PHP file upload problem - php

I've got a really annoying problem with file uploads.
Users can choose a file in an html file field. When they submit the form, this file will be uploaded.
On the serverside I just use standard PHP code (move_uploaded_file). I do nothing weird.
Everything works perfectly.
I can see the file on the server, I can download it again, ...
However sometimes this doesn't work. I upload the file, process it and I get no errors.
But the file just doesn't exist on the server.
Each time I upload that specific file I get no errors but it never gets saved.
Only if I rename it (test.file to tst.file for example) I can upload it and it'll actually get saved.
I get this problem very rarely. And renaming always works. But I can't ask users to rename their files obviously...
I have no access to the apache tmp file directory, no access to logs or settings so this makes debugging even harder. I only have this problem on this particular server (which I don't manage; I don't even have access to it) and I use the exact same code on lots of servers that don't have this problem.
I would be grateful if someone could help me out here or point me in the right direction.

Trying adding this debug code:
echo '<pre>';
print_r($_FILES);
echo '</pre>';
You should see an error number. You can lookup what it means at http://uk3.php.net/manual/en/features.file-upload.errors.php
Might also be worth checking to make sure the destination file doesn't already exist.

My first thought was filesize issues. In the php.ini, if the post_max_size or upload_max_filesize are too small, you can end up with similar results - where the file just seems to disappear. You would get an error in the apache logs (which you mention you've no access to).
In those cases, the $_FILES array would simply be empty - as if the file never arrived. Since your responses to Gumbo and James Hall show that php is reporting a proper upload, I'm led to wonder about the processing you mention.
If, during the process, your memory gets maxed or the script runs too long, the script may be dying out before it gets a chance to move it. You'll want to check these:
memory_limit
max_execution_time
max_input_time
Otherwise, without the apache logs, I'd say it might be a good idea to start outputting to a log file of your own throughout your file processing script. Try a file_exists on the tmp file, see what info you can get from the file (permissions, etc).
Unfortunately PHP doesn't get involved until the upload is finished, which means you won't get much info during - only after the fact. You best option might be to talk to the hosting company and get access to the logs - even if for a short time. In my experience, I've rarely had trouble getting ot the logs - or at least getting a tech to check the logs for me while I run tests (in the case where a shared server doesn't split their logs - seems ridiculous, but I've seen it before).
Edit: I realize you can't change those php settings, but you might want to see what they are in order to find out if they're potential problems for your script. For instance, a low memory limit will kill your processor script if it's less than the size of the uploaded file.

If an upload failes you don’t get the same kind of error like a PHP syntax error or such.
But you can check the file upload status and report the error to the user yourself.

This is what you said...
"I have no access to the apache tmp file directory, no access to logs or settings so this makes debugging even harder. I only have this problem on this particular server (which I don't manage; I don't even have access to it) and I use the exact same code on lots of servers that don't have this problem."
According to what you said above, I assume that you are using a server that is shared among many users. If the Apache of this server is configured with something like "mod_suphp", then your PHP scripts will be executed using the privileges of your UNIX user account ("jef1234", for example), which means the files you create will have you ("jef1234") as the owner (instead of "apache" or "www-data").
The system's temporary directory (usually "/tmp") is usually configured with the "sticky bit" on. This means everyone can create files in this directory, but the created files are only accessible by the owner (you may treat this as the one who created it).
As a result, if the server configuration is not careful enough, you may have file naming collisions with other users' files. For example, when you upload "test.file", if another user has already uploaded another file with the same name, the system refuses to overwrite the file created by him, as thus you have to use another name.
Usually the problem does not exist because PHP is smart enough to generate temporary names for the uploaded file (ie. $_FILES["html_form_input_name"]["tmp_name"]). If somehow you can confirm that this is really the reason, the server is obviously mis-configured. Tell your system administrator the problem as ask him to solve it. If this could not be solved, you may do some JavaScript tricks on the name of the file before it is uploaded (not tested, just an idea)...
★ When the user submits the form, rename the file from, for example, "test.file" to "jef1234-test.file-jef1234". After the file is uploaded, move the file (ie move_uploaded_file()) to another place and rename it to the original filename by removing the added strings.
Hope this helps...
Asuka Kenji

Related

PHP File edits not taking affect after uploading to the server

I have a PHP helper class with all static methods. When I add a new method or make
any changes to the file and afterwards upload to server, the server does not detect the changes. I get an error saying
Fatal error: Call to undefined method Class::functionName() does not
exist
even though it does exist.
I've tried restarting Apache Server and also clearing browser cache. I don't have any caching setup on server either.
if you can, connect to the server with ssh and do some investigation. for example, search for the php file with find, to see if it lies around multiple times, check last modified dates, and of course the contents. also maybe modify the main file of your webpage (for example index.php), to verify that you are looking in the right place.

Wordpress Importer showing blank page after clicking the Upload File and Import button

I have been trying to import an .xml file from my old WordPress to a new one. I have the following settings in php.ini:
upload_max_filesize = 64M
post_max_size = 90M
memory_limit = 128M
But when I click on the Upload File and Import button Im getting a blank page. No errors or anything.
Anyone has any idea how to solve this? Thanks.
UPDATE:
After turning on the error display which was suggested below I was able to get the following error:
Fatal error: Class 'DOMDocument' not found in /var/www/html/wp-content/plugins/wordpress-importer/parsers.php on line 61
which I was then able to fix by installing php-xml.
This question in its original form did not provide enough information to justify actually trying to guess the solution.
Therefore I felt the most relevant answer was some general troubleshooting steps that may shed more light on a similar situation - my focus is on tips that may help in this particular situation, but since it is going to be rather lengthy anyway I do include some more general tips as well.
The OP is not actually asking for alternatives to the wordpress import / export function, but since this is a migration gone sour (plus the fact that the wordpress import / export feature leaves a lot to desire), I will try to answer Alans question regarding alternative ways to migrate wordpress between servers / locations / domains as well.
At risk of stating the obvious: This answer is going to be long!
Debugging wordpress errors in general
Step 1. Make sure you can see what goes wrong
Enable debug mode, and make sure display_errors is enabled, and an appropriate error_reporting level is defined. This is vital to any wordpress development.
Open wp-config.php and find this line:
define('WP_DEBUG', false);
Replace it with:
//Switch on wordpress' built-in debug mode
define('WP_DEBUG', true);
/**
* Just a convenient check so you can leave the next few lines unchanged
* for next time you need debugging, and just switch true/false above.
*/
if (WP_DEBUG) {
//Handle all errors regardless of error level
ini_set('error_reporting', -1);
//Display errors directly in the browser
ini_set('display_errors', 'On');
}
...if for some reason the line isn't there already, just insert it somewhere above the line saying.
/* That's all, stop editing! Happy blogging. */
This should allow you to see some more information about most (php-)errors.
Notes:
In most cases, simply setting WP_DEBUG to true will automatically enable display_errors - however I have found the above to cover some edge cases where errors where not shown in spite of WP_DEBUG being true.
On a live (production) site it may be very undesirable to display errors to every visitor, so you may want to:
enable WP_DEBUG conditionally, for example by IP: define('WP_DEBUG', $_SERVER['REMOTE_ADDR'] === '123.123.123.123'); (obviously substituting your actual IP)
log errors instead of displaying them - see the wordpress codex for more information: Debugging in WordPress
If you have low-quality or outdated plugins or themes installed you are very likely to see a lot of output from poorly written functions within those.
If you do see errors referencing one of your plugins as soon as you enable debug mode my recommendation is to either contact the plugin developer regarding the issue, or simply uninstall the plugin and find another one that satisfies your need. Plugins from developers who didn't even care to use debug mode during development are highly likely to also contain security issues and / or be sub standard with regards to future- or third-party compatibility.
Step 2. Reproduce the error
Whatever you did to make the problem happen - do it again. This should give you something to work with, for example by simply pasting it on google and see what comes up. Chances are you're not the first to experience whatever problem your are having.
If you still get no visible errors try to right click the "nothingness" and view the page source in a plaintext editor. Sometimes errors can be hidden inside an attribute, or behind an element on the screen.
You can also try to insert some intentionally broken code in wp-config.php to confirm that errors will in fact be printed. For example type this_function_surely_does_not_exist(); right after the ini_set() directives.
Some hosts restrict the use of ini_set(), so if things still aren't working, but you do not see any errors try to find out how you can set the relevant php.ini settings - it may be in your hosting providers control panel (cPanel, Plesk etc.), you may have direct access to your php.ini via FTP... or they may offer no way to set it (find a different provider at once!)
It is also possible that you cannot change the value, but errors are logged somewhere in your providers panel by default.
If you get a completely white browser window it is likely that you have a fatal error somewhere - or a configuration problem on the server itself. This is outside the scope of this answer, so if the suggestions regarding increasing limits in the next section doesn't work, try to google "WSOD" to get started.
Find actual limits and settings
Do not trust that just because you have a file called php.ini that contains a line saying memory_limit = 128M your memory limit is actually 128M. This can be set in so many different ways that the only reliable way to know is to ask php what its current memory limit is. This is true for most php.ini-settings!
To get a fair idea what your working environment looks like create a file (preferably in the root of your wordpress install) called phpinfo.php, with the following content:
<?php
//Your memory limit
echo 'memory_limit: ' . ini_get('memory_limit') . '<br>';
//Your maximum size of post-data (including file uploads)
echo 'post_max_size: ' . ini_get('post_max_size') . '<br>';
//The maximum file size for uploads
echo 'upload_max_filesize: ' . ini_get('upload_max_filesize') . '<br>';
//Maximum runtime for php scripts (in seconds)
echo 'max_execution_time: ' . ini_get('max_execution_time') . '<br>';
//Current error reporting level
echo 'error_reporting: ' . ini_get('error_reporting') . '<br>';
//Are errors displayed?
echo 'display_errors: ' . ini_get('display_errors') . '<br>';
//Will errors be logged?
echo 'log_errors: ' . ini_get('log_errors') . '<br>';
//Where will errors be logged?
echo 'error_log: ' . ini_get('error_log') . '<br>';
//What is the absolute path of this files parent folder
// = the complete path to your wordpress "root folder"
echo 'root of wordpress: ' . __DIR__ . '<br>';
/**
* If you are curious to see *a lot* of information about your environment
* then uncomment this line too:
*/
//phpinfo();
/**
* This should print whatever is in the error log, but it could potentially
* be huge, so use with caution!
*/
//echo '<pre>' . file_get_contents(ini_get('error_log')) . '</pre><br>';
You should be aware that all of the above values can be changed during execution of a script - and some (poor quality) plugins actually will. I've seen plugins try to increase the memory_limit for instance - which is all fine and dandy, except 6-7 years pass, and a plugin "increasing" the memory limit to 32MB actually messes up the installation, because nowadays 64MB is needed for a pretty basic wordpress install, and 128MB would be a more reasonable minimum for most. The problem with this is that the only way to actually know the values for sure at any given point of execution is to insert the above right at that point.
Some very common reason for errors that happen "on occasion", particularly in connection with imports or file uploads is that either memory_limit, post_max_size or upload_max_filesize is set too low - you can try to increase them using ini_set() calls in wp-config.php:
ini_set('memory_limit', '256M');
ini_set('post_max_size', '128M');
ini_set('upload_max_filesize', '64M');
Again your host may completely prevent you from affecting your limits using these functions, but may provide another way for you to set them.
If that doesn't work either, try disabling as many plugins as possible, and as a last resort switch to a default theme - but be prepared to lose widgets and a bunch of settings if things get to that.
If you're still stuck at square one ask a question on Stack Overflow, and be very verbose about exactly what you did before it all went south ;)
Cloning / Migrating / Moving or Backing up a wordpress site
There are a lot of backup / migration plugins out there. If you are inexperienced working with files, databases and the like your best bet is probably to go with one of those. I will not recommend any specific plugin as changes are too frequent and I personally always do it manually - a google search should yield plenty of relevant results though, and I'm sure many of them can get the job done in most situations.
However, if like me, you prefer to do it manually to understand (and control) the process, here is the method I use to move, rename, clone or back up wordpress installations routinely - it should work for almost any standalone installation (ie. if you're trying to move a multisite you should probably go look for another guide).
These instructions should work whether you are
migrating from one server to another - for example development to production
migrating from one domain to another
migrating from a sub-folder to the domain root (or the other way)
taking a backup (just stop half way through the process, and continue where you left off if you ever need to recreate your backup)
The basic steps are:
Get a copy of all files
Get a copy of the entire database
Do necessary corrections in files
Upload files to new server (or same if you are restoring a backup)
Load up the database on the new server
Do necessary corrections in the database
This requires that you have access to:
Your files, for example through FTP or perhaps your hosting provider has a tool that can create an archive containing all your files.
Your database, for example through phpMyAdmin or any tool that can make a complete database dump for you.
All decent hosting plans, and nearly all inexpensive shared hosting plans come with phpMyAdmin and FTP access. VPS', private servers etc. obviously comes with direct file and database access which will be even better (or at least faster).
If you do not have access to the above wherever your site is hosted, it is likely because you bought your site from someone who does not want you to move it away (usually because they designed your website for free or at a very low cost, and need you to stay with them to get back their investment). If that is the case you can try one of the many backup / migration plugins, but chances are they don't even allow you to install plugins, so you'll have to contact them and work out some agreement instead.
(if you do not have access to your database, but you do have access to your files you can install phpMyAdmin yourself - but how to do that is way outside the scope of this answer)
Note that depending on what operation you are actually doing, some steps can be skipped - which you can feel free to do once you understand the process, and why each step is (sometimes) required - but if this is your first time just start from the top and work your way through each step.
Step 1. Get a copy of all files
You'll want to get all files in the "root" of your wordpress installation. That is the folder containing wp-content, wp-admin and wp-includes plus about 15-20 files. Make sure you get hidden files too (for example the file .htaccess will likely be hidden by default if you use FTP - in some cases this file is completely irrelevant, but in others it can be essential, so just make sure you get everything)
If your hosting provider has some sort of file manager you may want to try that first. A lot of file managers offer the option to up- or download folders as a single compressed archive - which will be a lot faster than downloading all files individually.
If you have a VPS or any solution with SSH or some other form of console access, use that and navigate to the "root" of your installation, then zip everything up - something like zip -r my_wp_backup.zip . should do. Download the file using whatever means you have.
If you only have FTP access to your files, it may take a while, but you simply log in with FTP (my favorite FTP client is FileZilla, because it's easy to use, and allows several simultaneous transfers... but any client should be fine). Navigate to the "root" of wordpress and transfer all files to a local folder on your computer (don't forget to show hidden files!)
Step 2. Get a copy of the entire database
If you have access to phpMyAdmin through your provider use that - it is by far the easiest, and I have never had a problem, except with extremely special databases or extremely old versions of phpMyAdmin.
Just log in to phpMyAdmin, select your database, click export and accept the defaults (options are very different depending on the version, but the defaults should be fine for any "normal" wordpress database). This should give you either a file download with a name ending in ".sql" - or a big text-field with huge amount of text in it. If you get the latter just copy it to a regular text file on your local computer - notepad, notepad++ or any other plain text editor will work (ie. don't use word, google docs or any other rich text editor!)
If you don't have access to phpMyAdmin you can either install it (which I'm not going to describe), or you must find some other way to export the database, for example:
If you have console access this command should give you a usable dump: mysqldump -u your_database_username -p your_db_name > my_backup.sql - if you don't know the name of your database, take a look in wp-config.php (also contains your username and password if you don't know those)
If you don't have console access either go explore your providers control panel - surely they have some way to let you make a database dump.
Step 3. Do necessary corrections in files
You should now have a complete backup on your local disk.
If you are just doing a backup you're done - the files and database are ready to be uploaded to the same location, and everything will be restored to the current state.
If you are moving to a different server or a different location on the same server find out:
what your new path is (upload the phpinfo.php file above if your provider doesn't give you any clues)
what your new database username and password is
if you need a special hostname to connect to the database (localhost is sufficient in most cases, but some providers have dedicated mysql-servers that require you to connect to some other hostname)
Correct your wp-config.php file - the relevant lines are:
/** The name of the database for WordPress */
define('DB_NAME', 'your_database_name');
/** MySQL database username */
define('DB_USER', 'your_database_username');
/** MySQL database password */
define('DB_PASSWORD', 'your_database_password');
/** MySQL hostname */
define('DB_HOST', 'localhost');
Though it's rather rare some plugins do write information in files that needs to be updated, so if the absolute path of your wordpress root folder, or the absolute URL of your installation is changing in the process of migrating you should also do a complete search and replace for those:
If the old absolute path of your installation was /var/www/www.example.com/web/blog and your new absolute path is /var/www/blog.example.com/public_html then search-and-replace those throughout all files. Do not include a trailing slash!
If the old URL was http://www.example.com/blog and the new URL is going to be http://blog.example.com do a search for www.example.com/blog replacing with blog.example.com. Do not include http:// and do not include a trailing slash!
Note that if for some reason you are in a situation where you do not know your old absolute path and / or URL you can find them in the database, so do step 5 first, and look in the prefix_options table for the values siteurl (your absolute URL) and upload_path will usually contain your absolute path (plus /wp-content/uploads) - if it doesn't then there will probably be other rows in the table that can tell you what the path was, look for something that starts with /var/www or /home/something.
Step 4. Upload files to new server or new location
As in step 1 your options may vary, but the point is to get all files uploaded to whatever folder is going to be your new root. Use whatever means you have available to do so.
Do not give in to the temptation to "try" the site out after uploading files - though unlikely it can have unforeseen consequences if you visit before all steps are completed!
Step 5. Load up the database on the new server
Again, options vary:
If phpMyAdmin is available simply log in, select your database, click import and upload the file from step 2. Sometimes I even click the SQL tab instead, and just paste the entire content directly in the big text field.
If you have console access you can upload the file and run mysql -u your_database_username -p your_new_db_name < my_backup.sql
Step 6. Do necessary corrections in the database
If you're restoring a backup to the same server and location you are done.
However, if you are migrating to a different server or a different URL you need to be aware that Wordpress itself, as well as a lot of plugins writes your absolute URL in a lot (thousands) of places in the database, and your absolute path is likely to also be present in at least a couple of rows.
You also need to be aware that a lot of plugins, as well as some core wordpress functions use the php function serialize to store complex data easily in the database. That format is very sensitive to changes, so a "regular" search and replace is very (very!) likely to break everything.
Luckily there is a free tool specifically designed with this in mind. I have no affiliation, but I cannot recommend interconnect/it database search and replace enough. It is well-maintained, super user friendly, and I have never personally experienced it mess anything up.
Download it using the link above, unzip it, rename the folder to something_random_for_security and upload it to your wordpress root folder. Then go to http://blog.example.com/something_random_for_security in your browser (obviously substituting relevant parts of the URL).
You'll be presented with a neat graphical interface, and it has probably already filled in your database details for you (by reading your wp-config.php).
At the top of the screen there's a search field and a replace field. Don't mess with anything else, unless of course it actually failed to get your database information automaticall.
Like for files you need to search for:
your old absolute path and replace with your new absolute path (excluding trailing slash)
your old absolute URL and replace with your new absolute URL (excluding protocol http:// and trailing slash)
You can use the "Dry run" button first to see what will be changed, and if any obvious problems might arise - after that just click the "Live run" button and it'll chew through your entire database replacing in a serialize()-safe way where relevant.
Step 6,5 Broken permalinks
If you have moved your site from one folder to another folder (or up or down a level), then permalinks / "pretty URLs" may not work (ie. your front page is fine but everything else is one big error). This is because of the rules in that "hidden" .htaccess-file getting "confused". The fix is very simple - just visit the "Settings" -> "Permalinks" in the wordpress admin... you don't need to make any changes, the file is automatically refreshed as soon as you visit the page.
Done
Check that everything works, then go celebrate...
Your directives are in the wrong format. Try
upload_max_filesize = 64M
post_max_size = 90M
memory_limit = 128M
max_execution_time = 120
If those don't work, ask your webhost; you may not be able to make changes in php.ini.
And try running debug https://codex.wordpress.org/Debugging_in_WordPress to catch PHP errors that may point the way to the issue and solution.
The only way to find out what is causing the blank screen is check your server error log.
And also take reference from here
try this,after making the necessary changes for uploading a file in php or wordpress i.e
post_max_size = 90M
max_execution_time = 120
upload_max_filesize = 64M
memory_limit = 128M
other steps,
1)Increase the PHP memory limit via .htaccess (e.g. php_value memory_limit 64M)..
2)Increase the PHP memory limit via wp-config.php (e.g. efine(‘WP_MEMORY_LIMIT’, ’64MB’);)
finally check,
https://codex.wordpress.org/Importing_Content
These steps may help:
After showing the blank page, the page keeps running in background (you can see this in flight by refreshing the wp_posts table or wp-admin)
Inside wp-includes/deprecated.php there is a function named wp_get_http() with #set_time_limit( 60 );, change this to 0 to disable limitation.
This worked for me:
No images imported
Wordpress Tools > Export did not attach images even though settings state it to be true. The import process on the target site crashes. To fix that I installed the DeMomentSomTres Export plugin on the exporting site that forces the import process on your target site to make a connection to the export site and then pull the images over. That worked well.
No content when editing
However, when editing the imported posts, the content wysiwyg editor box appeared empty even though the text would display on the front end. Initially I thought it was a database issue. Then, I tried deactivating Classic Editor plugin and edited a post. Whaa-la the content appeared in edit mode. Next, after re-activating Classic Editor plugin, the content stuck. All good.
I got the same behavior today while exporting All Posts and Media from a client site using the usual WordPress Importer.
I tried changing the PHP.ini settings suggested in other answers, but that didn't help probably because they can't be overridden. Importer will stop showing the loading icon after 1 minute or two. No errors appeared even when I set DEBUG to true.
However, when I checked the wp-content/uploads folder I could see some of the folders and images were uploaded (check modified date) yet the execution timeout stops the importer before it can finish.
My solution was to keep importing the same file again and again until the whole thing is finally imported. This works fine because WordPress Importer won't import a Media or a Post again if it's already imported/exists.
So even if there is a timeout setting you can't change, multiple attempts will get it done unless you have huge media files exceeding max file size.
Of course, if it's a huge amount of images you should find another solution.

Get file contents in Joomla

I'm trying to get a file's content into a variable but I don't get anything when I read the file. I used both methods JFile::read() and file_get_contents() but both return the same thing: a blank string, not an error , not any boolean values or anything.
I want to mention that I'm working on a Linux machine (just for 2 days) and recently I changed the permissions for the entire machine to 777 ( I don't know if this affects something or not).
Is the a connection between my OS, permissions and the php's file_get_contents()? or Joomla restricts file reading?
Also I want to mention that my file_get_contents() function was added manually by me in the index.php file , also the file I want to read was manually added in the same folder with index.php.
We had the same problem with one of our clients, it turned out it was a firewall issue. It was very hard to debug this issue. I suggest you check with your networking team.
I am assuming, of course, that you have set the PHP error reporting level to the maximum and that you have checked the error logs.
It seemed the problem was from my system . I messed it up when I changed the permissions so I have to re-install it.
Never change the permissions on a Linux for the entire file system.

Where do I hide my login info when using PHP connect to get to a database?

I need to connect to a mysql database using PHP. I am storing my login, user, password, and other info in a separate php file (let's say "mysql_connect.php") and then accessing it via require_once (mysql_connect.php) in a different file.
I have done a bit of googling and I know that I am supposed to keep "mysql_connect.php" out of the web root. I have moved it outside of the html folder and tried calling to it by using "../../mysql_connect.php" This is not working, it gives me an error "function not found" or something like that. Upon googling that, the internet says that its because it can't locate the file i'm referencing. When I move mysql_connect.php into a folder below root, everything works fine. The issue is because it is moved outside of the web root (i think).
I have been googling for two days now and cannot find a detailed explanation on how to get this to work. Something about changing the .htaccess file? I've read a bunch of articles on the theory but I am really looking for a step-by-step tutorial (I am a beginner). The only step-by-step tutorials I can find just tell you to put the config.php file into the same folder which is not secure.
Also in reading, it says that putting mysql_connect.php above root might not be THE most secure way to store the information as it is still basically just a .txt file and it can be retrieved easily(like downloading it). I am looking for a balance between secure and also do-able (for a beginner like myself). The mysql database I am trying to protect will not have any personal information and I plan on using a dedicated server (with no other information on it).
Can any one help me to solve this issue?
it gives me an error "function not found" or something like that.
This.
Is your main problem.
You either didn't bother to read this error message yourself nor didn't bring it here to help us to help you.
While
there is no problem in having this file below document_root,
and there is no problem in having this file above document root either,
the only problem you have is to assign a correct filename.
And the error message you got could help you more than 1000 volunteers from this site.
Despite of that, you can use PHP predefined variable to make this path work from whatever part of your site. Aassuming the file is one level above the document root, the code would be
require($_SERVER['DOCUMENT_ROOT']."/../mysql_connect.php");
however, this one may produce an error too, as nobody knows a real file locations. Thus, you may read the error message and corect the paths. Or post it here and get an interpretation
You can store the database information inside your web server configuration.
If you run Apache you can use SetEnv inside the VirtualHost. Since you're still on a shared host, your server admin probably need to help you with this. You can read more about this approach here.
... tried calling to it by using "../../mysql_connect.php" This is not working, it gives me an error "function not found" or something like that.
Include the connection details with:
require_once("../../mysql_connect.php");
This assumes that the file mysql_connect.php is two levels up from the currently executing script.
The database connection details will always be able to be read by whomever has administrative access to the server. It is not feasible to encrypt the file, because you would still need to store whatever key or password needed to decrypt it on the server as well, which would still not hide it from the server administrators.
Besides moving out of the web-root (which is a good step forward) an approach I've seen used is:
// at the top of your index or bootstrap file
define('SECURED', true);
And:
// at the top of any file subsequently included, such as mysql_connect.php
if(!defined('SECURED'))
{
exit();
}
This will at least prevent the file(s) from being accessed (executed) directly. This is helpful is the to-be-included files would otherwise issue a warning or error, that could potentially dump sensitive data as output.
If you're in a shared hosting environment you won't be allowed access outside of document root (most likely). You will need the password therefore it won't be completely secure. Instead, you can look into creating seperate mysql users with priviledges and limiting connections to to local accesses only.
i know i'm new, but something as simple as form for your login should be checked in order for it to work.
<form action="insertphpfilepath.php" method="POST">
and then in "insertphpfilepath.php", would have the mysql_query to check the login and password, not forgetting the mysql_query for connecting to the database and table using the right username and password .
a newbie recommendation to you for use mysql_real_escape_string for any $_POST['login'] so that it would become $login=mysql_real_escape_string($_POST['login']); for evading mysql injection.

Issue with AJAX/PHP/Apache data transmission and file permissions

I'm doing some analysis on user keystroke patterns for a biometrics-related prototype that I'm building. I'm having an issue where I pass variables via POST to another webpage, and that webpage calls a script that writes to the local server in a directory based on the data that's passed to it.
My prototype is simple: the user types some data into a text form, the keystrokes are collected, the user clicks submit at the end of the task, and that data is sent off to the server to be analyzed. However, PHP refuses to write to the directory specified via the web. If I go into the command-line PHP, it works. I even tried changing POST to GET in insertData, and passing in the data manually.
Here are a few things I think could be wrong:
My AJAX is wrong. It worked locally, but doesn't work on the web. However, I could have inadvertently changed something, and that's the source of this issue.
My file permissions for apache are incorrect. It's odd, though, because Apache owns the folder/file in question. SELinux is disabled, so that's one thing off of the list. I even tried chmod 777 on the folders in question, to no avail.
There's a directive in httpd.conf that I'm missing, and apache is just not allowing web writes.
Server information:
CentOS 5
Apache2.2
PHP 5.3.6
Here is the source code for clarification. Assume all site names et al are correct.
http://jyaworski.pastebin.us/2799
GatherData.php
http://jyaworski.pastebin.us/2800
GatherData.js
htt://jyaworski.pastebin.us/2801 //sorry. SO won't let newbies post more than 2 links. Add a "p" to http
InsertData.php
Thank you in advance; this issue has been plaguing me for some time.
Apache probably doesn't have write permissions on ".". Try putting it in /tmp and see if that fixes your problem. If so leave it there or add write permissions for apache in the directory you're trying to save the data to.
$dir = '/tmp/userdata/'.$id.'/';

Categories