URL Security Php/Ajax - php

I'm working on this application that reads confidential documents stored in the Blob of my Oracle 11g Database. What I have implemented so far is a php page that queries for all available blobs in the table and prints href's like this:
<html>
<head>
</head>
<body>
<?php
$i = 1;
echo "Welcome User!</br>";
$conn = OCILogon("abc","abc","abc_server");
$qry = "select id from some_table order by ID";
$stmt = ociparse ($conn,$qry);
OCIDefineByName($stmt,"ID",$id);
OCIExecute($stmt);
while ( $row = OCI_Fetch_Array($stmt, OCI_ASSOC+OCI_RETURN_LOBS) ) {
print "<a href = 'readMe.php?id=$id' target='_blank'>Document $i</a></br>";
$i = $i+1;
}
?>
</body>
</html>
readMe.php
<?php
session_start();
$id = $_GET[id];
$conn = OCILogon("abc","abc","abc_server");
$qry = "select doc_file,doc_name from some_table where ID =".$id;
//echo $qry;
$stmt = ociparse ($conn,$qry);
OCIDefineByName($stmt,"DOC_FILE",$blobFile);
OCIDefineByName($stmt,"DOC_NAME",$blobFileName);
OCIExecute($stmt);
while ($row = OCI_Fetch_Array($stmt, OCI_ASSOC+OCI_RETURN_LOBS))
{
$a = $row['DOC_FILE'];
}
header('Content-type: application/pdf');
header('Content-Disposition: inline; filename="' . $blobFileName . '"');
header('Content-Transfer-Encoding: binary');
header('Accept-Ranges: bytes');
print $a;
?>
The problem is that it produces this URL:
http://999.999.999.888/Some_work/ReadBlob/readMe.php?id=47
That is, the ID of every document in the browser. How can I avoid this? I tried using $_POST but it didn't open the document. ANy help would be highly appreciated.

Related

Export MySQL Data to MS Excel is working well in local but not on server

<title>Orders Export</title>
<body>
<?php
header('Content-Type: application/xls');
header('Content-Disposition: attachment; filename=download.xls');
$con = mysqli_connect('localhost','suresafe_admin','iwant$100','suresafe_suresafety');
$query = "select * from `orders_approval` where `approve`='1' and `company_name`='GAVL-F111'";
$result = mysqli_query($con,$query);
$output = '';
if(mysqli_num_rows($result) > 0)
{
$output .= '?>
<table class="table" bordered="1">
<tr>
<th>order_no</th>
<th>order_date</th>
<th>order_name</th>
<th>total_amount</th>
</tr><?php
';
while($row = mysqli_fetch_array($result))
{
$output .= '
<tr>
<td>'.$row["order_no"].'</td>
<td>'.$row["order_date"].'</td>
<td>'.$row["order_name"].'</td>
<td>'.$row["total_amount"].'</td>
</tr>
';
}
$output .= '</table>';
}?>
</body>
</html>
The code is simple. Working well in local. But when I use this in my website on server. It shows only table with data. It don't export that data in Excel.
order_no order_date order_name total_amount
100000705 2017-05-07 MR. PRADEEP Y 113500
100000708 2017-05-11 MR. A SRINIVASA RAO 5448
100000725 2017-05-30 MR. A SRINIVASA RAO 77180
Here is the result I can see when I click on export link.
In local server, it is easily exported.
If you had configured your server properly, you would be seeing warnings. You cannot send a header after data has already been output. In addition, the data you're sending is not application/xls (which is not a valid MIME type) it's text/html. You're also outputting "?>" and "<?php" into your HTML, which will not work too well.
However, I would suggest going with CSV for the data you're outputting:
<?php
$con = mysqli_connect("localhost", "suresafe_admin", "iwant$100", "suresafe_suresafety");
$query = "SELECT order_no, order_date, order_name, total_amount from orders_approval WHERE approve = 1 AND company_name = 'GAVL-F111'";
$result = mysqli_query($con, $query);
$output = "";
if(mysqli_num_rows($result) > 0) {
$output .= "order_no,order_date,order_name,total_amount\n";
while($row = mysqli_fetch_assoc($result)) {
$output .= "$row[order_no],$row[order_date],$row[order_name],$row[total_amount]\n";
}
}
header("Content-Type: text/csv");
header("Content-Disposition: attachment; filename=download.csv");
echo $output;

My prog do not fetching Marathi database values in exiting PDF template

Can anybody help me why my code is not fetching Marahti database values in PDF.
Here is my Code:
<?php
GLOBAL $html;
mb_internal_encoding("UTF-8"); header('Content-Type: text/html; charset=utf-8');
ini_set('display_errors', true);
$con=mysql_connect('localhost','root') or die('Error');
mysql_select_db('DemoMarathi');
$result = mysql_query("SET NAMES utf8")or die('error'.mysql_error());
$cmd = "select * from Demo_hindi";
$result = mysql_query($cmd);
while($row = mysql_fetch_assoc($result))
{
$html .= '<td>'.$row['DemoMarathi'].'</td><td>' . $row['DemoValues']. '</td>';
$pdf->Text(105, 73,"hi".$myrow['DemoMarathi']);
$pdf->Text(105, 73,"hi".$myrow['DemoValues']);
$pdf->Write(75,"".$myrow['DemoMarathi']);
$pdf->Write(90,"".$myrow['DemoValues']);
}
include('MPDF FULL_PACKAGE/mpdf60/mpdf.php');
$mpdf=new mPDF();
$mpdf->WriteHTML($html.$myrow['DemoMarathi']);
$mpdf->WriteHTML($html.$myrow['DemoValues']);
$mpdf->Output();
exit;
?>
PDF OUTPUT FILE

Fetch blob image from table and display it using php sqlite3

I know this question has been asked many times but I couldnot solve this using any of them.
I am new to sqlite and cannot understand what I am doing wrong.
WHAT I AM TRYING
I am trying to make a profile view page. I am able to fetch all details from my sqlite database but i am not able to display my profile picture.
TABLE STRUCTURE
**username|landline|mobile|email|profilepicture**
john |xxxxxxxx|xxxxxx|x#x.x|blob
WHAT I TRIED
$sql = "SELECT * FROM profile";
$query = $db->query($sql);
while($row = $query->fetchArray(SQLITE3_ASSOC) ){
echo "NAME = ". $row['user_name'] . "<br/>";
echo "LANDLINE = ". $row['user_landline'] ."<br/>";
echo "MOBILE = ". $row['user_mobile'] ."<br/>";
echo "EMAIL = ".$row['user_email'] ."<br/>";
header('Content-Type: image/png');
echo $row['user_profile_picture'];
}
<html>
<img src='profile.php?imgid=<?php echo $row['user_profile_picture'];?>'/>
</html>
But the image dosenot show and also the rest of the data dosenot display when i putheader('Content-Type: image/png');
Create an image.php:
<?php
$sql = "SELECT user_profile_picture FROM profile WHERE id = " . $_GET['id'];
$query = $db->query($sql);
$row = $query->fetchArray(SQLITE3_ASSOC);
header('Content-Type: image/png');
echo $row['user_profile_picture'];
In profile.php:
<img src='image.php?id=<?php echo $row['id'];?>'/>

images from database via php can't display

thank's for help. I have problem displaying images retrieving from my database.
I cant see the image when loading image.php in img src or directly from the page. When i display the variable without header('Content-type: image/jpeg'); i can see all the code inside, as i put this line all goes off.
I have a table called TABLE with id, title, img stored as longblob directly uploaded inside phpmyadmin.
Can anyone help me?
index.php
<?php
session_start();
include "admin/include/connection2.php";
$data = new MysqlClass();
$data->connect();
$query_img ="SELECT * FROM table ORDER BY data ASC LIMIT 4";
$post_sql = $data->query($query_img);
if(mysql_num_rows($post_sql) > 0){
while($post_obj = $data->estrai($post_sql)){
$id = $post_obj->id;
$titolo = stripslashes($post_obj->title);
$data_articolo = $post_obj->data;
$immagine = $post_obj->img;
// visualizzazione dei dati
echo "<h2>".$titolo."</h2>";
echo "Autore <b>". $autore . "</b>";
echo "<br />";
echo '<'.'img src="image.php?id='.$post_sql['id'].'">';
echo $id;
echo "<hr>";
}
}else{
echo "no post aviable.";
}
// here is the image.php code
<?php
include "admin/include/connection2.php";
$data = new MysqlClass();
// connect
$data->connetti();
$id = $_GET['id'];
echo $id;
$query = mysql_query("SELECT * FROM articoli_news WHERE id='".$id."'"; //even tried to send id='1' but not working
echo $query;
$row = mysql_fetch_array($query);
echo $row['id']; //correct displaying
$content = base64_decode($query['img']);
header('Content-type: image/jpeg');
echo $content;
?>
Delete all "echo" commands except "echo $content;" because there are also appear in the output, and damage your image.
And use ob_start(); in the begining of the script, and check out your script file not contain any of whitespace characters before or after the php begint and close tags .

Dynamically generated XML File Doesn't work on Server but works well on localhost

I generated a XML file in php. This file generates a xml output perfectly in my localhost and at the same time when I uploaded it to my server it fails.
Error Screen
Here is the code.
<?php
include_once("database/db.php");
$sqlNews = "SELECT * FROM news";
$runSqlNews = mysql_query($sqlNews);
while ($rowSqlNews = mysql_fetch_array($runSqlNews))
$arrSqlNews[] = $rowSqlNews;
header('Content-type: text/xml');
header('Pragma: public');
header('Cache-control: private');
header('Expires: -1');
echo "<?xml version=\"1.0\" encoding=\"utf-8\"?>";
echo '<xml>';
for($i=0;$i<count($arrSqlNews);$i++)
{
echo "<news>";
echo "<newsId>".$arrSqlNews[$i][id]."</newsId>";
echo "<newsAuthor>".$arrSqlNews[$i][news_author]."</newsAuthor>";
echo "<description>".$arrSqlNews[$i][news_description]."</description>";
echo "<newsText> <![CDATA[".$arrSqlNews[$i][news_text]. "]]></newsText>";
echo "<plainNewsDescription>".$arrSqlNews[$i][plain_news_description]."</plainNewsDescription>";
echo "<plainNewsTitle>".$arrSqlNews[$i][plain_news_title]."</plainNewsTitle>";
echo "<newsUrl> <![CDATA[". $arrSqlNews[$i][news_url]. "]]></newsUrl>";
echo "<newsCategory> <![CDATA[". $arrSqlNews[$i][category]. "]]></newsCategory>";
echo "<image>http://metroplots.com/images/members/".$arrSqlNews[$i][news_image]."</image>";
echo "<createdOn>".$arrSqlNews[$i][created_on]."</createdOn>";
echo "</news>";
}
echo '</xml>';
?>
New xml File after changes
<?php
ini_set('error_reporting', E_ALL);
include_once("database/db.php");
$dbConn = new mysqli($dbHost, $dbUserName, $dbUserPasswrd, $database);;
$sqlNews = "SELECT id, news_author,news_description,
news_text, news_url, category, news_image, created_on
FROM news";
$stmt = $dbConn->prepare($sqlNews);
$stmt->execute();
$stmt->bind_result($id, $newsAuthor, $newsDescription, $newsText, $newsUrl, $Category, $newsImage, $createdOn);
header('Content-type: text/xml');
header('Pragma: public');
header('Cache-control: private');
header('Expires: -1');
echo "<?xml version=\"1.0\" encoding=\"utf-8\"?>";
echo '<xml>';
echo "<news>";
while($stmt->fetch())
{
echo "<newsId>".$id."</newsId>";
echo "<newsAuthor>".$newsAuthor."</newsAuthor>";
echo "<description>".$newsDescription."</description>";
echo "<newsText> <![CDATA[".$newsText. "]]></newsText>";
echo "<newsUrl> <![CDATA[". $newsUrl. "]]></newsUrl>";
echo "<newsCategory> <![CDATA[". $Category. "]]></newsCategory>";
echo "<image>http://metroplots.com/images/members/".$newsImage."</image>";
echo "<createdOn>".$createdOn."</createdOn>";
}
echo "</news>";
echo '</xml>';
$stmt->close();
$dbConn->close();
?>
Please let me know where I went wrong. Thanks in Advance !!!
Hard to say what exactly goes wrong here.
For debugging, you could add a ini_set('error_reporting', E_ALL); at the beginning of your script or watch your php error log.
You got a few other problems in your script architecture
You should no longer use the mysql extension. Use mysqli or PDO instead.
The headers should be sent once only. Move them out of your loop to the top
why do you loop through the result twice? Remove the for loop and move its content into the while loop. Within the loop replace the variable $arrSqlNews by $rowSqlNews and remove the index accessor [$i]
Simplified example
while( $rowSqlNews = mysqli_fetch_assoc( $mysqliResult ) )
{
echo $rowSqlNews['yourdbCol1'];
}
Have you tried disabling PHP Output Buffering?
In PHP.ini: output_buffering = Off or comment out existing setting: ;output_buffering = On.
Don't forget to restart web server after changing settings.
I suspect that your upload tool transfers the file not in binary-safe way. Try to compare file sizes of the copy on your local machine and the remote one.

Categories