All of which brings up the fact that you should never just trust all the=20
values being submitted to a page. That's how SQL insertion attacks succeed.
On Thursday 20 June 2002 13:22, Scott Marlowe wrote:
> You have to process the values yourself to make sure it's right.
>
> Just do something like this:
>
> if ($driving_required == "1") $driving_required =3D 't';
> else $driving_required =3D 'f';
>
> Then use it in your update / insert statement as usual.
>
> On 20 Jun 2002, Jeff Self wrote:
> > That only works if I leave the checkboxes checked. If I remove the
> > check, I get the following error:
> >
> > Warning: pg_exec() query failed: ERROR: Bad boolean external
> > representation ''
> > in /var/www/nngov/admin/jobpostresults.php on line 66
> >
> > On Thu, 2002-06-20 at 13:39, Surojit Niyogi wrote:
> > > Hi Jeff,
> > >
> > > Set the value parameter in the input tag
> > >
> > >
> > > name=3D"driving_required" CHECKED value=3D'1'>
> > >
> > > That should work I believe.
> > >
> > > -Surojit
> > >
> > > Jeff Self wrote:
> > > >I've got a table with a field called driving_required with a boolean
> > > >type and default 'true'. I've built a web page which contains the
> > > >following lines for displaying a checkbox:
> > > >
> > > >
Driver's License Required?
> > > >
> > > >name=3D"driving_required" CHECKED>
> > > >
> > > >After the form is submitted, it calls a php file called
> > > >jobpostresults.php which enters the data from the form into the
> > > > database and displays the results on the page.
> > > >
> > > >Here's the section that enters the form data into the database:
> > > >
> > > >// Add Job Description Details
> > > >$jddquery =3D "INSERT INTO job_description_details (description_id,
> > > >effective_date, driving_required, submitted_on, submitted_by,
> > > >sm_description, responsibilities, behaviors, skills, experience,
> > > >requirements) VALUES
> > > >('$description_id','$effective_date','$driving_required',no w(),'$sub=
mi
> > > >tted_by','$sm_description','$responsibilities','$behaviors' ,'$skills=
',
> > > >'$experience','$requirements')";
> > > >
> > > >$jddresult =3D pg_exec($conn, $jddquery);
> > > >if (!$jddresult)
> > > > exit;
> > > >
> > > >When I input the data and click on submit I get the following error
> > > >message:
> > > >
> > > >Warning: pg_exec() query failed: ERROR: Bad boolean external
> > > >representation 'on'
> > > > in /var/www/nngov/admin/jobpostresults.php on line 46
> > > >
> > > >It looks like the html form is producing 'on' for the value of
> > > >driving_required. How do I get this changed to 'true' in PostgreSQL?
> > >
> > > ---------------------------(end of
> > > broadcast)--------------------------- TIP 3: if posting/reading throu=
gh
> > > Usenet, please send an appropriate subscribe-nomail command to
> > > majordomo@postgresql.org so that your message can get through to the
> > > mailing list cleanly
---------------------------(end of broadcast)---------------------------
TIP 1: subscribe and unsubscribe commands go to majordomo@postgresql.org
Re: Problem involving checkbox and Postgresql
am 20.06.2002 09:57:18 von dbrown
It returns "on" as true. Just test the value of $driving_required and
assign the proper boolen value for postgresql..
If ($driving_required=='on') {
$driving_required=TRUE;
} else {
$driving_required=FALSE;
}
Dave
Jeff Self wrote:
>That only works if I leave the checkboxes checked. If I remove the
>check, I get the following error:
>
>Warning: pg_exec() query failed: ERROR: Bad boolean external
>representation ''
> in /var/www/nngov/admin/jobpostresults.php on line 66
>
>On Thu, 2002-06-20 at 13:39, Surojit Niyogi wrote:
>
>
>>Hi Jeff,
>>
>>Set the value parameter in the input tag
>>
>>
>>name="driving_required" CHECKED value='1'>
>>
>>That should work I believe.
>>
>>-Surojit
>>
>>Jeff Self wrote:
>>
>>
>>
>>>I've got a table with a field called driving_required with a boolean
>>>type and default 'true'. I've built a web page which contains the
>>>following lines for displaying a checkbox:
>>>
>>>
Driver's License Required?
>>>
>>>name="driving_required" CHECKED>
>>>
>>>After the form is submitted, it calls a php file called
>>>jobpostresults.php which enters the data from the form into the database
>>>and displays the results on the page.
>>>
>>>Here's the section that enters the form data into the database:
>>>
>>>// Add Job Description Details
>>>$jddquery = "INSERT INTO job_description_details (description_id,
>>>effective_date, driving_required, submitted_on, submitted_by,
>>>sm_description, responsibilities, behaviors, skills, experience,
>>>requirements) VALUES
>>>('$description_id','$effective_date','$driving_required', now(),'$submitted_by','$sm_description','$responsibilities', '$behaviors','$skills','$experience','$requirements')";
>>>
>>>$jddresult = pg_exec($conn, $jddquery);
>>>if (!$jddresult)
>>> exit;
>>>
>>>When I input the data and click on submit I get the following error
>>>message:
>>>
>>>Warning: pg_exec() query failed: ERROR: Bad boolean external
>>>representation 'on'
>>>in /var/www/nngov/admin/jobpostresults.php on line 46
>>>
>>>It looks like the html form is producing 'on' for the value of
>>>driving_required. How do I get this changed to 'true' in PostgreSQL?
>>>
>>>
>>>
>>>
>>>
>>---------------------------(end of broadcast)---------------------------
>>TIP 3: if posting/reading through Usenet, please send an appropriate
>>subscribe-nomail command to majordomo@postgresql.org so that your
>>message can get through to the mailing list cleanly
>>
>>
---------------------------(end of broadcast)---------------------------
TIP 1: subscribe and unsubscribe commands go to majordomo@postgresql.org
Problem involving checkbox and Postgresql
am 20.06.2002 18:36:40 von Jeff Self
I've got a table with a field called driving_required with a boolean
type and default 'true'. I've built a web page which contains the
following lines for displaying a checkbox:
Driver's License Required?
name="driving_required" CHECKED>
After the form is submitted, it calls a php file called
jobpostresults.php which enters the data from the form into the database
and displays the results on the page.
Here's the section that enters the form data into the database:
$jddresult = pg_exec($conn, $jddquery);
if (!$jddresult)
exit;
When I input the data and click on submit I get the following error
message:
Warning: pg_exec() query failed: ERROR: Bad boolean external
representation 'on'
in /var/www/nngov/admin/jobpostresults.php on line 46
It looks like the html form is producing 'on' for the value of
driving_required. How do I get this changed to 'true' in PostgreSQL?
--
Jeff Self
Information Technology Analyst
Department of Personnel
City of Newport News
2400 Washington Avenue
Newport News, VA 23607
757-926-6930
---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to majordomo@postgresql.org so that your
message can get through to the mailing list cleanly
Re: Problem involving checkbox and Postgresql
am 20.06.2002 19:39:43 von Surojit Niyogi
Hi Jeff,
Set the value parameter in the input tag
name="driving_required" CHECKED value='1'>
That should work I believe.
-Surojit
Jeff Self wrote:
>I've got a table with a field called driving_required with a boolean
>type and default 'true'. I've built a web page which contains the
>following lines for displaying a checkbox:
>
>
Driver's License Required?
>
>name="driving_required" CHECKED>
>
>After the form is submitted, it calls a php file called
>jobpostresults.php which enters the data from the form into the database
>and displays the results on the page.
>
>Here's the section that enters the form data into the database:
>
>// Add Job Description Details
>$jddquery = "INSERT INTO job_description_details (description_id,
>effective_date, driving_required, submitted_on, submitted_by,
>sm_description, responsibilities, behaviors, skills, experience,
>requirements) VALUES
>('$description_id','$effective_date','$driving_required',no w(),'$submitted_by','$sm_description','$responsibilities','$ behaviors','$skills','$experience','$requirements')";
>
>$jddresult = pg_exec($conn, $jddquery);
>if (!$jddresult)
> exit;
>
>When I input the data and click on submit I get the following error
>message:
>
>Warning: pg_exec() query failed: ERROR: Bad boolean external
>representation 'on'
> in /var/www/nngov/admin/jobpostresults.php on line 46
>
>It looks like the html form is producing 'on' for the value of
>driving_required. How do I get this changed to 'true' in PostgreSQL?
>
>
>
---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to majordomo@postgresql.org so that your
message can get through to the mailing list cleanly
Re: Problem involving checkbox and Postgresql
am 20.06.2002 21:01:19 von Jeff Self
That only works if I leave the checkboxes checked. If I remove the
check, I get the following error:
Warning: pg_exec() query failed: ERROR: Bad boolean external
representation ''
in /var/www/nngov/admin/jobpostresults.php on line 66
On Thu, 2002-06-20 at 13:39, Surojit Niyogi wrote:
> Hi Jeff,
>
> Set the value parameter in the input tag
>
>
> name="driving_required" CHECKED value='1'>
>
> That should work I believe.
>
> -Surojit
>
> Jeff Self wrote:
>
> >I've got a table with a field called driving_required with a boolean
> >type and default 'true'. I've built a web page which contains the
> >following lines for displaying a checkbox:
> >
> >
Driver's License Required?
> >
> >name="driving_required" CHECKED>
> >
> >After the form is submitted, it calls a php file called
> >jobpostresults.php which enters the data from the form into the database
> >and displays the results on the page.
> >
> >Here's the section that enters the form data into the database:
> >
> >// Add Job Description Details
> >$jddquery = "INSERT INTO job_description_details (description_id,
> >effective_date, driving_required, submitted_on, submitted_by,
> >sm_description, responsibilities, behaviors, skills, experience,
> >requirements) VALUES
> >('$description_id','$effective_date','$driving_required',no w(),'$submitted_by','$sm_description','$responsibilities','$ behaviors','$skills','$experience','$requirements')";
> >
> >$jddresult = pg_exec($conn, $jddquery);
> >if (!$jddresult)
> > exit;
> >
> >When I input the data and click on submit I get the following error
> >message:
> >
> >Warning: pg_exec() query failed: ERROR: Bad boolean external
> >representation 'on'
> > in /var/www/nngov/admin/jobpostresults.php on line 46
> >
> >It looks like the html form is producing 'on' for the value of
> >driving_required. How do I get this changed to 'true' in PostgreSQL?
> >
> >
> >
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
> subscribe-nomail command to majordomo@postgresql.org so that your
> message can get through to the mailing list cleanly
--
Jeff Self
Information Technology Analyst
Department of Personnel
City of Newport News
2400 Washington Avenue
Newport News, VA 23607
757-926-6930
---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to majordomo@postgresql.org so that your
message can get through to the mailing list cleanly
Re: Problem involving checkbox and Postgresql
am 20.06.2002 22:02:24 von Chris Thompson
Then check if($driving_required==1) { $bleh='t'} else { $bleh='f'}
On 20 Jun 2002, Jeff Self wrote:
> That only works if I leave the checkboxes checked. If I remove the
> check, I get the following error:
>
> Warning: pg_exec() query failed: ERROR: Bad boolean external
> representation ''
> in /var/www/nngov/admin/jobpostresults.php on line 66
>
> On Thu, 2002-06-20 at 13:39, Surojit Niyogi wrote:
> > Hi Jeff,
> >
> > Set the value parameter in the input tag
> >
> >
> > name="driving_required" CHECKED value='1'>
> >
> > That should work I believe.
> >
> > -Surojit
> >
> > Jeff Self wrote:
> >
> > >I've got a table with a field called driving_required with a boolean
> > >type and default 'true'. I've built a web page which contains the
> > >following lines for displaying a checkbox:
> > >
> > >
Driver's License Required?
> > >
> > >name="driving_required" CHECKED>
> > >
> > >After the form is submitted, it calls a php file called
> > >jobpostresults.php which enters the data from the form into the database
> > >and displays the results on the page.
> > >
> > >Here's the section that enters the form data into the database:
> > >
> > >// Add Job Description Details
> > >$jddquery = "INSERT INTO job_description_details (description_id,
> > >effective_date, driving_required, submitted_on, submitted_by,
> > >sm_description, responsibilities, behaviors, skills, experience,
> > >requirements) VALUES
> > >('$description_id','$effective_date','$driving_required',no w(),'$submitted_by','$sm_description','$responsibilities','$ behaviors','$skills','$experience','$requirements')";
> > >
> > >$jddresult = pg_exec($conn, $jddquery);
> > >if (!$jddresult)
> > > exit;
> > >
> > >When I input the data and click on submit I get the following error
> > >message:
> > >
> > >Warning: pg_exec() query failed: ERROR: Bad boolean external
> > >representation 'on'
> > > in /var/www/nngov/admin/jobpostresults.php on line 46
> > >
> > >It looks like the html form is producing 'on' for the value of
> > >driving_required. How do I get this changed to 'true' in PostgreSQL?
> > >
> > >
> > >
> >
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 3: if posting/reading through Usenet, please send an appropriate
> > subscribe-nomail command to majordomo@postgresql.org so that your
> > message can get through to the mailing list cleanly
> --
> Jeff Self
> Information Technology Analyst
> Department of Personnel
> City of Newport News
> 2400 Washington Avenue
> Newport News, VA 23607
> 757-926-6930
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
> subscribe-nomail command to majordomo@postgresql.org so that your
> message can get through to the mailing list cleanly
> --
> Virus scanned by edNET.
>
--
This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted. Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of edNET or lightershade ltd. Finally, the
recipient should check this email and any attachments for the presence of
viruses. edNET and lightershade ltd accepts no liability for any damage
caused by any virus transmitted by this email.
--
--
Virus scanned by edNET.
---------------------------(end of broadcast)---------------------------
TIP 4: Don't 'kill -9' the postmaster
Re: Problem involving checkbox and Postgresql
am 20.06.2002 22:08:12 von Keary Suska
on 6/20/02 1:01 PM, jself@nngov.com purportedly said:
> That only works if I leave the checkboxes checked. If I remove the
> check, I get the following error:
>
> Warning: pg_exec() query failed: ERROR: Bad boolean external
> representation ''
> in /var/www/nngov/admin/jobpostresults.php on line 66
Also keep in mind that you can always manipulate ALL of your $_POST or
$_GET variables through a foreach() loop and a bunch of if() statements...
Hope this helps:)
On 20 Jun 2002, Jeff Self wrote:
> That only works if I leave the checkboxes checked. If I remove the
> check, I get the following error:
>
> Warning: pg_exec() query failed: ERROR: Bad boolean external
> representation ''
> in /var/www/nngov/admin/jobpostresults.php on line 66
>
> On Thu, 2002-06-20 at 13:39, Surojit Niyogi wrote:
> > Hi Jeff,
> >
> > Set the value parameter in the input tag
> >
> >
> > name="driving_required" CHECKED value='1'>
> >
> > That should work I believe.
> >
> > -Surojit
> >
> > Jeff Self wrote:
> >
> > >I've got a table with a field called driving_required with a boolean
> > >type and default 'true'. I've built a web page which contains the
> > >following lines for displaying a checkbox:
> > >
> > >
Driver's License Required?
> > >
> > >name="driving_required" CHECKED>
> > >
> > >After the form is submitted, it calls a php file called
> > >jobpostresults.php which enters the data from the form into the database
> > >and displays the results on the page.
> > >
> > >Here's the section that enters the form data into the database:
> > >
> > >// Add Job Description Details
> > >$jddquery = "INSERT INTO job_description_details (description_id,
> > >effective_date, driving_required, submitted_on, submitted_by,
> > >sm_description, responsibilities, behaviors, skills, experience,
> > >requirements) VALUES
> > >('$description_id','$effective_date','$driving_required',no w(),'$submitted_by','$sm_description','$responsibilities','$ behaviors','$skills','$experience','$requirements')";
> > >
> > >$jddresult = pg_exec($conn, $jddquery);
> > >if (!$jddresult)
> > > exit;
> > >
> > >When I input the data and click on submit I get the following error
> > >message:
> > >
> > >Warning: pg_exec() query failed: ERROR: Bad boolean external
> > >representation 'on'
> > > in /var/www/nngov/admin/jobpostresults.php on line 46
> > >
> > >It looks like the html form is producing 'on' for the value of
> > >driving_required. How do I get this changed to 'true' in PostgreSQL?
> > >
> > >
> > >
> >
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 3: if posting/reading through Usenet, please send an appropriate
> > subscribe-nomail command to majordomo@postgresql.org so that your
> > message can get through to the mailing list cleanly
> --
> Jeff Self
> Information Technology Analyst
> Department of Personnel
> City of Newport News
> 2400 Washington Avenue
> Newport News, VA 23607
> 757-926-6930
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
> subscribe-nomail command to majordomo@postgresql.org so that your
> message can get through to the mailing list cleanly
>
-Chadwick
---------------------------(end of broadcast)---------------------------
TIP 2: you can get off all lists at once with the unregister command
(send "unregister YourEmailAddressHere" to majordomo@postgresql.org)
Re: Problem involving checkbox and Postgresql
am 20.06.2002 22:14:39 von Surojit Niyogi
I suppose it works well with radio buttons where you at least have a "Yes"
and "No" option.
I've got a table with a field called driving_required with a boolean
type and default 'true'. I've built a web page which contains the
following lines for displaying a checkbox:
After the form is submitted, it calls a php file called
jobpostresults.php which enters the data from the form into the database
and displays the results on the page.
Here's the section that enters the form data into the database:
$jddresult = pg_exec($conn, $jddquery);
if (!$jddresult)
exit;
When I input the data and click on submit I get the following error
message:
Warning: pg_exec() query failed: ERROR: Bad boolean external
representation 'on'
in /var/www/nngov/admin/jobpostresults.php on line 46
It looks like the html form is producing 'on' for the value of
driving_required. How do I get this changed to 'true' in PostgreSQL?
---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to so that your
message can get through to the mailing list cleanly
--
Jeff Self
Information Technology Analyst
Department of Personnel
City of Newport News
2400 Washington Avenue
Newport News, VA 23607
757-926-6930
---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to so that your
message can get through to the mailing list cleanly
--
Virus scanned by edNET.
Re: Problem involving checkbox and Postgresql
am 20.06.2002 22:22:09 von Scott Marlowe
You have to process the values yourself to make sure it's right.
Then use it in your update / insert statement as usual.
On 20 Jun 2002, Jeff Self wrote:
> That only works if I leave the checkboxes checked. If I remove the
> check, I get the following error:
>
> Warning: pg_exec() query failed: ERROR: Bad boolean external
> representation ''
> in /var/www/nngov/admin/jobpostresults.php on line 66
>
> On Thu, 2002-06-20 at 13:39, Surojit Niyogi wrote:
> > Hi Jeff,
> >
> > Set the value parameter in the input tag
> >
> >
> > name="driving_required" CHECKED value='1'>
> >
> > That should work I believe.
> >
> > -Surojit
> >
> > Jeff Self wrote:
> >
> > >I've got a table with a field called driving_required with a boolean
> > >type and default 'true'. I've built a web page which contains the
> > >following lines for displaying a checkbox:
> > >
> > >
Driver's License Required?
> > >
> > >name="driving_required" CHECKED>
> > >
> > >After the form is submitted, it calls a php file called
> > >jobpostresults.php which enters the data from the form into the database
> > >and displays the results on the page.
> > >
> > >Here's the section that enters the form data into the database:
> > >
> > >// Add Job Description Details
> > >$jddquery = "INSERT INTO job_description_details (description_id,
> > >effective_date, driving_required, submitted_on, submitted_by,
> > >sm_description, responsibilities, behaviors, skills, experience,
> > >requirements) VALUES
> > >('$description_id','$effective_date','$driving_required',no w(),'$submitted_by','$sm_description','$responsibilities','$ behaviors','$skills','$experience','$requirements')";
> > >
> > >$jddresult = pg_exec($conn, $jddquery);
> > >if (!$jddresult)
> > > exit;
> > >
> > >When I input the data and click on submit I get the following error
> > >message:
> > >
> > >Warning: pg_exec() query failed: ERROR: Bad boolean external
> > >representation 'on'
> > > in /var/www/nngov/admin/jobpostresults.php on line 46
> > >
> > >It looks like the html form is producing 'on' for the value of
> > >driving_required. How do I get this changed to 'true' in PostgreSQL?
> > >
> > >
> > >
> >
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 3: if posting/reading through Usenet, please send an appropriate
> > subscribe-nomail command to majordomo@postgresql.org so that your
> > message can get through to the mailing list cleanly
>
--
"Force has no place where there is need of skill.", "Haste in every
business brings failures.", "This is the bitterest pain among men, to have
much knowledge but no power." -- Herodotus
---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to majordomo@postgresql.org so that your
message can get through to the mailing list cleanly
Re: Problem involving checkbox and Postgresql
am 21.06.2002 15:44:24 von Chadwick Rolfs
On Mon, 17 Jun 2002, Digital Wokan wrote:
> All of which brings up the fact that you should never just trust all the
> values being submitted to a page. That's how SQL insertion attacks succeed.
>
> On Thursday 20 June 2002 13:22, Scott Marlowe wrote:
> > You have to process the values yourself to make sure it's right.
> >
> > Just do something like this:
> >
> > if ($driving_required == "1") $driving_required = 't';
> > else $driving_required = 'f';
> >
> > Then use it in your update / insert statement as usual.
> >
> > On 20 Jun 2002, Jeff Self wrote:
> > > That only works if I leave the checkboxes checked. If I remove the
> > > check, I get the following error:
> > >
> > > Warning: pg_exec() query failed: ERROR: Bad boolean external
> > > representation ''
> > > in /var/www/nngov/admin/jobpostresults.php on line 66
> > >
> > > On Thu, 2002-06-20 at 13:39, Surojit Niyogi wrote:
> > > > Hi Jeff,
> > > >
> > > > Set the value parameter in the input tag
> > > >
> > > >
> > > > name="driving_required" CHECKED value='1'>
> > > >
> > > > That should work I believe.
> > > >
> > > > -Surojit
I just looked it up, and the value attribute is optional EXCEPT when the
type is either radio or checkbox. Therefore you must specify some sort of
value; it could even be 'on' if you want ;)
See here:
Either way, as stated above, all values should be checked in a production
state, but to manipulate your $_POST or $_GET arrays and turn them into
sql query strings, it is sometimes necessary to individually search and
replace values that do not work with sql. In other words, html form
values were not meant to be sent to database back ends in the form of sql,
hence we have php to change them for us :) Hooray for that!
-Chadwick
---------------------------(end of broadcast)---------------------------
TIP 4: Don't 'kill -9' the postmaster