code OK for large number of hits?

#11

On Mon, 05 May 2008 10:25:06 +0200, Matthias Watermann <lists (AT) mwat (DOT) de>
wrote:

Quote:

On Mon, 05 May 2008 07:16:35 +0100, Geoff Cox wrote:

[...]
where the user is typing a number into a box

var number_check = number_given;
if ( (number_check >7) || (number_check < 1) ) { alert("The number must
be in the range 1 to 7!"); } else
if (isNaN(number_check)) {
alert("Please enter a valid number"); } else {
sendGroup1Lab1(number_check);
}

You must _never_ rely on client-side validation! As far as the
server-side script is concerned you should at least assume the user
switched JavaScript off (not to mention intended malformed values).

I have changed (***) the php to

$result1 = $_GET['answer1'];
$result2 = $_GET['answer2'];
$result3 = $_GET['answer3'];
$result4 = $_GET['answer4'];

If those values are supposed to be numbers you should at least
ensure that:

$result1 = $_GET['answer1'] * 1;
$result2 = $_GET['answer2'] * 1;
$result3 = $_GET['answer3'] * 1;
$result4 = $_GET['answer4'] * 1;

Quote:

(There's no need for those "$result" variables: Why keep the same value
in memory multiple times?) Do _not_ assume all the expected CGI
arguments are there actually but always check that.

Matthias,

I'm not clear what you mean above re the "no need for those "$result"
variables" - could you please explain?

Cheers

Geoff

Quote:

[...]
$result4 = mysql_real_escape_string($_GET['favorite']); ***

What's "favorite" supposed to be? A string? A number (real or integer)?
How do you validate that?

mysql_query("INSERT INTO mytable (answer1,answer2,answer3,answer4)
VALUES ('$result1','$result2','$result3','$result4')");

The single quote are needed for string values, while those "$resultX"
variables are integers. Hence you could omit the single quotes.

I see that mysql_real_escape_string can only be used after connecting
to the database?

Yes. However, id you'd validate the user provided values there's not
much need for such a call anyway. And escaping possibly malicious
values might avoid some SQL injection problem but it does _not_ avoid
your tables being filled with useless data.

Is the above safer?

Further improvement could be gained by not using the tables directly
but calling an stored procedure which could implement additional
validation. But that's another topic and probably oversized for
your application.

However, you should switch from HTTP/GET to HTTP/POST. While that's
not a safety net as such at least it makes it a _little_ harder to
fake the CGI arguments.

#12

On Mon, 05 May 2008 12:51:09 +0200, Geoff Cox <gcox (AT) freeuk (DOT) notcom> wrote:

Quote:

If those values are supposed to be numbers you should at least
ensure that:

$result1 = $_GET['answer1'] * 1;
$result2 = $_GET['answer2'] * 1;
$result3 = $_GET['answer3'] * 1;
$result4 = $_GET['answer4'] * 1;

(There's no need for those "$result" variables: Why keep the same value
in memory multiple times?) Do _not_ assume all the expected CGI
arguments are there actually but always check that.

Matthias,

I'm not clear what you mean above re the "no need for those "$result"
variables" - could you please explain?

It's more of a discussion for comp.lang.php.

However, I do NOT agree that those $result variables are unneeded: it's a
Good Practise to leave the GET/POST/COOKIE/ARG superglobals arrays as
read-only. Who knows what other code would do next? And one could want to
log illegal values later on for instance. As soon as one wants to alter
it, use a 'normal' variable. Certainly with the limited GET array, memory
will seldomly be the problem.

Nothing to do with MySQL anymore, f'up comp.lang.php
--
Rik Wasmus

#13

On Mon, 05 May 2008 11:51:09 +0100, Geoff Cox wrote:

Quote:

[...]
(There's no need for those "$result" variables: Why keep the same value
in memory multiple times?) Do _not_ assume all the expected CGI
arguments are there actually but always check that.

Matthias,

I'm not clear what you mean above re the "no need for those "$result"
variables" - could you please explain?

As I've shown in my validation examples you can "clean" the CGI arguments
directly in the global "$_GET" list. I consider it a waste of memory to
duplicate those values. But just was just a hint. The other points were
more important.

--
Matthias
/"\
\ / ASCII RIBBON CAMPAIGN - AGAINST HTML MAIL
X - AGAINST Microsoft ATTACHMENTS
/ \

#14

Matthias Watermann wrote:

Quote:

On Mon, 05 May 2008 11:51:09 +0100, Geoff Cox wrote:

[...]
(There's no need for those "$result" variables: Why keep the same value
in memory multiple times?) Do _not_ assume all the expected CGI
arguments are there actually but always check that.
Matthias,

I'm not clear what you mean above re the "no need for those "$result"
variables" - could you please explain?

As I've shown in my validation examples you can "clean" the CGI arguments
directly in the global "$_GET" list. I consider it a waste of memory to
duplicate those values. But just was just a hint. The other points were
more important.

You can. But I agree with Rik. It is better to consider the $_GET and
$_POST values to be read-only.

Which is more important - maintainability and serviceability of the
application, or 50 bytes of memory?

But this is also a PHP question, not a MySQL one.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex (AT) attglobal (DOT) net
==================

#15

On Mon, 05 May 2008 10:25:06 +0200, Matthias Watermann wrote:

Quote:

$hits = array();

As a completely juvenile aside, variable names like this make me giggle.

--
3. My noble half-brother whose throne I usurped will be killed, not kept
anonymously imprisoned in a forgotten cell of my dungeon.
--Peter Anspach's list of things to do as an Evil Overlord

#16

On Mon, 05 May 2008 10:22:55 -0500, Peter H. Coffin wrote:

Quote:

[...]
$hits = array();

As a completely juvenile aside, variable names like this make me giggle.

You're welcome! Laughing improves your health, or so I hear :-)

--
Matthias
/"\
\ / ASCII RIBBON CAMPAIGN - AGAINST HTML MAIL
X - AGAINST Microsoft ATTACHMENTS
/ \

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

code OK for large number of hits?

comp.databases.mysql comp.databases.mysql

Re: code OK for large number of hits? - 05-05-2008 , 05:51 AM

Re: code OK for large number of hits? - 05-05-2008 , 05:57 AM

Re: code OK for large number of hits? - 05-05-2008 , 07:53 AM

Re: code OK for large number of hits? - 05-05-2008 , 08:59 AM

Re: code OK for large number of hits? - 05-05-2008 , 10:22 AM

Re: code OK for large number of hits? - 05-05-2008 , 10:39 AM