobierz, plaintext 

pokaz co zwraca:

[PHP] pobierz, plaintext 
                foreach ($this->_parameters as $param) {
                    $parameters = explode("\x7F", $param);
var_dump($parameters);
                    $this->_sQuery->bindParam($parameters[0], $parameters[1]);
                }
[PHP] pobierz, plaintext 

[PHP] pobierz, plaintext 
array(2) {
  [0]=>
  string(9) ":username"
  [1]=>
  string(17) "admindzLHFu@pl.pl"
}
array(2) {
  [0]=>
  string(5) ":enum"
  [1]=>
  string(1) "4"
}
array(2) {
  [0]=>
  string(9) ":category"
  [1]=>
  string(1) "1"
}
array(2) {
  [0]=>
  string(9) ":username"
  [1]=>
  string(17) "admindzLHFu@pl.pl"
}
array(2) {
  [0]=>
  string(5) ":enum"
  [1]=>
  string(1) "4"
}
array(2) {
  [0]=>
  string(9) ":category"
  [1]=>
  string(1) "1"
}
array(2) {
  [0]=>
  string(9) ":username"
  [1]=>
  string(17) "admindzLHFu@pl.pl"
}
array(2) {
  [0]=>
  string(5) ":enum"
  [1]=>
  string(1) "4"
}
array(2) {
  [0]=>
  string(9) ":category"
  [1]=>
  string(1) "1"
}
[PHP] pobierz, plaintext 

print_r($this->_sQuery); zwraca

[PHP] pobierz, plaintext 
$this->success = $this->_sQuery->execute(); and I have result: PDOStatement Object ( [queryString] => SELECT COUNT(title_pl) AS count FROM psGalleryCategories WHERE title_pl = ''';fwefewfpew'f'wef'wefew.''fewvdsniu*&&^&^@^7ef125e2''; )
[PHP] pobierz, plaintext 

print_r($this->_sQuery);

[PHP] pobierz, plaintext 
PDOStatement Object ( [queryString] => SELECT COUNT(title_pl) AS count FROM psGalleryCategories WHERE title_pl = ''';fwefewfpew'f'wef'wefew.''fewvdsniu*&&^&^@^7ef125e2''; )
[PHP] pobierz, plaintext 

$this->_sQuery = $this->_pdo->prepare($query); echo "<pre>";print_r($this->_sQuery);echo "</pre>";

[PHP] pobierz, plaintext 
PDOStatement Object ( [queryString] => SELECT COUNT(title_pl) AS count FROM psGalleryCategories WHERE title_pl = ''';fwefewfpew'f'wef'wefew.''fewvdsniu*&&^&^@^7ef125e2''; ) 
[PHP] pobierz, plaintext 

Kurcze, jako przyklad podales mi zapytanie z INSERT, a kod printujacy wyswietla ci jakiegos SELECT. Prosze, skup sie i podaj mi przyklady i PRINTy z zapytania ktore sie wykrzaczaa a nie zupelnie innego. Dodatkowo print z params pokazuje ze nie ma tam zadnego tekstu wefewfpew'f'wef'wefew wiec znowu dzialasz na innym zapytaniu. Skup sie troche i nie marnuj swojego i mojego czasu

Przepraszam bardzo.

[PHP] pobierz, plaintext 
array(2) {
  [0]=>
  string(9) ":username"
  [1]=>
  string(17) "admindzLHFu@pl.pl"
}
array(2) {
  [0]=>
  string(5) ":enum"
  [1]=>
  string(1) "4"
}
array(2) {
  [0]=>
  string(9) ":category"
  [1]=>
  string(1) "1"
}
array(2) {
  [0]=>
  string(9) ":username"
  [1]=>
  string(17) "admindzLHFu@pl.pl"
}
array(2) {
  [0]=>
  string(5) ":enum"
  [1]=>
  string(1) "4"
}
array(2) {
  [0]=>
  string(9) ":category"
  [1]=>
  string(1) "1"
}
array(2) {
  [0]=>
  string(9) ":username"
  [1]=>
  string(17) "admindzLHFu@pl.pl"
}
array(2) {
  [0]=>
  string(5) ":enum"
  [1]=>
  string(1) "4"
}
array(2) {
  [0]=>
  string(9) ":category"
  [1]=>
  string(1) "1"
}
array(2) {
  [0]=>
  string(7) ":enable"
  [1]=>
  string(1) "1"
}
array(2) {
  [0]=>
  string(7) ":number"
  [1]=>
  string(0) ""
}
array(2) {
  [0]=>
  string(12) ":description"
  [1]=>
  string(54) "'';fwefewfpew'f'wef'wefew.''fewvdsniu*&&^&^@^7ef125e2'"
}
array(2) {
  [0]=>
  string(21) ":visible_on_the_front"
  [1]=>
  string(0) ""
}
array(2) {
  [0]=>
  string(5) ":date"
  [1]=>
  string(10) "2019-02-27"
}
array(2) {
  [0]=>
  string(17) ":id_category_page"
  [1]=>
  string(2) "67"
}
array(2) {
  [0]=>
  string(22) ":visible_on_the_front2"
  [1]=>
  string(0) ""
}
array(2) {
  [0]=>
  string(9) ":title_pl"
  [1]=>
  string(54) "'';fwefewfpew'f'wef'wefew.''fewvdsniu*&&^&^@^7ef125e2'"
}
array(2) {
  [0]=>
  string(15) ":description_pl"
  [1]=>
  string(54) "'';fwefewfpew'f'wef'wefew.''fewvdsniu*&&^&^@^7ef125e2'"
}
array(2) {
  [0]=>
  string(12) ":keywords_pl"
  [1]=>
  string(54) "'';fwefewfpew'f'wef'wefew.''fewvdsniu*&&^&^@^7ef125e2'"
}
 
 
Fatal error:  Uncaught PDOException: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ') VALUES ('', '67', '', '2019-02-27', '\'\';fwefewfpew\'f\'wef\'wefew.\'\'fewvds' at line 1 in /Applications/XAMPP/xamppfiles/htdocs/um_rumia/apps/core/utilities/DbClass.php:79
Stack trace:
#0 /Applications/XAMPP/xamppfiles/htdocs/um/apps/core/utilities/DbClass.php(79): PDOStatement->execute()
#1 /Applications/XAMPP/xamppfiles/htdocs/um/apps/core/utilities/DbClass.php(105): Core\Utilities\Db->Init('INSERT INTO psG...', Array)
#2 /Applications/XAMPP/xamppfiles/htdocs/um/apps/backend/models/GalleryModel.php(234): Core\Utilities\Db->query('INSERT INTO psG...', Array)
#3 /Applications/XAMPP/xamppfiles/htdocs/um/apps/backend/controllers/GalleryList.php(149): Backend\Models\GalleryModel->saveDataFromForm(Array, 3)
#4 [internal function]: Backend\Controllers\GalleryListAdminContro in /Applications/XAMPP/xamppfiles/htdocs/um/apps/core/utilities/DbClass.php on line 79
[PHP] pobierz, plaintext 

No i poprosze jeszcze jak to wywolujesz z tym zapytaniem SELECT. O wszystko po kolei musze sie dopraszac?

Selecty tak wywołuję:

[PHP] pobierz, plaintext 
public function getNumberOfItems(string $searchValue = ""): int    {
$searchQuery = null;
        if ($searchValue != "") {
            $searchQuery .= " and ($searchNames or $searchNames2  or $searchNames3) ";
            $queryValue["search"] = "%$searchValue%";
        }
 
        return $this->_db->single("SELECT COUNT(id_categories_of_photos) AS id_categories_of_photos FROM psGalleryCategories WHERE enable = 1   $searchQuery;", $queryValue);
    }
[PHP] pobierz, plaintext 

$searchQuery .= " and ($searchNames or $searchNames2 or $searchNames3) ";
Tutaj wkladasz wartosci bezposrednio do zapytania i ich nie bindujesz. Nie wspominaj juz o tym ze tych zmienne w ogole nie istnieja wiec znowu pokazales jakis wycinek kodu