Site Review/Feedback

[grandad]

So maybe if i take the onclick event out and just used a standard 'a href' tag within the <td> tags, but this will only make the text clickable, will an image map work to make the whole link clickable?

Use both. That way, if JS is enabled, the site works as you want. If JS is disabled, they can still click on the text. Site works either way.....

 

[ziycon]

Use both. That way, if JS is enabled, the site works as you want. If JS is disabled, they can still click on the text. Site works either way.....

Good idea, thanks!

 

[ziycon]

By the way your pages are quite open to SQL injection because there is no input-checking on the ID, so you can make it spit out error messages or manipulate the query by going to a url such as /v/cl_desc.php?id=0+OR+ID>0

I have some validation now to check it the club exists, but im unsure how to go about checking to make sure the id is a num?? I was thinking of using something like is_int() or is_numeric() any ideas which is better or worse?

 

[daviddoran]

Well, what I'd do is the following

$id = ( (isset($_GET['id']))?(trim($_GET['id'])):(False) );
if( $id===false || $id=='' )
{
  //No id, very bad
}
if( !is_numeric($id) )
{
  //Not numeric, bad
}

This way you can catch No Input, Empty Input and non-numeric input.

 

[gary.b]

err.. you might not want to use ?id=0... in your URLs - google has a problem with those - and won't cache your pages.

 

[ziycon]

err.. you might not want to use ?id=0... in your URLs - google has a problem with those - and won't cache your pages.

I have it setup that before any pages loads now, it will check and see if the 'id' is a valid number and if it is then it will check to see if its in the DB, if its a number and exists in the DB then the page will load with the relevate data otherwise it will load an error page.

Also i dont use '0' for any records.

 

[daviddoran]

I think his point is that you should switch to using clean urls such as dublinnites.com/clubs/barcode

 

[ziycon]

I think his point is that you should switch to using clean urls such as dublinnites.com/clubs/barcode

I want to, i figured out how to use mod_rewrite but my problem is that when a user rates a venue it expects an ?id=1 to be passed to the next page and then depending on the id number once the entry is added to the DB then the user is redirected back to the venue they just rated. If im using mod_rewrite i cant pass the id variable to the next page and i get a DB error!

 

[daviddoran]

Can't you use a rewrite for that page aswell or POST the variable.
If you have access to modify the redirection then you can definitely do it.

 

[ziycon]

The rating value is currently being passed to the next page through a <form> and then requested using $_REQUEST['rating']; is there any way i can pass a variable on the 1st screen to the 2nd screen with out using the ?id=0 ????

 

[ziycon]

When im using the mod_rewrite, say i enter the fake url does the real url still work in the background or what is really happening?

 

[daviddoran]

Yes, unless your rewrite rule tries to redirect the real page aswell.

So, for instance if you use a rewrite like:

RewriteRule ^clubs/([a-zA-Z0-9_]+)$ venue_view.php?id=$1

You should still be able to access venue_view.php?id=1 or /clubs/1

 

[ziycon]

Yes, unless your rewrite rule tries to redirect the real page aswell.

So, for instance if you use a rewrite like:

RewriteRule ^clubs/([a-zA-Z0-9_]+)$ venue_view.php?id=$1

You should still be able to access venue_view.php?id=1 or /clubs/1

Sorry trying to get my head round this, if i type in clubs/1.php, can i still access id from clubs/venue_view.php?id=1 on that page?

 

[daviddoran]

Ah, here's the thing.

Because we have a Rewrite set up, the rewrite will attempt to redirect to venue_view.php?id=venue_view because it matches.

However, by adding a Rewrite Condition that will not match real files you can use both the real path venue_view.php and rewritten paths clubs/1

RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^clubs/([a-zA-Z0-9_]+)$ venue_view.php?id=$1

 

[ziycon]

Ok, i think i get you now, i'll give it ago later tonight when theres little traffic on the site!

 

[paul]

It's a shame you let it expire. What happened the project ?