#PHP string variable | Explore Tumblr posts and blogs

the-nox-syndicate · 2 months ago

Text

SysNotes devlog 3 - Ability to create a new profile

Welcome back to my SysNotes update! SysNotes is a system management app for people with DID, OSDD, and those who are otherwise plural.

(I will keep the intro text the same in all devlogs for context)

This devlog will be shorter than usual because I didn't want to lump it in with the next feature, which I expect will be quite long. In this devlog, I will add a way to create a new profile.

First Devlog (1) | Previous Devlog (2)

Quick Refactor before we jump in

"So I did some refactoring off-camera..." - originally, everything on the page was happening inside one component. I decided to split it up into the main page and the profile section, which is a new separate component. This will keep my code shorter and easier to maintain.

I also added a way to refer to each profile individually by their ID in the URL:

(Colin's profile is ID 4, which is shown in the URL)

I was also storing profile data as separate variables, which would be inconvenient to individually pass into the new main profile component. So I moved them all into one variable:

(old | new)

Design of the New Profile form

To be honest, I've been dreading this part since the beginning. I mean, how do I even lay this out? 💀

It is common for developers to avoid UI design because they are "coders not designers". I, for one, quite enjoy web design. Still, this task feels quite overwhelming to me. So, let's take this little mockup I made and turn it into something usable 💪

Too much stuff?

I think the biggest challenge here is the sheer number of inputs. And as the app grows, the number of inputs in this form will only increase.

The only mandatory input for a new profile is just their name. Therefore, the first step should be separating the Name field from the rest of the inputs.

The new and improved New Profile form is looking much better now:

...Yes, really! That's the whole form!

You are unlikely to know everything about an alter that has just split, so all those fields are completely unnecessary for an alter to be added to the list. Every other detail can be added later through the edit mode, where each field can be edited separately without needing one giant form.

Another big reason why I decided to forego the big form altogether is that the code for saving a new profile and the code for editing a profile would be almost exactly the same (including validation), and it wouldn't make sense to duplicate this code if I can just use it in one instance.

Saving a new profile

Let's add some validation to the input field to make sure that the user enters the name in a correct format.

As the Name is stored in the database as a string, it has the maximum length of 255 characters. Trying to save a longer name than this will cause errors, so we need to validate the input to make sure it's safe to insert into the database:

Here's what happens when I input a whole paragraph of Lorem Ipsum text and try to save it:

On the other hand, a shorter name saves just fine:

By the way, these flash messages are added in 2 ways: the success is a session message, and the error is an error stored separately by the validator. The flash messages originally have no styling, so I defined those myself using Tailwind's "@apply" for efficiency.

Once submitted, the name list automatically updates with our new profile:

(And if I click cancel it just empties the input)

Okay, let's click on Jenny's profile to see what it looks like! ...Oh

This is because the code tries to access Jenny's status, but she doesn't have one yet, she only has a name!

(When I pull the data from the database, I'm trying to access a non-existent value)

(And when I display the values I got from the database, the display may break if the value is NULL)

(This error applies to all profile fields, not just status, however the app crashes after just the first error it comes across so the remaining errors are not shown)

This can easily fixed by using PHP's "isset()" and/or "empty()" function, which checks if a variable has a value:

(I'm using a ternary operator as a more compact alternative to if-else. it basically goes: "if this condition is true ? then do it : if not, do something else")

(And here I just check if these values are not blank before rendering them)

Success, Jenny's profile shows!

Now, we just have to populate this profile with data about Jenny, and to do that we'll need to be able to edit each field. I will work on this in the next devlog, as I expect this to take quite some time.

Thanks so reading! As always, any suggestions are welcome!

#sysnotes devlog #devlog #sysblr #plurality #did #osdd #web development #programming #coding

5 notes · View notes

izicodes · 1 year ago

Text

Tuesday 5th March 2024 - [ Week 1 Day 3 ]

Today I studied primarily on Codecademy's "Learn PHP Skill Path" and still on the basics but it's pretty easy??? Programming languages have a trend of starting off relatively the same, each having small differences.

I don't know if the time of this challenge I would get to the very hard parts of PHP (if there are any? I'm not sure) but so far I am loving it!

What I learnt today: 🌷 Escapes 🌷 String Concatenation 🌷 Creating Variables 🌷 Using Variables 🌷 Variable Parsing 🌷 Variable Reassignment 🌷 Concatenating Assignment Operator 🌷 Assign by Reference 🪻 Numbers 🪻 Addition and Subtraction 🪻 Using Number Variables 🪻 Multiplication and Division 🪻 Exponentiation 🪻 Order of Operations 🪻 Mathematical Assignment Operators

💌 Day 3: How do you print “Welcome to Earth!” in PHP?

[ The challenge ]

#5in5weeks #study challenge #programming #coding #studyblr #codeblr #studying #comp sci #progblr #tech #programmer #php #study #study hard #studyspiration #night study #stay productive

17 notes · View notes

sqlinjection · 8 months ago

Text

SQL Injection

perhaps, the direct association with the SQLi is:

' OR 1=1 -- -

but what does it mean?

Imagine, you have a login form with a username and a password. Of course, it has a database connected to it. When you wish a login and submit your credentials, the app sends a request to the database in order to check whether your data is correct and is it possible to let you in.

the following PHP code demonstrates a dynamic SQL query in a login from. The user and password variables from the POST request is concatenated directly into the SQL statement.

$query ="SELECT * FROM users WHERE username='" +$_POST["user"] + "' AND password= '" + $_POST["password"]$ + '";"

"In a world of locked rooms, the man with the key is king",

and there is definitely one key as a SQL statement:

' OR 1=1-- -

supplying this value inside the name parameter, the query might return more than one user.

most applications will process the first user returned, meaning that the attacker can exploit this and log in as the first user the query returned

the double-dash (--) sequence is a comment indicator in SQL and causes the rest of the query to be commented out

in SQL, a string is enclosed within either a single quote (') or a double quote ("). The single quote (') in the input is used to close the string literal.

If the attacker enters ' OR 1=1-- - in the name parameter and leaves the password blank, the query above will result in the following SQL statement:

SELECT * FROM users WHERE username = '' OR 1=1-- -' AND password = ''

executing the SQL statement above, all the users in the users table are returned -> the attacker bypasses the application's authentication mechanism and is logged in as the first user returned by the query.

The reason for using -- - instead of -- is primarily because of how MySQL handles the double-dash comment style: comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). The safest solution for inline SQL comment is to use --<space><any character> such as -- - because if it is URL-encoded into --%20- it will still be decoded as -- -.

#sqlinjection #technique #example #sql

4 notes · View notes

learnershub101 · 2 years ago

Text

25 Udemy Paid Courses for Free with Certification (Only for Limited Time)

2023 Complete SQL Bootcamp from Zero to Hero in SQL

Become an expert in SQL by learning through concept & Hands-on coding :)

What you'll learn

Use SQL to query a database Be comfortable putting SQL on their resume Replicate real-world situations and query reports Use SQL to perform data analysis Learn to perform GROUP BY statements Model real-world data and generate reports using SQL Learn Oracle SQL by Professionally Designed Content Step by Step! Solve any SQL-related Problems by Yourself Creating Analytical Solutions! Write, Read and Analyze Any SQL Queries Easily and Learn How to Play with Data! Become a Job-Ready SQL Developer by Learning All the Skills You will Need! Write complex SQL statements to query the database and gain critical insight on data Transition from the Very Basics to a Point Where You can Effortlessly Work with Large SQL Queries Learn Advanced Querying Techniques Understand the difference between the INNER JOIN, LEFT/RIGHT OUTER JOIN, and FULL OUTER JOIN Complete SQL statements that use aggregate functions Using joins, return columns from multiple tables in the same query