while($row = mysql_fetch_array($result)) {
  $days[] = $row[0] ;
  }

'프로그래밍 > PHP' 카테고리의 다른 글

.htaccess 수정하여 index.php 파일 제거  (0) 2009/05/04
DB 내용 배열에 저장하기  (0) 2009/04/26
mysql 보안  (0) 2009/04/22
PHP URL 주소 받아오기  (0) 2009/04/21
Posted by 웹눈

CDATA !?

프로그래밍 2009/04/22 17:47
http://lvsin.tistory.com/148?srchid=BR1http://lvsin.tistory.com/148

'프로그래밍' 카테고리의 다른 글

중복을 최소로 하는 프로그래밍 하기  (4) 2010/07/01
CDATA !?  (0) 2009/04/22
Posted by 웹눈
As long as there are programming languages people will try to hack them, fortunately for us this means we have to have our wits about us when writing applications. In this 2 part article we'll be discussing different ways that hackers try and break into our applications and how we go about protecting our applications from possible harm.

Database Security

Many websites fall under the attack known as SQL Injection. SQL injection occurs when a malicious user experiments on a form to gain information about a database. After gaining sufficient knowledge, usually from database error messages the attacker is equipped to exploit the form for any possible vulnerabilities by injecting SQL into form fields. With SQL Injection a hacker can retrieve your data, insert, delete, basicly can do anything with your database.

A very common example is:

<?php

$username = $_POST['username'];

query = "SELECT * FROM users WHERE username= $username";

?>

Here it is easy for a hacker to try and experiment with your form by giving it statements such as 'OR 1' or 'SELECT username'.

This is easily fixable by using mysql_real_escape_string. What this does is take a string that is going to be used and return the same string with all SQL Injection attempts safely escaped. It will replace those troublesome quotes(') a user might enter with \'.

Example:

<?php

$username = $_POST['username'];

$username = mysql_real_escape_string($username);

query = "SELECT * FROM users WHERE username= $username";

?>

It is always best to make sure that whenever user input is required to use mysql_real_escape_string to ensure that whatever has been given is clean and won't harm your application. Remember NEVER TRUST USER INPUT!

Session Security

Mainly there are 2 types of session hacking, Session Fixation and Session Hijacking. When a user first encounters a page in your application that calls session_start(), a session is created for the user. PHP generates a random session identifier to identify the user, and then it sends a Set-Cookie header to the client. By default, the name of this cookie is PHPSESSID, but it is possible to change the cookie name in php.ini or by using the session_name() function. On subsequent visits, the client identifies the user with the cookie, and this is how the user's data is recalled.

It is possible to set the session identifier through manual input this way a hacker is able to "ride" a session.

An example of this is:

http://yourdomain.com/index.php?PHPSESSID=283

An easy way of preventing this from happening is to regenerate your sessions id every time a user logs in.

Example:

<?php

session_start();
// A user just logged in now call the session_regenerate_id() function
{
session_regenerate_id();
}

?>

This is a quick way to protect your site from any would be hacker. Unfortunately it doesn't protect your site from Session Hijacking, this happens when the person discovers another's session id rather than providing his own. So we would have to identify the person using the session to prevent this. One way of doing this is by using the User-Agent request header. Because it is highly unlikely that a user will change browsers using the same session we'll use this header to identify our user.

When a user logs in identify their User-Agent:

<?php

session_start();
// A user just logged in now call the session_regenerate_id() function
{
session_regenerate_id();
$_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'];
}

?>

Now to prevent our would be hacker from accommodating our session we'll have to check the User-Agent every now and then. Call this up on subsequent pages or every page if you prefer:

<?php

if ($_SESSION['user_agent'] != $_SERVER['HTTP_USER_AGENT'])
{
// Bye now Mr hacker
session_destroy();
exit;
}

?>

Implementing these easy techniques are the best route to go for protecting your applications from malicious attacks. Next time we'll discuss protecting your Filesystem and protection from Cross-Site Scripting better known as XSS. Enjoy!

'프로그래밍 > PHP' 카테고리의 다른 글

DB 내용 배열에 저장하기  (0) 2009/04/26
mysql 보안  (0) 2009/04/22
PHP URL 주소 받아오기  (0) 2009/04/21
MYSQL 여러 테이블에서 검색할때  (0) 2009/04/20
Posted by 웹눈
$url = "http://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"];

'프로그래밍 > PHP' 카테고리의 다른 글

mysql 보안  (0) 2009/04/22
PHP URL 주소 받아오기  (0) 2009/04/21
MYSQL 여러 테이블에서 검색할때  (0) 2009/04/20
$_SERVER 변수  (0) 2009/04/19
Posted by 웹눈
http://study.itiscom.net/8?srchid=BR1http://study.itiscom.net/8

참조

'프로그래밍 > PHP' 카테고리의 다른 글

PHP URL 주소 받아오기  (0) 2009/04/21
MYSQL 여러 테이블에서 검색할때  (0) 2009/04/20
$_SERVER 변수  (0) 2009/04/19
PHP mysql function 들  (0) 2009/04/18
Posted by 웹눈

CSS 리스트 가로 표시

web 2009/04/19 22:44
http://sharpsim.tistory.com/15?srchid=BR1http://sharpsim.tistory.com/15

'web' 카테고리의 다른 글

균열을 일으킨다.  (0) 2009/08/16
CSS 리스트 가로 표시  (0) 2009/04/19
DIV 가운데 정렬 시키기  (3) 2009/04/05
웹폰트 설치 방법  (0) 2009/04/05
Posted by 웹눈

<?
$a1 = $_SERVER["REQUEST_URI"] ;


//웹 절대경로(?) 
$a2 = $_SERVER["SCRIPT_NAME"];
$a3 = $_SERVER["PHP_SELF"] ;


//서버명 
$a4 = $_SERVER["SERVER_NAME"] ;
$a5 = $_SERVER["HTTP_HOST"] ;


//웹서버 document 디렉토리 
$a6 = $_SERVER["DOCUMENT_ROOT"];


//파일전체경로 
$a7 = $_SERVER["PATH_TRANSLATED"] ;
$a8 = $_SERVER["SCRIPT_FILENAME"] ;
$a9 = __FILE__ ; //이건 좀 틀리져. 인클루드한 파일에서도



echo "
<br>
 \$_SERVER[\"REQUEST_URI=\"] ->  $a1 , $REQUEST_URI<br>
<br>
//웹 절대경로(?) <br>
\$_SERVER[\"SCRIPT_NAME\"] -> $a2  , $SCRIPT_NAME<br>
\$_SERVER[\"PHP_SELF\"]  ->$a3 , $PHP_SELF<br>
<br>
//서버명 <br>
\$_SERVER[\"SERVER_NAME\"] ->$a4 ,$SERVER_NAME<br>
\$_SERVER[\"HTTP_HOST\"] ->$a5 , $HTTP_HOST<br>
<br>
//웹서버 document 디렉토리 <br>
\$_SERVER[\"DOCUMENT_ROOT\"] ->$a6 , $DOCUMENT_ROOT<br>
<br>
//파일전체경로 <br>
\$_SERVER[\"PATH_TRANSLATED\"] ->$a7 , $PATH_TRANSLATED<br>
\$_SERVER[\"SCRIPT_FILENAME\"] ->$a8 , $SCRIPT_FILENAME<br>
<br>
\__FILE__ ; //이건 좀 틀리져. 인클루드한 파일에서도 ->$a9 <br>
<br>

";

?>

'프로그래밍 > PHP' 카테고리의 다른 글

MYSQL 여러 테이블에서 검색할때  (0) 2009/04/20
$_SERVER 변수  (0) 2009/04/19
PHP mysql function 들  (0) 2009/04/18
PHP 파일업로드 구현시 보안문제 해결방안.  (0) 2009/04/17
Posted by 웹눈

PHP MySQL Functions

PHP: indicates the earliest version of PHP that supports the function.

FunctionDescriptionPHP
mysql_affected_rows() Returns the number of affected rows in the previous MySQL operation 3
mysql_change_user() Deprecated. Changes the user of the current MySQL connection 3
mysql_client_encoding() Returns the name of the character set for the current connection 4
mysql_close() Closes a non-persistent MySQL connection 3
mysql_connect() Opens a non-persistent MySQL connection 3
mysql_create_db() Deprecated. Creates a new MySQL database. Use mysql_query() instead 3
mysql_data_seek() Moves the record pointer 3
mysql_db_name() Returns a database name from a call to mysql_list_dbs() 3
mysql_db_query() Deprecated. Sends a MySQL query. Use mysql_select_db() and mysql_query() instead 3
mysql_drop_db() Deprecated. Deletes a MySQL database. Use mysql_query() instead 3
mysql_errno() Returns the error number of the last MySQL operation 3
mysql_error() Returns the error description of the last MySQL operation 3
mysql_escape_string() Deprecated. Escapes a string for use in a mysql_query. Use mysql_real_escape_string() instead 4
mysql_fetch_array() Returns a row from a recordset as an associative array and/or a numeric array 3
mysql_fetch_assoc() Returns a row from a recordset as an associative array 4
mysql_fetch_field() Returns column info from a recordset as an object 3
mysql_fetch_lengths() Returns the length of the contents of each field in a result row 3
mysql_fetch_object() Returns a row from a recordset as an object 3
mysql_fetch_row() Returns a row from a recordset as a numeric array 3
mysql_field_flags() Returns the flags associated with a field in a recordset 3
mysql_field_len() Returns the maximum length of a field in a recordset 3
mysql_field_name() Returns the name of a field in a recordset 3
mysql_field_seek() Moves the result pointer to a specified field 3
mysql_field_table() Returns the name of the table the specified field is in 3
mysql_field_type() Returns the type of a field in a recordset 3
mysql_free_result() Free result memory 3
mysql_get_client_info() Returns MySQL client info 4
mysql_get_host_info() Returns MySQL host info 4
mysql_get_proto_info() Returns MySQL protocol info 4
mysql_get_server_info() Returns MySQL server info 4
mysql_info() Returns information about the last query 4
mysql_insert_id() Returns the AUTO_INCREMENT ID generated from the previous INSERT operation 3
mysql_list_dbs() Lists available databases on a MySQL server 3
mysql_list_fields() Deprecated. Lists MySQL table fields. Use mysql_query() instead 3
mysql_list_processes() Lists MySQL processes 4
mysql_list_tables() Deprecated. Lists tables in a MySQL database. Use mysql_query() instead 3
mysql_num_fields() Returns the number of fields in a recordset 3
mysql_num_rows() Returns the number of rows in a recordset 3
mysql_pconnect() Opens a persistent MySQL connection 3
mysql_ping() Pings a server connection or reconnects if there is no connection 4
mysql_query() Executes a query on a MySQL database 3
mysql_real_escape_string() Escapes a string for use in SQL statements 4
mysql_result() Returns the value of a field in a recordset 3
mysql_select_db() Sets the active MySQL database 3
mysql_stat() Returns the current system status of the MySQL server 4
mysql_tablename() Deprecated. Returns the table name of field. Use mysql_query() instead 3
mysql_thread_id() Returns the current thread ID 4
mysql_unbuffered_query() Executes a query on a MySQL database (without fetching / buffering the result) 4


PHP MySQL Constants

Since PHP 4.3 it has been possible to specify additional flags for the mysql_connect() and mysql_pconnect() functions:

PHP: indicates the earliest version of PHP that supports the constant.

ConstantDescriptionPHP
MYSQL_CLIENT_COMPRESS Use compression protocol 4.3
MYSQL_CLIENT_IGNORE_SPACE Allow space after function names 4.3
MYSQL_CLIENT_INTERACTIVE Allow interactive timeout seconds of inactivity before closing the connection 4.3
MYSQL_CLIENT_SSL Use SSL encryption (only available with version 4+ of the MySQL client library) 4.3

The mysql_fetch_array() function uses a constant for the different types of result arrays. The following constants are defined:

ConstantDescriptionPHP
MYSQL_ASSOC Columns are returned into the array with the fieldname as the array index  
MYSQL_BOTH Columns are returned into the array having both a numerical index and the fieldname as the array index  
MYSQL_NUM Columns are returned into the array having a numerical index (index starts at 0)  

'프로그래밍 > PHP' 카테고리의 다른 글

$_SERVER 변수  (0) 2009/04/19
PHP mysql function 들  (0) 2009/04/18
PHP 파일업로드 구현시 보안문제 해결방안.  (0) 2009/04/17
exlode() 배열 관리 외부파일 배열 생성하기  (1) 2009/04/16
Posted by 웹눈
TAG MySQL
http://ssyangcal.tistory.com/380?srchid=BR1http://ssyangcal.tistory.com/380


정규표현식을 사용해서 파일확장자 검사
Posted by 웹눈
list. txt

김치, 1000
콩나물, 2000
.
.
.

<?

 $fp = fopen("list.txt" , "r") ;
while(!feof($fp)) $data[] = fgets( $fp , "1024") ; // 한줄씩 list.txt 에서 데이터 추출
$total = count($data); 총 열 갯수
for($i=0 ; $i < $total ; $i++ ) {
  
 $list = explode("," , $data[$i]) ;
    echo " $list[0] 는 $list[1] 원입니다. <br />";
  }
  ?>
Posted by 웹눈
<?

/* $email, $name, $subject, $message, $to 의 값이 넘어온다. */

mail ($to, $subject, $massage, "From: $email\r\nReply-to: $email \r\n");
?>

mail() 함수는 세개의 인자가 필요한데, 메일을 보내고자 하는 곳의 메일 주소, 메일의 제목, 보내고자 하는 메세지의 본문이다. 네 번째 인자는 지정하지 않아도 되는 선택인자인데, 이는 표준 <CRLF>("\r\n")에 의해 분리되어야 하는 추가적인 헤더를 부여할 수 있도록 해준다.

'프로그래밍 > PHP' 카테고리의 다른 글

exlode() 배열 관리 외부파일 배열 생성하기  (1) 2009/04/16
PHP 이메일 보내기  (0) 2009/04/12
PHP mysql 로우 열 갯수 구하기  (0) 2009/04/11
MYSQL ALTER 문  (0) 2009/04/10
Posted by 웹눈
$total = mysql_num_rows($result);

echo "$total ";

// 정수

'프로그래밍 > PHP' 카테고리의 다른 글

PHP 이메일 보내기  (0) 2009/04/12
PHP mysql 로우 열 갯수 구하기  (0) 2009/04/11
MYSQL ALTER 문  (0) 2009/04/10
PHP 파일 업로드  (0) 2009/04/10
Posted by 웹눈
TAG PHP
http://happybruce.tistory.com/324?srchid=BR1http://happybruce.tistory.com/324

위 링크 참조
Posted by 웹눈
TAG INPUT
새로운 열 추가하기
mysql > ALTER TABLE 테이블명 ADD (추가할row명 varchar(20));

 속성 바꾸기

MODIFY

열 삭제하기

DROP

테이블 이름 바꾸기

RENAME

칼럼 이름 바꾸기

CHANGE

'프로그래밍 > PHP' 카테고리의 다른 글

PHP 이메일 보내기  (0) 2009/04/12
PHP mysql 로우 열 갯수 구하기  (0) 2009/04/11
MYSQL ALTER 문  (0) 2009/04/10
PHP 파일 업로드  (0) 2009/04/10
Posted by 웹눈
TAG MySQL
1. 파일을 입력받을 폼 write.php
<html>
<head><title>파일 업로드</title>
</head>
<body>
<form action="upload.php" name=age enctype=multipart/form-data method=post>

파일 : <input type="file" name="attachfile"><br />
<input type=submit value="입력">
<input type=reset value="취소">
</form>

</body>
</html>

2. 입력받은 폼을 처리 upload.php
<?php

$path = "files/";

if ($_FILES["attachfile"]["error"] > 0)
  {
  echo "Error: " . $_FILES["attachfile"]["error"] . "<br />";
  }
else
  {
  echo "Upload: " . $_FILES["attachfile"]["name"] . "<br />";
  echo "Type: " . $_FILES["attachfile"]["type"] . "<br />";
  echo "Size: " . ($_FILES["attachfile"]["size"] / 1024) . " Kb<br />";
  echo "Stored in: " . $_FILES["attachfile"]["tmp_name"];

  copy($_FILES["attachfile"]["tmp_name"], $path.$_FILES["attachfile"]["name"]);
  }
?>

3. 업로드시 제한 추가하기

<?php
if ((($_FILES["attach"]["type"] == "image/gif")
|| ($_FILES["attach"]["type"] == "image/jpeg")
|| ($_FILES["attach"]["type"] == "image/pjpeg"))
&& ($_FILES["attach"]["size"] < 20000))
  {
  if ($_FILES["attach"]["error"] > 0)
    {
    echo "Error: " . $_FILES["attach"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["attach"]["name"] . "<br />";
    echo "Type: " . $_FILES["attach"]["type"] . "<br />";
    echo "Size: " . ($_FILES["attach"]["size"] / 1024) . " Kb<br />";
    echo "Stored in: " . $_FILES["attach"]["tmp_name"];
    }
  }
else
  {
  echo "Invalid file";
  }
?>

주의 : 동일한 파일명이 존재할경우 덮어써버림.

'프로그래밍 > PHP' 카테고리의 다른 글

PHP 이메일 보내기  (0) 2009/04/12
PHP mysql 로우 열 갯수 구하기  (0) 2009/04/11
MYSQL ALTER 문  (0) 2009/04/10
PHP 파일 업로드  (0) 2009/04/10
Posted by 웹눈
TAG PHP
http://i-ruru.com/265?srchid=BR1http://i-ruru.com/265

body { text-align: center; }

container { text-align: left; margin: 0 auto; }

위의 예제처럼 바디와 가운데 정렬시키고 싶은 div 박스 각각에 위 속성을 넣어준다.

'web' 카테고리의 다른 글

CSS 리스트 가로 표시  (0) 2009/04/19
DIV 가운데 정렬 시키기  (3) 2009/04/05
웹폰트 설치 방법  (0) 2009/04/05
폼/전송버튼 스타일 설정  (1) 2009/04/04
Posted by 웹눈

웹폰트 설치 방법

web 2009/04/05 20:13
http://k.daum.net/qna/view.html?category_id=QCL001&qid=3IHk1&q=%B1%DB%BE%BE%C3%BC+%B8%B8%B5%E5%B4%C2+%B9%E6%B9%FD&srchid=NKS3IHk1

웹폰트 스타일 시트 적용에 대한 자세한 설명

'web' 카테고리의 다른 글

DIV 가운데 정렬 시키기  (3) 2009/04/05
웹폰트 설치 방법  (0) 2009/04/05
폼/전송버튼 스타일 설정  (1) 2009/04/04
css 폰트 설정 정리자료  (1) 2009/04/04
Posted by 웹눈
form {
margin:10px; padding: 0 5px;
border: 1px solid #f1f1f1; 
background-color: #f5f5f5;
}
label {
display:block;
font-weight:bold;
margin:5px 0;
}
input {
padding:2px;
border:1px solid #eee;
font: normal 1em Verdana, sans-serif;
color:#777;
}
textarea {
width:400px;
padding:2px;
font: normal 1em Verdana, sans-serif;
border:1px solid #eee;
height:100px;
display:block;
color:#777;
}
input.button { 
font: bold 12px Arial, Sans-serif; 
height: 24px;
margin: 0;
padding: 2px 3px; 
color: #FFF;
background: #8EB50C url(nav.jpg) repeat-x 0 0;
border: 1px solid #88AD0C;
}

'web' 카테고리의 다른 글

웹폰트 설치 방법  (0) 2009/04/05
폼/전송버튼 스타일 설정  (1) 2009/04/04
css 폰트 설정 정리자료  (1) 2009/04/04
웹디자인 포토샵강좌가 매일 업데이트 되는 사이트  (3) 2008/09/07
Posted by 웹눈
http://doosaram.tistory.com/333?srchid=BR1http://doosaram.tistory.com/333

css 폰트 설정
Posted by 웹눈
TAG CSS, 폰트