Assign html value to a variable in php - php

I ran into an issue that I am not able to figure out. I have a page that I want to add an image of "Verified" or "Unverified". The code I have is the following:
PHP
if($listing['priority']==0 {
$header->set('ver_status,'<img src="images/icon_unverified.png"/>');
} else {
$header->set('ver_status,'<img src="images/icon_verified.png"/>');
}
HTML
<?php echo $ver_status; ?>
For some reason when I run the page in my website, that variable comes up empty.
The database contains a listing table, and the table contains a priority field which the default value is 0. Unless a customer updates information, which automatically changes to priority field value to 1, all profiles state "unverified"
The $header is the variable assigned to the template
All priority codes at 0 should show the unverified image. All others 1-5 shold show the veriried image.
I did this in a different page and it worked fine. That code was:
if (config['language'] == 2) {
$header->set('language_flag','<img src="images/flags/Spanish.png" />');
} else {
$header->set('language_flag','<img src="images/flags/English.png" />');
}
where code 2 was Spanish and code 1 was English.
Is there something missing in my code that I am not seeing? I am not getting any error messages, just empty values.

You appear to be missing a close paren in your if statement. If that's copied and pasted directly out of your code, that could be causing issues - it should also be causing error messages, but you may have those turned off.
If it's just a typo from copying your code into SO, of course, this is unhelpful.

The variable comes up empty because there isn't one. If you want to retrieve an image through echoing a variable's value, simply type
if($listing['priority']===0){
$ver_status='<img src="images/icon_unverified.png">';
}else{
$ver_status='<img src="images/icon_verified.png">';
}
What you're doing in your code is setting an object's key, but when you're trying to get that same key, you're not referencing it correctly. echo $header->ver_status is how you should retrieve the value if you don't want to use a normal variable. I suggest reading http://php.net/manual/en/language.types.object.php
To note, you have a typo in your code as well. t('ver_status,' is an open string.
Also to note, there is no need for a slash in an tag unless you're using XML.

Related

Prevent end user manipulating URL to change content on website, method GET PHP

I have a personal search site project I'm building, at the moment the only data that is being displayed on the website is data that is retrieved using SELECT queries and the GET method using the super global $_GET['example']. Now I don't know if I'm doing this wrong but some parts of my page are only displayed if certain GET variables in the URL are set or not empty. Below shows how my URL looks
EXAMPLE: index.php?search_category=guitar&main_category=9&postcode_val1=NP22&distance_default=100&submit=search
I have a lot of these if(isset($_GET['search_category']) type conditions in my website which are replied upon and show particular parts of content depending whether or not these are either true or false.
I have been on a lot of other websites that have similar URL's, I have tried to alter and manipulate these and the content does not break, alter or change in any way yet when i try this with my url it breaks my page and only certain parts of content gets displayed by being based on what is set. Is there some other layer of protection I should add, would using something like a rewrite rule help? The code below shows how I have wrote a drop down box based on what has been set In the URL but if a user edits the URL this is easily broken.
if(isset($_GET['search_category']) && isset($_GET['main_category']) &&
isset($_GET['postcode_val1']) && isset($_GET['distance_default']))
{
$stmt = $getFromUi->dispCategories();
echo "<option value='0'>All</option>";
echo "<option value='#'>-------------</option>";
while($row = $stmt->fetch(PDO::FETCH_OBJ))
{
$selected = '';
if(!empty($_GET['main_category']) && $_GET['main_category'] == $row->cat_id)
{
$selected = ' selected="selected"';
}
echo '<option value="'.htmlentities($row->cat_id).'"'.$selected.'>'.htmlentities($row->cat_title).'</option>';
}
}
It will break because the strict nature of logic you use on your code. The && mark with isset mean any parameter you define not set will not evaluate to true. If the parameter is quite flexible why not ||.
If you need it to still evaluate all parameter try to do limit first if condition to main determiner. like $_GET['search_category'] and use the remaining $_GET['other_parameter'] as needed inside the block code of main if.
You would need to use a post method, so that this goes through as a request instead. In my experiance, get will only fetch the url you open - not actually pass anything through unless its in the URL.
Not sure if that made any sense, but check post out.
https://www.w3schools.com/tags/ref_httpmethods.asp is a good place to start to see the difference of get vs post.

PHP session changes unexpectedly in if statement and ignores echo command

I'm setting $_SESSION['showroom'] to 'active' when a particular page in Wordpress is displayed:
if(get_the_ID()==6470||get_the_ID()==252){
$_SESSION['showroom']='active';
}
I then set 2 arrays of pages to check against. If the next page displayed is NOT in one of these arrays, $_SESSION['showroom'] gets changed to 'inactive'.
$allowed_templates = array('template-A.php',
'template-B.php',
'template-C.php',
'template-E.php',
'template-G.php');
$allowed_ids = array(6470,252);
$template_name = get_page_template_slug();
$page_id = get_the_ID();
if(in_array($template_name,$allowed_templates)==false && in_array($page_id,$allowed_ids)==false){
$_SESSION['showroom']='inactive';
}
The if statement works most of the time, but sometimes my $_SESSION['showroom'] changes to inactive EVEN though one of the arrays is returning true! After several hours of testing I am unable to locate where the problem is. Echoing out the two parts of the if statement ALWAYS gives me 2 trues or 1 true + 1 false, but never 2 falses:
if(in_array($template_name,$allowed_templates)==false){echo 'TFALSE';}
if(in_array($template_name,$allowed_templates)){echo 'TTRUE';}
if(in_array($page_id,$allowed_ids)==false){echo 'IFALSE';}
if(in_array($page_id,$allowed_ids)){echo 'ITRUE';}
What am I missing here?
Thanks in advance for any help!
EDIT: Have continued testing and found the following anomaly:
if(in_array($template_name,$allowed_templates)==false && in_array($page_id,$allowed_ids)==false){
$_SESSION['showroom']='inactive';
echo 'SET TO INACTIVE';
}
The if statement changes $_SESSION['showroom'] to 'inactive' but DOES NOT echo out 'SET TO INACTIVE'!
There's something strange going on here!
Problem solved. My code was fine. Two missing images files were causing WordPress to crash my sessions. Took 10 hours to find out but happy I found it. Thanks to everyone for their help.
You can try the following;
if(!in_array($template_name,$allowed_templates) && !in_array($page_id,$allowed_ids)){
$_SESSION['showroom']='inactive';
}
Edit: lets try and break it down further... similar to your examples
if(!in_array($template_name,$allowed_templates){
echo "not in templates,";
}
if(!in_array($page_id,$allowed_ids)){
echo "not in ids,";
}
if(!in_array($template_name,$allowed_templates) && !in_array($page_id,$allowed_ids)){
echo "not in both\n";
}
then see if we get a result with not in templates,not in ids, but no trailing not in both
The problem is pure logical. Lets look at this statement:
if (in_array($template_name,$allowed_templates)==false && in_array($page_id,$allowed_ids)==false)
Which translates to "If the template is not valid AND page is not valid"
This means that both statements needs to be fulfilled in order to mark session as inactive. What if the template is fine, but the page is not valid? That definitely should be marked as inactive as well.
By changing the statement to read "If the template is not valid OR page is not valid", we cover up the invalid cases. Because either of them counts as an invalid state, and thus, only one of them needs to be false in order for everything to be false. (the OR-statement)
So code-wise it would be
if (in_array($template_name,$allowed_templates)==false || in_array($page_id,$allowed_ids)==false)
And you are set.
As and addition. I would structure the code as you noted works. Which is more logical. That is, mark it as inactive whenever it's should be treated as inactive, in all other cases mark it as 'active'. Or vice-versa.

Showing a href without needing to input text(Wordpress and html issue)

I'm on wordpress atm and I'm stuck with a small issue.
To save the people receiving the site some work I hoped i'd be able to make things as easy as possible.
So what I did was add a plugin called "advanced custom fields", and I made a custom field.
What I wanted was to have 1 custom field that'd show a link(as text) in the following way:
The issue
My issue is that I want the link(example) to show without needing to fill in "The issue", because in the backend(the wordpress cms) it's a lot of trouble for the person to fill in an extra sub field called name with the exact same value.
So my question is, is it possible to show a link without needing to fill in "The Issue" or is there a different html tag for this?
Thanks in advance!
You can check if the field "The Issue" is empty and only in this case reprint in this place the "example" field.
if (!empty(the_field('The issue'))) {
<?php the_field('The issue'); ?>
} else {
<?php the_field('example'); ?>
}
If you need to ensure that a link input from the user is external (that always begins with http://) you can do something like this (of course, before printing the $link variable in the href):
if (strpos($x, "http://") == 0) {
$link = $x;
} else {
$link = "http://" . $x;
}
strpos search the position of the first occurrence of a substring on your string ($x, for example). So if the position is 0 means that the string begins with "http://", so it is external, but if this is not the case you have to add it at the beggining of the string.
One have to note that user inputs are tricky (imagine that the user writes " http: //..." with a space before the url) so it is possible that one needs more validation than this, but I think that the idea is clear.

Turning a form's GET into a PHP variable?

I'm trying to make the following form's GET function to be part of a predefined variable.
Any ideas? Thanks in advance!
Let me explain a little more of what I'm really trying to do. I currently run a website concentrating on the U.S. stock market. I've created an HTML form with a method=GET. This form is used like a search box to look up stock ticker symbols. With the GET method, it places the ticker symbol at the end of the URL, and I created a quotes.php page that captures this information and displays a stock chart based on what ticker symbol is keyed into the box. For the company names, I've created a page called company.php that declares all of the variables for the company names (which happens to be a $ followed by the ticker symbol). The file, company.php, is the only file included in quotes.php.
This is where this came in: ' . $$_GET["symbol"] . '
The above code changes the GET into the variable based on what was typed into the form. I've used "die" to display an error message if someone types something into the box that doesn't match a variable in the company.php page.
I've also added into the company.php page variables for each company that will display which stock exchange each stock is listed on. These variables begin with "$ex_". So, what I was trying to do was have the symbol keyed into the box appended to "$ex_" so that it would display the corresponding stock exchange.
My questions are:
Is there a way to have what is typed into the form added to "$ex_"?
Is this an insecure way to code something like this (can it be hacked)?
Thank you all!
Rather than prefixing your variables and using variable variables (that are potentially insecure especially with user input), try this:
$ex = array(
"foo" => "bar",
...
);
if( !isset($ex[$_GET['symbol']])) die("Error: That symbol doesn't exist!");
$chosen = $ex[$_GET['symbol']];
Here's another approach:
extract($_GET, EXTR_PREFIX_ALL, "ex");
Although it's better to use it like this just to make sure there is no security issues.
extract($_GET, EXTR_SKIP);
PHP's extract() does what exactly what you want, and you should specify "ex_" as the prefix you want.
However, there are security issues and unintended consequences to using such a function blindly, so read up on the additional paragraphs following the function parameters.
Will the below achieve what you need?
$myGetVariable = $_GET['symbol'];
$ex_{$myGetVariable} = "Something";
$_GET['symbol'] = 'APPL';
if (!empty($_GET)) {
foreach ($_GET as $k => $v) {
$var = 'ex_'.$k ;
$$var=$v;
}
}
var_dump($ex_symbol);
APPL

Display data if usertype is admin otherwise display error message

I currently have a list of users in my mysql database. One of the columns is "type". I am trying to display certain data if type is equal to admin. If type is equal to anything else, it should just echo an error message.
Unfortunately, I have tried multiple methods but it just does not seem to be working out for me. Can anyone help me get this to work properly?
This is what I have, but obviously I am doing something wrong....
<?php
$usertype = $_SESSION['type'];
if ($usertype == "admin" ){
?>
admin stuff only goes here
<?
}
else
{
echo "not priveleged usertype";
}
?>
EDIT:
The following code works when displaying via username, however, I need content displayed by usertype, not the username.
<?php
if($_SESSION['user']['username'] == "oneoftheadminusernames" )
{
?>
Each page has to start with
<?php
#session_start();
?>
otherwise, php does not "see" the sessions contents. So that's probably it.
The # prevents the php error: A session has already been started... by the way.
Now, every page that uses the session must have this directive at the top.
At least, in a quick example, that reproduces your error perfectly.
If you are saving each logged in users type field in $_SESSION['type'] variable than the code you are writing is correct. Or if you are storing type in another variable than you that variable to check.
i have an idea like add a field EnableFlag in the table. if enablee flag is set to 1 consider it as a admin else as a User;

Categories