cURL and PHP displaying "1" - php

Question

I have a PHP script with which I want to read servers from database and connect to them with cURL. Servers responds with results from sql query. The problem is that script after each respond from server displays number 1. The ouput looks like this:
Server 1: some results
1Server 2: some results
1Server 3: some results
1
Here is the code that reads servers from database and connects to them:
<?php
$mysql_id = mysql_connect('localhost', 'ms', 'pass');
mysql_select_db('servers', $mysql_id);
mysql_query("SET NAMES utf8");
$query = "SELECT * FROM svr";
$result = mysql_query($query);
$num = mysql_num_rows($result);
while ($data = mysql_fetch_assoc($result))
{
$server[] = $data;
}
mysql_close($mysql_id);
$i = 0;
while($i < $num) {
$dealer = $server[$i]['dealer'];
echo $dealer . "<br />";
$data = "val=a"; //just for testing
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: text/html; charset=utf-8')
);
$result = curl_exec($ch);
echo $result;
$i++;
}
?>
I discovered that 1 is displayed with "echo $result;" and the code for creating response is this:
<?php
$mysql_id1 = mysql_connect('localhost', 'ms', 'pass');
mysql_select_db('servers', $mysql_id1);
mysql_query("SET NAMES utf8");
$query2 = "SELECT * FROM data";
$result2 = mysql_query($query2);
$num2 = mysql_num_rows($result2);
while ($data2 = mysql_fetch_assoc($result2))
{
$deli[] = $data2;
}
$i1 = 0;
$space = " ";
while ($i1 < $num2) {
echo $space . $deli[$i1]['id'] . " ";
echo $deli[$i1]['artikel'] . " ";
echo $deli[$i1]['znamka'] . " ";
echo $deli[$i1]['model'] . " ";
echo $deli[$i1]['letnik'] . " ";
echo $deli[$i1]['cena'] . " € ";
echo $deli[$i1]['zaloga'] . "<br />";
$i1++;
}
echo "<br />";
mysql_close($mysql_id1);
?>
Please help me

Answer 1

Use the CURLOPT_RETURNTRANSFER option. Otherwise cURL will automatically echo the data and just return true (which is converted to 1 by echo).
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
PHP.net says,
TRUE to return the transfer as a string of the return value of curl_exec() instead of outputting it directly.

Answer 2

You need to use CURLOPT_RETURNTRANSFE or curl_exec returns a statuscode and sends the response to stdout:
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

Answer 3

CURLOPT_RETURNTRANSFER shoud be TRUE to return the transfer as a string of the return value of curl_exec() instead of outputting it out directly.read the full documentation php.net
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
or you can do
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

Answer 4

Use CURLOPT_RETURNTRANSFE or else it will return a status-code and sends the response to stdout:
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

Answer 5

Man, if the user can change dealer field or $deli fields you have got stored XSS vulnerability here.
$dealer = $server[$i]['dealer'];
echo $dealer . "<br />";
echo $space . $deli[$i1]['id'] . " ";
...etc
use
htmlentities($your fields)
to solve this problem