Is mysql_real_escape_string sufficient for cleaning user input in most situations?
::EDIT::
I'm thinking mostly in terms of preventing SQL injection but I ultimately want to know if I can trust user data after I apply mysql_real_escape_string or if I should take extra measures to clean the data before I pass it around the application and databases.
I see where cleaning for HTML chars is important but I wouldn't consider it necessary for trusting user input.
T
Hi guys!
So, i have a application that displays tasks and i created an option in the Settings menu that lets you choose in how many days all (Never, 10 days, 20 days or 30 days) these tasks should be automatically deleted. So when i open up the app there will be a method that will be called and check if theres any tasks to be deleted. I did that to challenge myself, but i'm hitting the wall with my head and i cant come up with something. So here i am in need of help!
A little more information: i was trying to do something with java/android code, but from past searches i saw people dealing with it using SQL functions. Is it better?
Thanks in advance guys!
Hi,
I am about to implement a very basic licensing feature for my application. A serial number may be granted per-machine (or per-operating-system) or per-user (as for CAL in Windows Server: if my application is used by several users on one machine or if it is used by one user on several machines).
For per-operating-system licensing, I use SerialNumber of Win32_OperatingSystem.
For per-user licensing, I use:
WindowsIdentity currentIdentity = WindowsIdentity.GetCurrent();
if (currentIdentity != null)
{
SecurityIdentifier userSid = currentIdentity.User.AccountDomainSid;
Console.WriteLine(userSid);
}
A hash of an obtained OS serial number or SID is then stored in the database, associated with application serial; each time the program starts, it queries the server, sending hash of OS SN/SID and application serial.
Is it a right thing to do it or is it completely wrong? Will it work on every Windows machine? (For example, using motherboard serial is wrong)
Scott Gu explains how to run visual web developer using a root path, here:
http://weblogs.asp.net/scottgu/archive/2006/12/19/tip-trick-how-to-run-a-root-site-with-the-local-web-server-using-vs-2005-sp1.aspx
This worked exactly as he described in one instance for me. But, today I do not see this option. More over, I do not think I have a solution file, and I think that has something to do with it.
I'm aware there are web application projects and web site model, and web site model is basically just a "directory". But can web site model, also, have a solution file for this setting or not a solution file? What determines that? I am interested in using this method on on a web site, i.e directory only model.
I'm using Drupal 6.16: I think I have a pretty simple question. How can I get the current user id and put it in a menu tab. What I would like to happen is when the user logs in and wants to change their their name, email etc to click a menu tab. I image it would look something like this: http://domain.com/user/{userid}/edit
Thanks in advance!
msindle
I want to use the CakePHP Helper "time" and his method niceShort to transform a date into a nice, easy to read one. Instead of the english default transformation I want to use a localized version (in my case: "german") but I don't know where to set this. How can I localize this method?
echo $time->niceShort($comment['created']);
I have a web app that I would like to have the following functionality:
user gives a url
webapp gets json data from that url and others from same website (this can take anywhere from 1-10 seconds)
webapp uses data to generate page for user
With this approach, I believe that if the server is in the process of getting the data for one user, then the other user won't be able to load the page (server busy). I would like to avoid this if possible.
It seems like the Google Tasks API would be useful for this, but I don't see how I can run the task, and then use the output of the task to generate the page (how would the main app know when the task was finished?)
What is the best way to resolve this?
Thanks in advance
Is it worth to set the service with ConcurrencyMode.Multiple and InstanceContextMode.Single attributes to save some performance when using named pipes ?
I mean when I do so I have to bother with multithreading issues.
I've read the "Create Multi-Step Wizard" in Advanced Rails Recipes. I've also read and re-read the documentation for the updated FSM I'm using called Workflow, and looked here and here. The Advanced Rails Recipe focuses on records (quizzes) that already exist, and doesn't cover creating new ones. The Workflow docs don't cover any code for controllers or views, so I've no idea what to do with all this model magic, and the last two links barely touch on implementation either. From the aforementioned resources, I have a good understanding of what a FSM in Rails is and how to play with it in the console or IRB, but I've got very little direction or understanding how to implement one into my Rails app.
What I would like is this: a simple, multi-step user signup process.
Step 1: User enters in their critical
details (with validations).
Step 2: User enters in their search
criteria, for their profile (with
validations).
Step 3: User agrees to the Terms of
Service (with validations).
Step 4: User is greeted by a
confirmation page, including a link
that takes them to their newly created
account.
I'd also like full navigation between the steps and full capture (saves to the database) with each transition.
Can someone please give me a clear implementation of something similar to this? I would LOVE an example app that includes a multi-step signup process where I can look at the code (FULL source code--models AND controllers and views) under the hood, but I've been unable to find anything like that.
Any guidance would be appreciated!
EDIT: Please help make this a Railscast! Ryan B. (a.k.a. Superman), if you're reading this, we need you! http://feedback.railscasts.com/forums/77-episode-suggestions/suggestions/35553-multi-step-forms-and-wizards
I'm trying to get the users current latitude and longitude with this viewDidLoad method. The resulting map is correctly indicating the current location however the NSLog consistently shows:
2009-09-19 16:45:29.765 Mapper[671:207] user latitude = 0.000000
2009-09-19 16:45:29.772 Mapper[671:207] user longitude = 0.000000
Anyone know what I am missing here? Thanks in advance for your help!
- (void)viewDidLoad {
[super viewDidLoad];
[mapView setMapType:MKMapTypeStandard];
[mapView setZoomEnabled:YES];
[mapView setScrollEnabled:YES];
[mapView setShowsUserLocation:YES];
CLLocation *userLoc = mapView.userLocation.location;
CLLocationCoordinate2D userCoordinate = userLoc.coordinate;
NSLog(@"user latitude = %f",userCoordinate.latitude);
NSLog(@"user longitude = %f",userCoordinate.longitude);
}
What are the differences between Membership.GetUser() and Context.User, and which is recommended for use in getting information about the current user?
we were working on our sandbox trying to get the facebook like button set up for our site. Like an idiot, I set our sandbox URL as the domain. Here's the question: is there any going back once I've done this? I tried to reset the domain but it doesn't seem to have taken.
And, here's a related question: if i just go and make a like button (iFrame version) it spits out an app_id as part of the code. If that app_id isn't hooked up to an actual application w/domain, will it work after we move it to our QA server and then on to production? Or will it, once we've tested on our sandbox, establish the sandbox as it's domain and then we're back where we started?
We can't change code once it moves on to QA, it's just bad form...so what do I do?
I'm working on heavily dynamic and configurable CMS system. Therefore, many pages are composed of a dynamically loaded set of user controls. To enable loose coupling between containers (pages) and children (user controls), all user controls are responsible for their own persistence. Each User Control is wired up to its data/service layer dependencies via IoC. They also implement an IPersistable interface, which allows the container .aspx page to issue a Save command to its children without knowledge of the number or exact nature of these user controls.
Note: what follows is only pseudo-code:
public class MyUserControl : IPersistable, IValidatable
{
public void Save()
{
throw new NotImplementedException();
}
public bool IsValid()
{
throw new NotImplementedException();
}
}
public partial class MyPage
{
public void btnSave_Click(object sender, EventArgs e)
{
foreach (IValidatable control in Controls)
{
if (!control.IsValid)
{
throw new Exception("error");
}
}
foreach (IPersistable control in Controls)
{
if (!control.Save)
{
throw new Exception("error");
}
}
}
}
I'm thinking of using declarative transactions from the System.EnterpriseService namespace to wrap the btnSave_Click in a transaction in case of an exception, but I'm not sure how this might be achieved or any pitfalls to such an approach.
Hi,
My friend's website was working fine until he moved the document root from /var/www/xxx to /home/user/xxx
Apache give 13 permission denied error messages when we try to access the site via a web browser.
The site is configured as a virtual directory. All the Apache configurations were unchanged (except for the directory change).
We tried to chmod 777 /home/user/xxx, chown apache /home/user/xxx. But they didn't work.
Is there some kind of security feature set on the user's home directories? The server OS is CentOS (Godaddy VPS).
Any help is appreciated!
Thanks!
I can easly upload video file to the server with SaveAs method. But when i wanted to convert video file to .flv file i can't see any output file in the folder that i expected to find.
Actually i did it in my VS.NET 2008 IDE but after i published the files to the server, when i wrote the url of that internet site i couldn't see the files(in the remote machine i can see exported file and its converted file by calling http://localhost/FileUpload.aspx )
I just spent 2 hours trying to figure out why django celery stopped working.
Celery would being to start, but would stop short of printing out the configuration items, implying that it wasn't starting correct. The log would only contain
The celery.decorators module along with the magic keyword arguments,
are deprecated, and will be removed in version 3.0.
Please use the celery.task module instead of celery.decorators,
and the task.request should be used instead of the magic keyword arguments:
from celery.task import task
See http://bit.ly/celery22major for more information.
"""))
It turns out that some celery env variables that I was importing to try and fix a different problem were causing celery not to start correctly:
from celery.tests.config import CELERY_QUEUES, CELERY_DEFAULT_QUEUE, CELERY_DEFAULT_ROUTING_KEY
Even though I wasn't using them anywhere.
Does anyone know what was happening?
i try to show notification as a pop up. like when admin login and through his account he send notification to user i add this html in admin form like this..
<asp:Button ID="notic" runat="server" Text="Send" onclick="Button1_Click" /> <br />
<input class="add_message" type="text" value="type your message"
name="add_message"></input>
<input type="button" value="add message"
onclick="sNotify.addToQueue($('.add_message').attr('value'))"/>
Then when admin click on button then notification send to users account like when any user login then he/she able to see pop ups in user form
I call this java script in page load like this ..
ClientScript.RegisterStartupScript(GetType(), "Javascript",
"javascript:sNotify.addToQueue($('.add_message').attr('value'))();", true);
it works like when i login as a admin and click on button then notification in his own page ..
but i want to show this notifications in user form.
so how to solve it?
Hi,
I have tried to work this regex to set up a goal in GA for 2 days, but I cannot get my head around it...
The url format is like this:
/purchase.php?cDd=1&transaction_id=xxxxxxx&verify=xxxxxxxxxxxxxxxx=&method=creditcard&type=purchase
transaction_id= is populated with a sept of numbers
verify= is populated by a string of numbers, letters in both caps and lower case
Basically I would like to only match URLs which finish by "&method=creditcard&type=purchase"
I have tried to just put &method=creditcard&type=purchase but it does retrieve other URLs too
Would anyone has any ideas
Hi All,
I have created a user control (from System.Web.UI.UserControl), and created my own validator for the user control (from System.Web.UI.WebControls.BaseValidator). Everything works ok until I try to get the user control to do client side validation.
While trying to debug this issue I have set 'Control to Validate' to a text box instead of the custom user control, and the client side script works fine! It appears to me that it has an a issue with my composite user control I have created. Has anyone encountered this issue before? Has anyone else seen client side validation fail on custom user controls?
Some extra info :
The composite control is a drop down list and 'loader image', as it is a ajax enabled drop down list (using ICallbackEventHandler). I know that the client side javascript is being written to the page, and have placed an alert('random message') as the first line in the validator function that only appears if it is validating a text box (i.e. not when it is validating my custom control)
Language : C# (ASP.NET 2.0) and jQuery 1.2.6
in aspx file :
<rms:UserDDL ID="ddlUserTypes" runat="server" PreLoad="true" />
<rms:DDLValidator
ID="userTypesVal"
ControlToValidate="ddlUserTypes"
ErrorMessage="You have not selected a UserType"
runat="server"
Text="You have not selected a UserType"
Display="Dynamic"
EnableClientScript="true" />
in validator code behind
protected string ScriptBlock
{
get
{
string nl = System.Environment.NewLine;
return
"<script type=\"text/javascript\">" + nl +
" function " + ScriptBlockFunctionName + "(ctrl)" + nl +
" {" + nl +
" alert('Random message'); " + nl +
" var selVal = $('#' + ctrl.controltovalidate).val(); " + nl +
" alert(selVal);" + nl +
" if (selVal === '-1') return false; " + nl +
" return false; " + nl +
" }" + nl +
"</script>";
}
}
protected override void OnPreRender(EventArgs e)
{
if (this.DetermineRenderUplevel() && this.EnableClientScript)
{
Page.ClientScript.RegisterExpandoAttribute(this.ClientID, "evaluationfunction", this.ScriptBlockFunctionName);
Page.ClientScript.RegisterClientScriptBlock(GetType(), this.ScriptBlockKey, this.ScriptBlock);
}
base.OnPreRender(e);
}
I know my ControlPropertiesValid() and EvaluateIsValid() work ok.
I appreciate any help on this issue.
Noel.
I created a User defined table type named tvp_Shipment with two columns (id and name) . generated a snapshot and the User defined table type was properly propogated to all the subscribers.
I was using this tvp in a stored procedure and everything worked fine.
Then I wanted to add one more column created_date to this table valued parameter.I dropped the stored procedure (from replication too) and also i dropped and recreated the User defined table type with 3 columns and then recreated the stored procedure and enabled it for publication
When i generate a new snapshot, the changes in user defined table type are not propogated to the subscriber. The newly added column was not added to the subscription.
the Error messages:
The schema script 'usp_InsertAirSa95c0e23_218.sch' could not be propagated to the subscriber. (Source: MSSQL_REPL, Error number: MSSQL_REPL-2147201001)
Get help: http://help/MSSQL_REPL-2147201001
Invalid column name 'created_date'. (Source: MSSQLServer, Error number: 207)
Get help: http://help/207
I'm working on heavily dynamic and configurable CMS system. Therefore, many pages are composed of a dynamically loaded set of user controls. To enable loose coupling between containers (pages) and children (user controls), all user controls are responsible for their own persistence. Each User Control is wired up to its data/service layer dependencies via IoC. They also implement an IPersistable interface, which allows the container .aspx page to issue a Save command to its children without knowledge of the number or exact nature of these user controls.
Note: what follows is only pseudo-code:
public class MyUserControl : IPersistable, IValidatable
{
public void Save()
{
throw new NotImplementedException();
}
public bool IsValid()
{
throw new NotImplementedException();
}
}
public partial class MyPage
{
public void btnSave_Click(object sender, EventArgs e)
{
foreach (IValidatable control in Controls)
{
if (!control.IsValid)
{
throw new Exception("error");
}
}
foreach (IPersistable control in Controls)
{
if (!control.Save)
{
throw new Exception("error");
}
}
}
}
I'm thinking of using declarative transactions from the System.EnterpriseService namespace to wrap the btnSave_Click in a transaction in case of an exception, but I'm not sure how this might be achieved or any pitfalls to such an approach.