OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: php-general-digest-helplists.php.net
Date: Sun Jul 07 2002 - 12:43:59 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    php-general Digest 7 Jul 2002 17:43:59 -0000 Issue 1450

    Topics (messages 105924 through 105964):

    Re: Having more problems
            105924 by: Alberto Serra

    Linked drop down selection lists and dynamically generated links
            105925 by: Peter Goggin
            105928 by: Alberto Serra
            105929 by: C╗╕sar Aracena
            105935 by: Naintara Jain
            105936 by: Alberto Serra
            105963 by: Pekka Saarinen

    Mailing all the elements of a form
            105926 by: Jeremy Bowen
            105930 by: B.C. Lance
            105932 by: C╗╕sar Aracena
            105934 by: Alberto Serra
            105961 by: Justin French

    Re: Thanks -> Actually POSTING without javascript
            105927 by: B.C. Lance
            105931 by: Alberto Serra

    preg_match or not?
            105933 by: Steve Fitzgerald
            105937 by: CC Zona
            105938 by: Steve Fitzgerald

    Authorization
            105939 by: Chris Schoeman
            105962 by: Justin French

    Problem with SQL query
            105940 by: JJ Harrison
            105941 by: Alberto Serra
            105942 by: Alberto Serra
            105951 by: JJ Harrison
            105953 by: JJ Harrison
            105954 by: JJ Harrison

    Splitting up a timestamp?
            105943 by: Tony Harrison
            105944 by: Alberto Serra

    inserting linebrakes in multisite forms
            105945 by: andy
            105948 by: Alberto Serra
            105959 by: andy

    transporting variable via post to another site
            105946 by: andy
            105950 by: Alberto Serra
            105958 by: andy
            105960 by: Alberto Serra

    About submitting multipart.forms
            105947 by: MG Lim
            105949 by: Alberto Serra

    Re: suppressing errors with ""
            105952 by: Peter

    Plz help w/ global variables
            105955 by: Anthony Rodriguez

    Re: Survey: MySQL vs PostgreSQL for PHP
            105956 by: Pete James

    Re: Help needed with hexdec();
            105957 by: Jonathan Rosenberg

    Re: HTTPS vs. HTTP ?
            105964 by: Miguel Cruz

    Administrivia:

    To subscribe to the digest, e-mail:
            php-general-digest-subscribelists.php.net

    To unsubscribe from the digest, e-mail:
            php-general-digest-unsubscribelists.php.net

    To post to the list, e-mail:
            php-generallists.php.net

    ----------------------------------------------------------------------

    attached mail follows:


    Привет!

    Shiloh Madsen wrote:
    >

    > $LoginDB=mysql_connect($dbhost, $dbuser, $dbpass);
    > if (! $LoginDB) {
    > print "<p>Unable to connect to the database server at this time.</p>";
    > exit();
    > } else {

    This can be just:

    $LoginDB=mysql_connect($dbhost, $dbuser, $dbpass) or die('<p>Unable to
    connect to the database server at this time.</p>')

    > <?php
    > }
    > ?>

    Sorry, what exactly are you trying to do here?

    As for a general advice:
       1) use libraries. Make yourself a public dibconnect funcion. Chances
          are your user/password will differ depending on where the code gets
          executed (production or development) You don't want to go thru
          hundreds of scripts the recode that, right?
       2) Look for a very old PD class called FastTemplate. I know people
          will object that it adds to general execution and lowers
          performance, but that will allow you to keep your HTML code
          well separated by your scripting. And it does help, especially
          when you are not sure about what you are doing.

    пока
    Альберто
    Киев

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    I have two related tables. The first has about 12 records, each of which is related to about 12 records in the second table. I want to have two interconnectedt dropdown list fields. The fisrt is used to select from the first table and when the value has been selected, use it to determine the contents of the second drop down list. Once the second field has been selected I want to use this data to otain the name of the form to be used to display data selected using the two fields.

    Obviously I can do this by having interrelated pages where the value from the first fields is carried to the second page and used to populate the second drop down list. I can then presumably dynamically generate the link to the required page and pass over what paraeters are needed.

    Is there any way of doing this so within a single page?

    Can this be done using only PHP or do I need to use Javascripts? Where would I be able to find examples of code which does this sort of processing?

    Any adivice would be gratefully received. Regards

    Peter Goggin

    Regards

    Peter Goggin

    attached mail follows:


    Привет!

    Peter Goggin wrote: > Can this be done using only PHP or do I need to use Javascripts?

    managing this in PHP should be considered *only* when jscript is not available. It's a matter of load distribution.

    When doing client server applications (like the web is) you shall always remember that any interaction about the two entities adds up time to the result. Which, incidentally, is the point in using Stored Procedures (when they are properly coded and the db engine is capable of supporting them) instead of making tons of single SQL calls from a single PHP script.

    Now, if all of your data is already on the client (somehow stoked in jscript variables) your user interaction will be quick and easy. If you call PHP any time you will get a serious delay (because you do issue a request along the net, then the server processes it and sends it back to your browser, that again processes it and shows it). So this should be considered an emergency solution only.

    A 100% robust solution should contain both, and call PHP only if jscript is not available on the client. But this is costly and requires the two procedures to be realigned everytime you have some change going on. Most applications can just use javascript and forget about it.

    пока Альберто Киев

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    As Alberto says, PHP has to be used to do such thing ONLY when Java is not acceptable. There are many JavaScript snippets out there that do such things. Most of them are called *DOUBLE COMBO* but as I recently found out in this list, and from a similar question I had, is NOT so simple for PHP to figure out what was chosen in the second choice. Try to read post made the last month and you'll get the answer to all this.

    C.

    > -----Original Message----- > From: Alberto Serra [mailto:albertoserragala.net] > Sent: Sunday, July 07, 2002 2:44 AM > Cc: php-generallists.php.net > Subject: Re: [PHP] Linked drop down selection lists and dynamically > generated links > > ╖╠╖Б╖з╖с╖ж╖Д! > > Peter Goggin wrote: > > Can this be done using only PHP or do I need to use Javascripts? > > managing this in PHP should be considered *only* when jscript is not > available. It's a matter of load distribution. > > When doing client server applications (like the web is) you shall always > remember that any interaction about the two entities adds up time to the > result. Which, incidentally, is the point in using Stored Procedures > (when they are properly coded and the db engine is capable of supporting > them) instead of making tons of single SQL calls from a single PHP script. > > Now, if all of your data is already on the client (somehow stoked in > jscript variables) your user interaction will be quick and easy. If you > call PHP any time you will get a serious delay (because you do issue a > request along the net, then the server processes it and sends it back to > your browser, that again processes it and shows it). So this should be > considered an emergency solution only. > > A 100% robust solution should contain both, and call PHP only if jscript > is not available on the client. But this is costly and requires the two > procedures to be realigned everytime you have some change going on. Most > applications can just use javascript and forget about it. > > ╖А╖Ю╖э╖я > ╖║╖щ╖Н╖р╖ж╖Б╖Д╖Ю > ╖╛╖з╖ж╖с > > > -- > > > -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_- > > LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? > lOrD i'M sHiNiNg... > YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is....... > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php

    attached mail follows:


    You can use both JavaScript and PHP. Initially use PHP to get your data, you can use 13 arrays to store this data. 1st array stores the options for the 1st list. The other 12 arrays can store options related to each item of the 1st list/array.

    Use JavaScript (client-side scripting, faster) to populate the 2nd list based on the selection in the 1st list. This way you do not run PHP (server-side scripting, slower) more than once on the same page.

    this is of course, keeping in mind, that your backend (database data) is not changing every few seconds. If you are dealing with dynamic data, such that the list options might be changing at every moment then you would need the latest database data and PHP would need to be used after the selection in the 1st list.

    -Naintara

    -----Original Message----- From: php-general-return-105925-naintara=del6.vsnl.net.inlists.php.net [mailto:php-general-return-105925-naintara=del6.vsnl.net.inlists.php.ne t]On Behalf Of Peter Goggin Sent: Saturday, July 06, 2002 10:31 PM To: php-generallists.php.net Subject: [PHP] Linked drop down selection lists and dynamically generated links

    I have two related tables. The first has about 12 records, each of which is related to about 12 records in the second table. I want to have two interconnectedt dropdown list fields. The fisrt is used to select from the first table and when the value has been selected, use it to determine the contents of the second drop down list. Once the second field has been selected I want to use this data to otain the name of the form to be used to display data selected using the two fields.

    Obviously I can do this by having interrelated pages where the value from the first fields is carried to the second page and used to populate the second drop down list. I can then presumably dynamically generate the link to the required page and pass over what paraeters are needed.

    Is there any way of doing this so within a single page?

    Can this be done using only PHP or do I need to use Javascripts? Where would I be able to find examples of code which does this sort of processing?

    Any adivice would be gratefully received. Regards

    Peter Goggin

    Regards

    Peter Goggin

    --
    PHP General Mailing List (http://www.php.net/)
    To unsubscribe, visit: http://www.php.net/unsub.php
    

    attached mail follows:


    Naintara Jain wrote: > this is of course, keeping in mind, that your backend (database data) is not > changing every few seconds. If you are dealing with dynamic data, such that > the list options might be changing at every moment then you would need the > latest database data and PHP would need to be used after the selection in > the 1st list.

    Привет!

    True! If you have dynamic stuff you might consider having an invisible entity on your page that gets refreshed at constant intervals with a server call and contains a flag result. Any time the flag is set user-interaction will fire the PHP refresh, while you will still be using javascript when possible.

    This will save you a lot of user complaints. People hate to wait for a second. It's maaad world :)

    This road leaves a potential inconsistency problem that you shall solve on the final PHP call: user might send in the data before the flag is set. In that case you shall refresh the data and ask the user to repeat input. It's called an "optimistic strategy" :)

    Actually, whether you can use it or not depends on the update frequency of your dynamic data. Plus some tailoring on the intervals (you don't want to kill your server by sending it millions of "check-the-content" requests). Decision is based on the number of users and the update frequency.

    пока Альберто

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    At 7/7/2002, you wrote: >Is there any way of doing this so within a single page? > >Can this be done using only PHP or do I need to use Javascripts? >Where would I be able to find examples of code which does this sort of >processing?

    Hi,

    I would do it in PHP, because you can never ever rely on Javascript (is it on? what version? what browser?). Javascript is good for additional UI smoothing, but should never be a requirement (nor should cookies be).

    Here's a simple quick code (partial) how I'd do it on one php page:

    http://photography-on-the.net/php/3_choice_select.php

    Use the resulting ID's to query the full data of the "product" found.

    There is source code and db dump link in the bottom of that page. The database is very normalized.

    I did and debugged this in couple of hours (I know, I'm slow), and this needs _plenty_ of more code like clearing choices from "product" and "version" when "platform" is changed, and checking valid "platform" id etc... this is just a core which gives you id's for additional queries.

    If you improve this please share the code!

    Hope this helps,

    Pekka http://photography-on-the.net

    attached mail follows:


    Hey,

    I have looked in PHP manual but I cannot seem to find what I am looking for.

    I have a very large form that I need to be able to mail. I just don't want to have to code all of the field into my mail() function.

    Thanks,

    Jeremy

    attached mail follows:


    you could loop through $_POST (assuming you are using a post action) to extract the value out.

    e.g.

    $arr = array_keys($_POST); for ($i = 0; $i < count($arr); $i++) { $msg.= "{$arr[$i]}: {$_POST[$arr[$i]]}\r\n"; } echo $msg;

    b.c. lance

    Jeremy Bowen wrote: > Hey, > > I have looked in PHP manual but I cannot seem to find what I am looking for. > > I have a very large form that I need to be able to mail. I just don't want > to have to code all of the field into my mail() function. > > Thanks, > > Jeremy >

    attached mail follows:


    I suppose this is not the answer you are looking for, but it's the only one a newbie like me knows. Try to build a $body variable and pass it to the mail() function. Try this:

    $from = $sender_field;

    $subject = $subject_field;

    $body = $form_field1; $body .= $form_field2; $body .= $form_field3; $body .= $form_field4; $body .= $form_field5; $body .= $form_field6;

    $headers = // extra headers IF any

    and then do mail($from, $subject, $body, $headers);

    You could do a very much smaller script simply by creating an array of the form objects. Just name them like this:

    <input type="text" name="form_field[]">

    After the information is passed to PHP, just make a loop which will make an array of the form fields that are NOT null.

    Hope this helps,

    C.

    > -----Original Message----- > From: Jeremy Bowen [mailto:ocaruleswebnationinc.com] > Sent: Sunday, July 07, 2002 2:28 AM > To: php-generallists.php.net > Subject: [PHP] Mailing all the elements of a form > > Hey, > > I have looked in PHP manual but I cannot seem to find what I am looking > for. > > I have a very large form that I need to be able to mail. I just don't want > to have to code all of the field into my mail() function. > > Thanks, > > Jeremy > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php

    attached mail follows:


    Jeremy Bowen wrote: > Hey, > > I have looked in PHP manual but I cannot seem to find what I am looking for. > > I have a very large form that I need to be able to mail. I just don't want > to have to code all of the field into my mail() function. > > Thanks, > > Jeremy > >

    Привет!

    *IF* the form is only to be mailed, and no other action shall be taken on the data it contains, you can use CGI processing instead of calling PHP. Can't remember the name of the call now, but there is something like that on every site.

    *IF* you also want to process data *AND* mail it, you will have to to build the $body mail function or do some tricky things to have a second copy of your form built in a self-closing entity (DHTML can do that) which will perform the CGI action while your PHP script takes care of processing the original form.

    Usually is much quicker to code the mail body. It depends on the context you are in.

    пока Альберто

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    If you just want ALL the fields of the form the appear one after the other (with something \n after each), then you could just loop through the POST vars (assuming you used <form action="blah.php" method="post">), which would be either in the $_POST array or the $HTTP_POST_VARS array.

    something like:

    <? // untested code

    $msg = "Type email header here\n\n";

    foreach($_POST as $key => $value) { $msg .= "{$key}: {$value}\n"; }

    $msg .= "\nEmail footer here";

    mail($to, $subject, $msg, $headers);

    ?>

    Assuming you had the usual $first_name / $last_name / $email_address / $password kinda form, this would result in an email something like:

    ---
    Type email header here
    

    first_name: Justin last_name: French email_address: justinindent.com.au password: foofoo

    Email footer here ---

    Warning:

    1. this leaves you wide open to evil people submitting evil things via the form... I'd look at strip_tags(), trimming longer than expected strings, etc.

    2. this doesn't give you much in the way of formatting options, or breaking the vars into sections

    For a totally secure form, with trusted data, I'd be coding the message body by hand checking to make sure that the values submitted were not suspicious, and were as expected.

    However, for a quick-and-nasty form, or for an intranet where you trust the submitters (eg your own staff perhaps), this *might* be sufficient.

    Justin French

    Jeremy Bowen wrote: > Hey, > > I have looked in PHP manual but I cannot seem to find what I am looking for. > > I have a very large form that I need to be able to mail. I just don't want > to have to code all of the field into my mail() function. > > Thanks, > > Jeremy

    attached mail follows:


    yes. now its clearer. hm... but i can't think of submitted the information if javascript is off on the client browser. unless you stick in a button telling the user to hit it if the page do not bring him to another after a specific timing. a button probably don't look presentable. use an image as the input type. that will probably brighten up the page.

    in short, what i mean is let the user do the submit if javascript fails.

    an image of brintney spear and a text on it telling the user to click on sounds appealing to you? ;)

    b.c. lance

    Alberto Serra wrote: > Привет! > > *The problem was here*. What if this second step fails? easy, I just > leave the META as is and stock previous data on a session during the > first execution of index.php > > At this point index.php knows all it needs to fill in cionfiguration > data and it just includes the real home page. From now on we will be > able to tailor channelling (that is, cookies or not, jscript or not) > without reasonable doubts. Yes, the user *may* change it's configuration > during the session, but this is very low percentage of cases and we can > live with it. > > Well, that's the most general part of it. But at least it's clearer. > > пока > Альберто > Киев > > >

    attached mail follows:


    Привет!

    > an image of brintney spear and a text on it telling the user to click on > sounds appealing to you? ;)

    LOLOL yes, something like that :) when the second execution fails (that is, the refresh META sends back no data on the POST channel) we show the user a form with the local logo, where he just says what the dimensions of his screen are and we assume that javascript is not present within the sesion :)) The problem was just in not losing the referer and the passed link while doing all this snake-like contorsions :)

    пока Альберто Киев

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    I have been struggling for a couple of hours now trying to write a preg_match expression to validate a dollar amount - the user may or may not put in the decimals so I want to allow only digits plus a possible period followed by two more digits. My eyes are now swimming and I just can't seem to get right. This is what I have at the moment:

    if (!preg_match("/[\d]+([\.]{1}[\d]{2})?/", $form_data[amount])) // wrong amount

    but it still allows invalid input. Can anyone help or is there a better way to do it?

    Thanks Steve

    attached mail follows:


    In article <3D27DB2F.B09F4102netscape.net>, oneeightonenetscape.net (Steve Fitzgerald) wrote:

    > I have been struggling for a couple of hours now trying to write a > preg_match expression to validate a dollar amount - the user may or may > not put in the decimals so I want to allow only digits plus a possible > period followed by two more digits. My eyes are now swimming and I just > can't seem to get right. This is what I have at the moment: > > if (!preg_match("/[\d]+([\.]{1}[\d]{2})?/", $form_data[amount])) // > wrong amount > > but it still allows invalid input. Can anyone help or is there a better > way to do it?

    It sounds like you need an exact match; note that your regex is matching against substrings, thus additional invalid characters are allowed to pass. Anchor the pattern, so that it essentially says "From beginning to end, the only chars allowed are one or more digits, optionally followed by the combination of a period then two more digits." (The "^" and "$" special chars are anchors.)

    A regex special character loses it "specialness" when it's either escaped with a backslash, or included within a square-bracketed character class; you don't need to do both.

    The {1} is implied; you don't need it.

    if (preg_match("/^\d+(\.\d{2})?$/", $form_data[amount])) {echo "Validated!";} else {exit("That's not a dollar amount.");}

    -- 
    CC
    

    attached mail follows:


    Thanks, thats hit the nail on the head, and my headache is a whole lot better! Steve

    Cc Zona wrote:

    > In article <3D27DB2F.B09F4102netscape.net>, > oneeightonenetscape.net (Steve Fitzgerald) wrote: > > > I have been struggling for a couple of hours now trying to write a > > preg_match expression to validate a dollar amount - the user may or may > > not put in the decimals so I want to allow only digits plus a possible > > period followed by two more digits. My eyes are now swimming and I just > > can't seem to get right. This is what I have at the moment: > > > > if (!preg_match("/[\d]+([\.]{1}[\d]{2})?/", $form_data[amount])) // > > wrong amount > > > > but it still allows invalid input. Can anyone help or is there a better > > way to do it? > > It sounds like you need an exact match; note that your regex is matching > against substrings, thus additional invalid characters are allowed to pass. > Anchor the pattern, so that it essentially says "From beginning to end, the > only chars allowed are one or more digits, optionally followed by the > combination of a period then two more digits." (The "^" and "$" special > chars are anchors.) > > A regex special character loses it "specialness" when it's either escaped > with a backslash, or included within a square-bracketed character class; > you don't need to do both. > > The {1} is implied; you don't need it. > > if (preg_match("/^\d+(\.\d{2})?$/", $form_data[amount])) > {echo "Validated!";} > else > {exit("That's not a dollar amount.");} > > -- > CC

    attached mail follows:


    I am using the folowing script for authorization:

    $username = "test"; $password = "123";

    function authenticate() { Header( "WWW-authenticate: basic realm=\"Protected\""); Header( "HTTP/1.0 401 Unauthorized"); echo "Gebruikersnaam en/of wachtwoord is niet goed ingevuld!\n"; exit; }

    function CheckPwd($user,$pass) { global $username,$password; return ($user != $username || $pass != $password) ? false : true; }

    if(!isset($PHP_AUTH_USER)) { authenticate(); } elseif(!CheckPwd($PHP_AUTH_USER,$PHP_AUTH_PW)) { authenticate(); }

    On my hosting provider this script works fine, om my own computer where I run a server it doesn't work. I run an Internet Information Server on my own computer.

    Anyone has an idea.

    Chris

    attached mail follows:


    You need to tell us what version of PHP you're running in both environments... this should have been your first step -- detrmining the difference between the two set-ups, basically using php_info().

    My guess is that you're running PHP > 4.2 on the local machine, which has a default setting of register_globals OFF in your php.ini file, which contradicts what your "live" server has it set to.

    The short answer is to turn register_globals ON, the long answer would be:

    1. read the release notes for the recent versions

    2. check out the millions of threads and messages in this lists' archives, mostly with the subject "register globals"

    3. read up on the new predefined variables such as $_POST, $_COOKIE, $_GET, $_SESSION, etc etc, and learn how to modify your scripts to run in this more secure manner: http://www.php.net/manual/en/language.variables.predefined.php

    Justin French

    on 07/07/02 6:19 PM, Chris Schoeman (c.schoemaneudoramail.com) wrote:

    > I am using the folowing script for authorization: > > $username = "test"; > $password = "123"; > > function authenticate() { > Header( "WWW-authenticate: basic realm=\"Protected\""); > Header( "HTTP/1.0 401 Unauthorized"); > echo "Gebruikersnaam en/of wachtwoord is niet goed ingevuld!\n"; > exit; > } > > function CheckPwd($user,$pass) { > global $username,$password; > return ($user != $username || $pass != $password) ? false : true; > } > > if(!isset($PHP_AUTH_USER)) { > authenticate(); > } > elseif(!CheckPwd($PHP_AUTH_USER,$PHP_AUTH_PW)) { > authenticate(); > } > > On my hosting provider this script works fine, om my own computer > where I > run a server it doesn't work. > I run an Internet Information Server on my own computer. > > Anyone has an idea. > > Chris

    attached mail follows:


    I can't figure out what is wrong with this:

    $query = "select count(*) as monthly_views from visitors group by extract('year', time), extract('month', time) order by monthly_view desc limit 1"; $result = mysql_query($query); echo $query; $row = mysql_fetch_array($result); echo $row['monthly_views']; echo mysql_error();

    I get this:

    select count(*) as monthly_views from visitors group by extract('year', time), extract('month', time) order by monthly_view desc limit 1 Warning: Supplied argument is not a valid MySQL result resource in C:\Inetpub\TecEco_PHP\stats_interface\summary.php on line 76 You have an error in your SQL syntax near ''year', time), extract('month', time) order by monthly_view desc limit 1' at line 1

    I don't know any advanced SQL so I don't know how to debug this.

    I am using mySQL. The person who gave me this code appeared to be using postgreSQL if that makes any differance

    --
    JJ Harrison
    webmastertececo.com
    www.tececo.com
    

    attached mail follows:


    Привет!

    > I can't figure out what is wrong with this: > > $query = "select count(*) as monthly_views from visitors group by > extract('year', time), extract('month', time) order by monthly_view desc > limit 1";

    AFAIK this is no ANSI SQL, which is why is not portable. Your query should really be

    SELECT extract('year', time), extract('month', time) count(*) as monthly_views FROM visitors group by extract('year', time), extract('month', time) order by monthly_view desc limit 1

    *BUT* extract doesn't seem to be a MYSQL function, you most probably need to use DATE_FORMAT. Look in the Mysql docs for this.

    As a general ANSI rule group by functions *need* the fields on which result is grouped to appear *first* in the query. Take half an hour to look at the GROUP BY docs in MySQL online manual, everything will become much clearer.

    пока Альберто Киев

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    Привет!

    I forgot to add:

    SELECT extract('year', time), extract('month', time), count(*) as monthly_views FROM visitors group by extract('year', time), extract('month', time) order by monthly_view desc limit 1

    I take it that you have a *monthly_view* column in your table that is not the *monthly_views* alias yoiu use in your query. if that's a typo and you mean to order by the numebr of visitors (that is, you want the most visited month on top of the result) your query should probably look like:

    SELECT extract('year', time), extract('month', time), count(*) as monthly_views FROM visitors group by extract('year', time), extract('month', time) order by 3 desc limit 1

    That's because most databases (and I guess MySql is no exception) will not be able to use an alias in their GROUP BY, ORDER BY clauses. But you may want to try, maybe MySql *is* an exception, after all.

    пока Альберто Киев

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    Thanks for giving me something to look up :)

    --
    JJ Harrison
    webmastertececo.com
    www.tececo.com
    

    "Alberto Serra" <albertoserragala.net> wrote in message news:3D28105B.8090309gala.net... > Привет! > > I forgot to add: > > SELECT > extract('year', time), > extract('month', time), > count(*) as monthly_views > FROM > visitors > group by > extract('year', time), > extract('month', time) > order by > monthly_view desc > limit 1 > > I take it that you have a *monthly_view* column in your table that is > not the *monthly_views* alias yoiu use in your query. if that's a typo > and you mean to order by the numebr of visitors (that is, you want the > most visited month on top of the result) your query should probably look > like: > > SELECT > extract('year', time), > extract('month', time), > count(*) as monthly_views > FROM > visitors > group by > extract('year', time), > extract('month', time) > order by > 3 desc > limit 1 > > That's because most databases (and I guess MySql is no exception) will > not be able to use an alias in their GROUP BY, ORDER BY clauses. But you > may want to try, maybe MySql *is* an exception, after all. > > пока > Альберто > Киев > > > -- > > > -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_- > > LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? > lOrD i'M sHiNiNg... > YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is....... >

    attached mail follows:


    No matter what I try I still seem to get the error message.

    The coloumn that contains the dates has unix timestamps. I think this is why it is not working.

    I will research it further.

    If you can be of any help please tell me.

    --
    JJ Harrison
    webmastertececo.com
    www.tececo.com
    

    "Alberto Serra" <albertoserragala.net> wrote in message news:3D28105B.8090309gala.net... > Привет! > > I forgot to add: > > SELECT > extract('year', time), > extract('month', time), > count(*) as monthly_views > FROM > visitors > group by > extract('year', time), > extract('month', time) > order by > monthly_view desc > limit 1 > > I take it that you have a *monthly_view* column in your table that is > not the *monthly_views* alias yoiu use in your query. if that's a typo > and you mean to order by the numebr of visitors (that is, you want the > most visited month on top of the result) your query should probably look > like: > > SELECT > extract('year', time), > extract('month', time), > count(*) as monthly_views > FROM > visitors > group by > extract('year', time), > extract('month', time) > order by > 3 desc > limit 1 > > That's because most databases (and I guess MySql is no exception) will > not be able to use an alias in their GROUP BY, ORDER BY clauses. But you > may want to try, maybe MySql *is* an exception, after all. > > пока > Альберто > Киев > > > -- > > > -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_- > > LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? > lOrD i'M sHiNiNg... > YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is....... >

    attached mail follows:


    I have fixed it now don't worry!

    --
    JJ Harrison
    webmastertececo.com
    www.tececo.com
    

    "Alberto Serra" <albertoserragala.net> wrote in message news:3D28105B.8090309gala.net... > Привет! > > I forgot to add: > > SELECT > extract('year', time), > extract('month', time), > count(*) as monthly_views > FROM > visitors > group by > extract('year', time), > extract('month', time) > order by > monthly_view desc > limit 1 > > I take it that you have a *monthly_view* column in your table that is > not the *monthly_views* alias yoiu use in your query. if that's a typo > and you mean to order by the numebr of visitors (that is, you want the > most visited month on top of the result) your query should probably look > like: > > SELECT > extract('year', time), > extract('month', time), > count(*) as monthly_views > FROM > visitors > group by > extract('year', time), > extract('month', time) > order by > 3 desc > limit 1 > > That's because most databases (and I guess MySql is no exception) will > not be able to use an alias in their GROUP BY, ORDER BY clauses. But you > may want to try, maybe MySql *is* an exception, after all. > > пока > Альберто > Киев > > > -- > > > -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_- > > LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? > lOrD i'M sHiNiNg... > YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is....... >

    attached mail follows:


    Hi. I please need some help with converting a MySQL timestamp into something easily read. Any help at all is most appreciated, thanks.

    attached mail follows:


    Tony Harrison wrote: > Hi. I please need some help with converting a MySQL timestamp into something > easily read. Any help at all is most appreciated, thanks. >

    Привет!

    use DATE_FORMAT. (it's a MYSQL function, not a PHP one). Look for it in the online MySQL manual.

    пока Альберто Киев

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    He everybody,

    I am wondering how to insert the linebrakes into mulitsite forms.

    Example: One Form has a textfield, I submit it to another html site where there is another form with a textfield. Inside this textfield I place a hidden field with the value of the field from page 1 then I submit to the actual php site inserting the values into a db.

    at this point I do insert the linebrakes (nl2br) but only the field from page 2 is really stored with linebrakes the other one is not. How come?

    Has anybody a good idea or even know how to do this?

    attached mail follows:


    Привет!

    andy wrote: > One Form has a textfield, I submit it to another html site where there is > another form with a textfield. Inside this textfield I place a hidden field > with the value of the field from page 1 then I submit to the actual php site > inserting the values into a db.

    So, let's see if I got you right:

    Form 1: a textfield, you submit it to another page (no matter whether it is on the same host or not, this should not make any difference)

    Form 2 contains: 1) a hidden field with the value from form 1 2) another text field for new user input You submit form 2 and nl2br does not work on the values of the hidden field. Right?

    If that is so it's simply because once the value gets put in form2/field1 it has already lost the new lines. So you should run nl2br on it *before* it gets submitted the second time. Do it when you send the value to form2.

    пока Альберто Киев

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    Hi alberto,

    I did try this out, but somehow this happens:

    text br / br / text in new line

    br/ is exacly where the linebrakes should be, but instead it is typed on screen.

    Is there a solution for this?

    Andy

    "Alberto Serra" <albertoserragala.net> schrieb im Newsbeitrag news:3D28226C.6010307gala.net... > Привет! > > andy wrote: > > One Form has a textfield, I submit it to another html site where there is > > another form with a textfield. Inside this textfield I place a hidden field > > with the value of the field from page 1 then I submit to the actual php site > > inserting the values into a db. > > So, let's see if I got you right: > > Form 1: a textfield, you submit it to another page (no matter whether it > is on the same host or not, this should not make any difference) > > Form 2 contains: > 1) a hidden field with the value from form 1 > 2) another text field for new user input > You submit form 2 and nl2br does not work on the values of the hidden > field. Right? > > If that is so it's simply because once the value gets put in > form2/field1 it has already lost the new lines. > So you should run nl2br on it *before* it gets submitted the second > time. Do it when you send the value to form2. > > пока > Альберто > Киев > > > -- > > > -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_- > > LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? > lOrD i'M sHiNiNg... > YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is....... >

    attached mail follows:


    Hi there,

    I do have a multisite form. There are several fields on page 1 and several on page 2.

    Everything works fine exept of error handling. Which means if a user wants to go back from step 2 to one and has already filled in some data in site 2 he will loose this data for sure. It is not possible to transport the data via get anymor because the text is way to long.

    So how could this be done with post? I tryed to include a hidden text field, but since this must be another form (action links to page 1) I can't get the value of the entered data.

    Has anybody a good idea, or even experiance in this?

    Thanx,

    Andy

    attached mail follows:


    Привет!

    andy wrote: > Everything works fine exept of error handling. Which means if a user wants > to go back from step 2 to one and has already filled in some data in site 2 > he will loose this data for sure. It is not possible to transport the data > via get anymor because the text is way to long.

    Okay, this means Form 1 can be entered from two directions: 1) the usual sequence (that is, the way users usually get to it) 2) getting back from Form 2

    If you place a button on Form2 saying "go back to form 1" when your user presses it just post your current data back to the script of form1. *PLUS* you add a hidden field called *FLAGBACK* (or whatever you want to call it like.

    when the script that prepares form1 is called it must check for *FLAGBACK* being present. If not, it will do the same old stuff, if yes you just write a new branch that will put the data back into form 1. Easy.

    *BUT* all this will never protect your user in case he just presses *back* on his browser. Make sure this is well explained on the page.

    пока Альберто Киев

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    sorry maybe I did explain it not good enough.

    The problem is that if a user has entered data in form 2 goes back to form 1 and forward to form 2 again, the data he entered once in form 2 is lost. And I do not find a way how the get the data out of form 2 because the back button is placed in form 3 (same site as form2 ) to allow a different action since we have to link to another site then in form 2.

    sounds confusing? I know but I hope I explained it ok

    Andy

    ----- Original Message ----- From: "Alberto Serra" <albertoserragala.net> Newsgroups: php.general Cc: <php-generallists.php.net> Sent: Sunday, July 07, 2002 1:21 PM Subject: Re: [PHP] transporting variable via post to another site

    > Привет! > > andy wrote: > > Everything works fine exept of error handling. Which means if a user wants > > to go back from step 2 to one and has already filled in some data in site 2 > > he will loose this data for sure. It is not possible to transport the data > > via get anymor because the text is way to long. > > Okay, this means Form 1 can be entered from two directions: > 1) the usual sequence (that is, the way users usually get to it) > 2) getting back from Form 2 > > If you place a button on Form2 saying "go back to form 1" when your user > presses it just post your current data back to the script of form1. > *PLUS* you add a hidden field called *FLAGBACK* (or whatever you want to > call it like. > > when the script that prepares form1 is called it must check for > *FLAGBACK* being present. If not, it will do the same old stuff, if yes > you just write a new branch that will put the data back into form 1. Easy. > > *BUT* all this will never protect your user in case he just presses > *back* on his browser. Make sure this is well explained on the page. > > пока > Альберто > Киев > > > -- > > > -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_- > > LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? > lOrD i'M sHiNiNg... > YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is > tHe TeSt, YeS iT iS > ThE tEsT, yEs It Is....... >

    attached mail follows:


    Привет!

    andy wrote: > sorry maybe I did explain it not good enough. > > The problem is that if a user has entered data in form 2 goes back to form 1 > and forward to form 2 again, the data he entered once in form 2 is lost. And > I do not find a way how the get the data out of form 2 because the back > button is placed in form 3 (same site as form2 ) to allow a different action > since we have to link to another site then in form 2. > > sounds confusing? I know but I hope I explained it ok

    Honestly yes, it does :( Cant't you draw a sort of diagram? Besides, I will probably also need to know how data is modelled (that is, what your tables look like) to give you meaningful advice.

    пока Альберто Киев

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    Hello,

    has anyone met with this problem.. using IE to submit multipart forms. in text fields if there is "&" ... all text after it will disappear..quite a nuisance when submitting

    mg

    ---
    Outgoing mail is certified Virus Free.
    Checked by AVG anti-virus system (http://www.grisoft.com).
    Version: 6.0.373 / Virus Database: 208 - Release Date: 01/07/2002
    

    attached mail follows:


    Привет!

    MG Lim wrote: > has anyone met with this problem.. using IE to submit multipart forms. in > text fields if there is "&" ... all text after it will disappear..quite a > nuisance when submitting

    yes, all dangerous chars should be substituted. Like &quot; for the " symbol. It's not just IE, it's any browser.

    пока Альберто Киев

    -- 
    

    -_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_--_=}{=_-

    LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu? lOrD i'M sHiNiNg... YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE tHe TeSt, YeS iT iS ThE tEsT, yEs It Is tHe TeSt, YeS iT iS ThE tEsT, yEs It Is.......

    attached mail follows:


    Doesn't surpress output (in general)? Variables don't usually produce an output so putting before it shouldn't make any difference.

    "Uri Even-Chen" <webmasterspeedy.co.il> wrote in message news:3D260D1F.51C8AEB8speedy.co.il... > Hi, > > I tried to suppress warnings in isset expressions (Uninitialized string > offset warnings). The original line was something like this: > > if (!(isset($GLOBALS['SPEEDY_GLOBAL_VARS']['PAGE_NAME']))) > > When I added the "" sign like this: > > if (!(isset($GLOBALS['SPEEDY_GLOBAL_VARS']['PAGE_NAME']))) > > My program stopped working, and I got errors like: > > PHP Parse error: parse error, expecting `T_VARIABLE' or `'$'' .... > > Eventually, I put the "" in this place: > > if (!(isset($GLOBALS['SPEEDY_GLOBAL_VARS']['PAGE_NAME']))) > > Which works, but why didn't it work the other way? Is it some kind of > PHP bug? > > I'm using PHP Version 4.1.2 > > Thanks, > Uri. > --------------------------------------------------------

    attached mail follows:


    To test global variables, I wrote the following PHP script:

    (1)<?php (2)session_start(); (3)session_register("counter"); (4)$counter++; (5)echo "$counter"; (6)// header ("location:statistics/contents.php"); (7)?>

    When the script is called several times, the variable is increased accordingly. Thus, it exists globally.

    But when I un-comment line (6), the Web page ("contents.php) is displayed but I cannot echo the variable.

    Why?

    Thanks!

    Tony

    PS: Richard, thank you for your reply, but I still don't understand why is not passed.

    attached mail follows:


    From the php.net manual for pg_fetch_array:

    Note: From 4.1.0, row became optional. Calling pg_fetch_array() will increment internal row counter by 1.

    "Ilia A." wrote: > > On July 5, 2002 07:54 pm, Pete James wrote: > > "Ilia A." wrote: > > > The biggest annoyance I've come across is > > > the fact that while using PostgreSQL with PHP is that when you fetch a > > > row you must specify the number of the result, while in MySQL, that is > > > handled internally by PHP for you. This means that your PHP scripts must > > > track the row numbers themselves. > > > > This is not so... see pg_fetch_array. Since PHP 4.1.0, you no longer > > need the row number. > > It may work without, but according to the manual on php.net > pg_fetch_array > pg_fetch_object > pg_fetch_row > > REQUIRE a row number. If that is no longer the case as you claim, perphaps > someone needs to inform the developers and have them update the > documentation. > > > > > > Now we come to the actual database speed itself. In this regard in most > > > applications MySQL is MUCH faster probably because it has to do allot > > > less work then PostgreSQL does. For example, lets analyze the most common > > > action performed in a database system, a SELECT. When you do a select in > > > MySQL, MySQL internally locks the table for the duration of the select. > > > PostgreSQL on the other hand does a row level lock, internally, for every > > > row you select. > > > > Is this really what you want? Doesn't this mean that PostgreSQL would > > be more efficient for larger user volumes? Locking an entire table > > isn't usually a good thing. > > > > Not necessarily, locking entire table has its pluses and minuses. The BIG > minues is that while the entire table is locked you cannot do anything until > the lock is released. On the other hand, it is MUCH faster to lock the entire > table then the inidividual rows. PostgreSQL would be more effecient on a > system that does lots of locking, but on a system without or few locks MySQL > will beat it hands down. > > Ilia > FUDforum Core Developer > iliaprohost.org

    attached mail follows:


    I spent many frustrating days debugging a similar problem. I don't understand exactly what is going on, but it seems that the problems revolve around PHP's treatment of an integer as signed or unsigned.

    Through experimentation I determined that the way you specify an integer constant (decimal or hex) with the sign bit on will affect how PHP treats that integer.

    Try the following: determine the signed decimal equivalents of the two hex integers in your code & replace the hex representations with the decimal "equivalents". So, if I'm remembering correctly (please check my math), the line

    if ($a > hexdec("ffffffff"))

    would become

    if ($a > -1)

    See if this makes a difference.

    > -----Original Message----- > From: frankhertogs.info [mailto:frankhertogs.info] > Sent: Saturday, July 06, 2002 5:54 PM > To: php-generallists.php.net > Subject: [PHP] Help needed with hexdec(); > > > Hi Guys, > > I have a problem wich I hope has been solved by someone :-) > > Here's the deal, > > I have to convert a perl script to PHP trying to do so > I get negative > values from hexdec(), If I use (int)hexdec() the > numbers aren't negative > anymore, but they do not add up to what they should. > > Here's the perl line: > $a = FF ($a, $b, $c, $d, $temparr[8], $S11, hex("698098d8")); > > > this is PHP: > $a = FF ($a, $b, $c, $d, $temparr[8], $S11, > hexdec("698098d8")); > > FF is a function: > function FF($a,$b,$c,$d,$x,$s,$ac) > { > $a += F($b,$c,$d) + $x + $ac; > if ($a > hexdec("ffffffff")) > { > $a = substr($a,strlen($a)-9,9) ; > } > $a = RL($a,$s); > $a += $b; > return $a; > } > > F is also a function: > function F($x, $y, $z) > { > return ((($x) & ($y)) | ((~$x) & ($z))); > } > > Could anybody tell me what I am missing here? > > e-mail: <mailto:frankhertogs.info> frankhertogs.info > >

    attached mail follows:


    On Sat, 6 Jul 2002, Richard Lynch wrote: > I think we both agree that any old certificate is secure from snooping, > right?

    I would disagree with that.

    In order to snoop on a connection, you need to have some access to the link.

    This may be by being in the same building with one of the endpoints, or by being in the same building as one of the ISPs involved, or by having remotely compromised a machine in one of the above locations.

    If you have this access, then you can divert packets. You can move wires around, or you can outrace a router and take over a connection as it's being initiated.

    Therefore you can present a certificate which is indistinguishable to the client from the "real" server's self-signed certificate, effectively hijacking the session.

    > Yes, a C&A signed certificate is nominally "better" than a non-signed one, > since you know that at some point, somebody paid somebody at least $119 > (US), and that the certificate has the same domain name as the domain name > of the computer you are now surfing to. > > You don't know it's the same computer, though, right? It could easily be a > stolen Cert and hijacked domain. > > For that matter, you don't know that a CRIMINAL purchased the C&A signed > Certificate in the first place.

    No, but the chances of each of these other things happening are progressively less.

    A certificate signed by a known certificate authority tells you that the server you're talking with has a unique token provided to the entity named. That's better than not knowing that.

    miguel