Hoe doorverwijzen zonder header?
------------------------------
Bovenstaand probleem is ondertussen opgelost. Bedankt iedereen! Voor degene die het uiteindelijke script wil:
Formulier:
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
<?php
echo '<h2>Plaats een nieuw concert in het systeem</h2>';
if ($_GET['err'] ==1){
echo '<font color="#666666">Het plaatsen van het concert is gelukt</font>';
}
elseif ($_GET['err'] ==2) {
echo '<font color="#ff0000">Er is iets fouts gegaan, probeer opnieuw.</font>';
}
else{
echo'<form method="post" enctype="multipart/form-data" action="concerten/addconcertcontrole.php">
<input type="hidden" name="show" value="add">
<table width="500" cellpadding="2" cellspacing="4" style="border: 1px solid #FFFFFF;">
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Artiest:</font>
</td>
<td width="300" class="bg_checkbox">
<input type="text" name="artiest" size="50" value="' . isset($_POST["artiest"]) . '" />
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Omschrijving kort:</font>
</td>
<td width="300" class="bg_checkbox">
<textarea name="omschrijving_kort" rows="3" cols="50">' . isset($_POST["omschrijving_kort"]) . '</textarea>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Omschrijving lang:</font>
</td>
<td width="300" class="bg_checkbox">
<textarea name="omschrijving_lang" rows="8" cols="50">' . isset($_POST["omschrijving_lang"]) . '</textarea>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Link website artiest:</font>
</td>
<td width="300" class="bg_checkbox">
<input type="text" name="url" size="50" value="' . isset($_POST["url"]) . '"/>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Genre:</font>
</td>
<td width="300" class="bg_checkbox">
<select name="genrelijst">
<option value="pop/rock">Pop/Rock</option>
<option value="hiphop">Hip-Hop</option>
<option value="jazz">Jazz, Singer-songwriter</option>
<option value="ska">Ska, Raggae, Wereldmuziek</option>
<option value="punk">Punk</option>
<option value="metal">Metal</option>
<option value="gothic">Gothic</option>
<option value="hardcore">Hardcore</option>
</select>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Datum:</font>
</td>
<td width="300" class="bg_checkbox">
<input type="text" size="5" name="datum_dag" value="' . isset($_POST["datum_dag"]) . '">
<select name="datum_maand">
<option value="januari">januari</option>
<option value="februari">februari</option>
<option value="maart">maart</option>
<option value="april">april</option>
<option value="mei">mei</option>
<option value="juni">jui</option>
<option value="juli">juli</option>
<option value="augustus">augustus</option>
<option value="september">september</option>
<option value="oktober">oktober</option>
<option value="november">november</option>
<option value="december">december</option>
</select>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Vvk prijs:</font>
</td>
<td width="300" class="bg_checkbox">
€ <input type="text" size="8" name="vvk_euro" value="' . isset($_POST["vvk_euro"]) . '" /> ,
<input type="text" size="8" name="vvk_cent" value="' . isset($_POST["vvk_cent"]) . '" />
</center>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Deur prijs:</font>
</td>
<td width="300" class="bg_checkbox">
€ <input type="text" size="8" name="deur_euro" value="' . isset($_POST["deur_euro"]) . '" /> ,
<input type="text" size="8" name="deur_cent" value="' . isset($_POST["deur_cent"]) . '" />
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Zaal open:</font>
</td>
<td width="300" class="bg_checkbox">
<select name="zaal_uur">
<option value="12">12</option>
<option value="13">13</option>
<option value="14">14</option>
<option value="15">15</option>
<option value="16">16</option>
<option value="17">17</option>
<option value="18">18</option>
<option value="19">19</option>
<option value="20">20</option>
<option value="21">21</option>
<option value="22">22</option>
<option value="23">23</option>
<option value="00">00</option>
<option value="01">01</option>
<option value="02">02</option>
<option value="03">03</option>
<option value="04">04</option>
<option value="05">05</option>
<option value="06">06</option>
<option value="07">07</option>
<option value="08">08</option>
<option value="09">09</option>
<option value="10">10</option>
<option value="11">11</option>
</select>
:
<select name="zaal_minuut">
<option value="00">00</option>
<option value="05">05</option>
<option value="10">10</option>
<option value="15">15</option>
<option value="20">20</option>
<option value="25">25</option>
<option value="30">30</option>
<option value="35">35</option>
<option value="40">40</option>
<option value="45">45</option>
<option value="50">50</option>
<option value="55">55</option>
</select>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Aanvang:</font>
</td>
<td width="300" class="bg_checkbox">
<select name="aanvang_uur">
<option value="12">12</option>
<option value="13">13</option>
<option value="14">14</option>
<option value="15">15</option>
<option value="16">16</option>
<option value="17">17</option>
<option value="18">18</option>
<option value="19">19</option>
<option value="20">20</option>
<option value="21">21</option>
<option value="22">22</option>
<option value="23">23</option>
<option value="00">00</option>
<option value="01">01</option>
<option value="02">02</option>
<option value="03">03</option>
<option value="04">04</option>
<option value="05">05</option>
<option value="06">06</option>
<option value="07">07</option>
<option value="08">08</option>
<option value="09">09</option>
<option value="10">10</option>
<option value="11">11</option>
</select>
:
<select name="aanvang_minuut">
<option value="00">00</option>
<option value="05">05</option>
<option value="10">10</option>
<option value="15">15</option>
<option value="20">20</option>
<option value="25">25</option>
<option value="30">30</option>
<option value="35">35</option>
<option value="40">40</option>
<option value="45">45</option>
<option value="50">50</option>
<option value="55">55</option>
</select>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
</td>
<td width="300" class="bg_checkbox">
<input type="submit" name="submit" value="Opslaan" />
</td>
</tr>
</table>
</form>';
}
?>
echo '<h2>Plaats een nieuw concert in het systeem</h2>';
if ($_GET['err'] ==1){
echo '<font color="#666666">Het plaatsen van het concert is gelukt</font>';
}
elseif ($_GET['err'] ==2) {
echo '<font color="#ff0000">Er is iets fouts gegaan, probeer opnieuw.</font>';
}
else{
echo'<form method="post" enctype="multipart/form-data" action="concerten/addconcertcontrole.php">
<input type="hidden" name="show" value="add">
<table width="500" cellpadding="2" cellspacing="4" style="border: 1px solid #FFFFFF;">
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Artiest:</font>
</td>
<td width="300" class="bg_checkbox">
<input type="text" name="artiest" size="50" value="' . isset($_POST["artiest"]) . '" />
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Omschrijving kort:</font>
</td>
<td width="300" class="bg_checkbox">
<textarea name="omschrijving_kort" rows="3" cols="50">' . isset($_POST["omschrijving_kort"]) . '</textarea>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Omschrijving lang:</font>
</td>
<td width="300" class="bg_checkbox">
<textarea name="omschrijving_lang" rows="8" cols="50">' . isset($_POST["omschrijving_lang"]) . '</textarea>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Link website artiest:</font>
</td>
<td width="300" class="bg_checkbox">
<input type="text" name="url" size="50" value="' . isset($_POST["url"]) . '"/>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Genre:</font>
</td>
<td width="300" class="bg_checkbox">
<select name="genrelijst">
<option value="pop/rock">Pop/Rock</option>
<option value="hiphop">Hip-Hop</option>
<option value="jazz">Jazz, Singer-songwriter</option>
<option value="ska">Ska, Raggae, Wereldmuziek</option>
<option value="punk">Punk</option>
<option value="metal">Metal</option>
<option value="gothic">Gothic</option>
<option value="hardcore">Hardcore</option>
</select>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Datum:</font>
</td>
<td width="300" class="bg_checkbox">
<input type="text" size="5" name="datum_dag" value="' . isset($_POST["datum_dag"]) . '">
<select name="datum_maand">
<option value="januari">januari</option>
<option value="februari">februari</option>
<option value="maart">maart</option>
<option value="april">april</option>
<option value="mei">mei</option>
<option value="juni">jui</option>
<option value="juli">juli</option>
<option value="augustus">augustus</option>
<option value="september">september</option>
<option value="oktober">oktober</option>
<option value="november">november</option>
<option value="december">december</option>
</select>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Vvk prijs:</font>
</td>
<td width="300" class="bg_checkbox">
€ <input type="text" size="8" name="vvk_euro" value="' . isset($_POST["vvk_euro"]) . '" /> ,
<input type="text" size="8" name="vvk_cent" value="' . isset($_POST["vvk_cent"]) . '" />
</center>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Deur prijs:</font>
</td>
<td width="300" class="bg_checkbox">
€ <input type="text" size="8" name="deur_euro" value="' . isset($_POST["deur_euro"]) . '" /> ,
<input type="text" size="8" name="deur_cent" value="' . isset($_POST["deur_cent"]) . '" />
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Zaal open:</font>
</td>
<td width="300" class="bg_checkbox">
<select name="zaal_uur">
<option value="12">12</option>
<option value="13">13</option>
<option value="14">14</option>
<option value="15">15</option>
<option value="16">16</option>
<option value="17">17</option>
<option value="18">18</option>
<option value="19">19</option>
<option value="20">20</option>
<option value="21">21</option>
<option value="22">22</option>
<option value="23">23</option>
<option value="00">00</option>
<option value="01">01</option>
<option value="02">02</option>
<option value="03">03</option>
<option value="04">04</option>
<option value="05">05</option>
<option value="06">06</option>
<option value="07">07</option>
<option value="08">08</option>
<option value="09">09</option>
<option value="10">10</option>
<option value="11">11</option>
</select>
:
<select name="zaal_minuut">
<option value="00">00</option>
<option value="05">05</option>
<option value="10">10</option>
<option value="15">15</option>
<option value="20">20</option>
<option value="25">25</option>
<option value="30">30</option>
<option value="35">35</option>
<option value="40">40</option>
<option value="45">45</option>
<option value="50">50</option>
<option value="55">55</option>
</select>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
<font class="text">Aanvang:</font>
</td>
<td width="300" class="bg_checkbox">
<select name="aanvang_uur">
<option value="12">12</option>
<option value="13">13</option>
<option value="14">14</option>
<option value="15">15</option>
<option value="16">16</option>
<option value="17">17</option>
<option value="18">18</option>
<option value="19">19</option>
<option value="20">20</option>
<option value="21">21</option>
<option value="22">22</option>
<option value="23">23</option>
<option value="00">00</option>
<option value="01">01</option>
<option value="02">02</option>
<option value="03">03</option>
<option value="04">04</option>
<option value="05">05</option>
<option value="06">06</option>
<option value="07">07</option>
<option value="08">08</option>
<option value="09">09</option>
<option value="10">10</option>
<option value="11">11</option>
</select>
:
<select name="aanvang_minuut">
<option value="00">00</option>
<option value="05">05</option>
<option value="10">10</option>
<option value="15">15</option>
<option value="20">20</option>
<option value="25">25</option>
<option value="30">30</option>
<option value="35">35</option>
<option value="40">40</option>
<option value="45">45</option>
<option value="50">50</option>
<option value="55">55</option>
</select>
</td>
</tr>
<tr width="500">
<td width="200" class="bg_text">
</td>
<td width="300" class="bg_checkbox">
<input type="submit" name="submit" value="Opslaan" />
</td>
</tr>
</table>
</form>';
}
?>
script om alles in te vullen in de DB:
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
<?php
error_reporting(E_ALL);
ini_set("display_errors", 1);
// Databaseconnectie includen
include '../database.php';
// Variabelen voor alle invoervelden aanmaken.
$artiest = $_POST['artiest'];
$om_kort = $_POST['omschrijving_kort'];
$om_lang = $_POST['omschrijving_lang'];
$url = $_POST['url'];
$genre = $_POST['genrelijst'];
$datum_dag = $_POST['datum_dag'];
$datum_maand = $_POST['datum_maand'];
$vvk_euro = $_POST['vvk_euro'];
$vvk_cent = $_POST['vvk_cent'];
$deur_euro = $_POST['deur_euro'];
$deur_cent = $_POST['deur_cent'];
$zaal_uur = $_POST['zaal_uur'];
$zaal_minuut = $_POST['zaal_minuut'];
$aanvang_uur = $_POST['aanvang_uur'];
$aanvang_minuut = $_POST['aanvang_minuut'];
//ingevoerde velden in de query zetten mbv de variabelen.
$sql = 'INSERT INTO concerten(artiest, omschrijving_kort, omschrijving_lang, url, genrelijst, datum_dag, datum_maand, vvk_euro, vvk_cent, deur_euro, deur_cent, zaal_uur, zaal_minuut, aanvang_uur, aanvang_minuut) VALUES ("'.$artiest.'", "'.$om_kort.'", "'.$om_lang.'", "'.$url.'", "'.$genre.'", "'.$datum_dag.'", "'.$datum_maand.'", "'.$vvk_euro.'", "'.$vvk_cent.'", "'.$deur_euro.'", "'.$deur_cent.'", "'.$zaal_uur.'", "'.$zaal_minuut.'", "'.$aanvang_uur.'", "'.$aanvang_minuut.'")';
//query uitvoeren + controle
$result = mysql_query($sql,$connection);
if (!$result) {
die('Invalid query: ' . mysql_error());
}
//terugverwijzen naar het formulier met informatie of invoer gelukt is of niet.
if($result){
header ( "Location: http://www.franklicht.nl/test/index.php?show=1&news=1&err=1");
}
else{
header ( "Location: http://www.franklicht.nl/test/index.php?show=1&news=1&err=2");
}
?>
error_reporting(E_ALL);
ini_set("display_errors", 1);
// Databaseconnectie includen
include '../database.php';
// Variabelen voor alle invoervelden aanmaken.
$artiest = $_POST['artiest'];
$om_kort = $_POST['omschrijving_kort'];
$om_lang = $_POST['omschrijving_lang'];
$url = $_POST['url'];
$genre = $_POST['genrelijst'];
$datum_dag = $_POST['datum_dag'];
$datum_maand = $_POST['datum_maand'];
$vvk_euro = $_POST['vvk_euro'];
$vvk_cent = $_POST['vvk_cent'];
$deur_euro = $_POST['deur_euro'];
$deur_cent = $_POST['deur_cent'];
$zaal_uur = $_POST['zaal_uur'];
$zaal_minuut = $_POST['zaal_minuut'];
$aanvang_uur = $_POST['aanvang_uur'];
$aanvang_minuut = $_POST['aanvang_minuut'];
//ingevoerde velden in de query zetten mbv de variabelen.
$sql = 'INSERT INTO concerten(artiest, omschrijving_kort, omschrijving_lang, url, genrelijst, datum_dag, datum_maand, vvk_euro, vvk_cent, deur_euro, deur_cent, zaal_uur, zaal_minuut, aanvang_uur, aanvang_minuut) VALUES ("'.$artiest.'", "'.$om_kort.'", "'.$om_lang.'", "'.$url.'", "'.$genre.'", "'.$datum_dag.'", "'.$datum_maand.'", "'.$vvk_euro.'", "'.$vvk_cent.'", "'.$deur_euro.'", "'.$deur_cent.'", "'.$zaal_uur.'", "'.$zaal_minuut.'", "'.$aanvang_uur.'", "'.$aanvang_minuut.'")';
//query uitvoeren + controle
$result = mysql_query($sql,$connection);
if (!$result) {
die('Invalid query: ' . mysql_error());
}
//terugverwijzen naar het formulier met informatie of invoer gelukt is of niet.
if($result){
header ( "Location: http://www.franklicht.nl/test/index.php?show=1&news=1&err=1");
}
else{
header ( "Location: http://www.franklicht.nl/test/index.php?show=1&news=1&err=2");
}
?>
Databaseconnectie:
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
<?php
// Database information
$hostname = "xxxx";
$username = "xxxx";
$password = "xxxx";
$database = "xxxx";
// Function to specify possible MySQL errors
function showerror()
{
die("Error" .mysql_errno() . " : " . mysql_error());
exit;
}
// Making the MySQL connection
if (!($connection= @ mysql_connect($hostname, $username, $password))) showerror();
// Function to specify the Database
if (!mysql_select_db($database, $connection))
showerror();
?>
// Database information
$hostname = "xxxx";
$username = "xxxx";
$password = "xxxx";
$database = "xxxx";
// Function to specify possible MySQL errors
function showerror()
{
die("Error" .mysql_errno() . " : " . mysql_error());
exit;
}
// Making the MySQL connection
if (!($connection= @ mysql_connect($hostname, $username, $password))) showerror();
// Function to specify the Database
if (!mysql_select_db($database, $connection))
showerror();
?>
Gewijzigd op 01/01/1970 01:00:00 door Frank
Notice: Undefined index: err in concerten\concertform.php on line 10
Notice: Undefined index: err in concerten\concertform.php on line 14
Notice: Undefined index: artiest in concerten\concertform.php on line 29
Notice: Undefined index: omschrijving_kort in concerten\concertform.php on line 39
Notice: Undefined index: omschrijving_lang in concerten\concertform.php on line 49
Notice: Undefined index: url in concerten\concertform.php on line 59
Notice: Undefined index: datum_dag in concerten\concertform.php on line 88
Notice: Undefined index: vvk_euro in concerten\concertform.php on line 113
Notice: Undefined index: vvk_cent in concerten\concertform.php on line 114
Notice: Undefined index: deur_euro in concerten\concertform.php on line 125
Notice: Undefined index: deur_cent in concerten\concertform.php on line 126
---------------
Komt er dus op neer dat bij vrijwel alle dropdowns iets mis is. Ik had ergens gezien dat ik moest checken met isSet of er iets is ingevuld?
Verder is je tweede script lek: sql-injection.
Zie de vele topics over beveiliging.
Zie ook eens www.phptuts.nl
nimtex schreef op 22.12.2009 12:01:
moet \ niet / zijn?
Het zal wel eens Windows-bakkie zijn.
Gewijzigd op 01/01/1970 01:00:00 door - SanThe -
En zolang het script alleen door admin gebruikt kan worden dan is het script al beveilig tegen sql injectie hackers in zekere zin, maar moet je dat wel zeker weten dat er niemand erbij kan komen
Gewijzigd op 01/01/1970 01:00:00 door peter