dougandrews.co.uk

This error usually means that either your code is expecting a variable that isn’t there (so for instance your database needs populating) or your code has assigned the variable in such a way that it can’t be picked up correctly.

You can’t simply ‘echo’ the object variable to see what has been assigned however by using echo in combination with print_r you can view both the variables that your code is expecting as well as those that are actually assigned.

Syntax:

echo print_r($object);

Replace $object with the name of the object in question.

If you are importing a file over a few MB more often than not the phpadmin interface will crash.

Depending on the size of the file it is possible to simply break it into chunks and paste each section into the sql window but this very quickly becomes tiresome and also could lead to missing out data.

A much more effective way of doing this is via your command prompt and only takes a few moments (where I write something in [ ] brackets the contents of the brackets needs to be changed to your local values and the brackets omitted):

1. Open your command prompt and navigate to your mysql/bin directory (entering cd .. takes you up a level, entering cd [name of directory] will change you directory to the name entered).
2. Login to mysql – type: mysql -u[username] -p then press Enter. Enter your password when prompted. The command prompt should now look like : mysql>
3. Assuming you have already created the database, type : use ‘[database name]‘
4. Type source [path of file to import].sql (so for example this could be source c:\Users\Someuser\Downloads\myfile.sql or similar)
5. The command window should then show files being imported row by row.

As I type I am in the process of importing a 586 mb sql file, so far so good..

If you have a website which is powered by a database it is potentially vulnerable to SQL injection attacks – this is relatively simple to protect against and the risks of not doing so are to compromise the integrity of the data stored on your server and possibly the website itself.

What is an SQL Injection attack?

Most websites will pass data from one page to another in order to maintain continuity. For example you might be looking at a list of products and you click on a particular product for more information. The website will pass the ID of the product in question to the next page so that it know what informationt o serve to the customer.

In many cases this is passed in the URL, so you might have  something like www.examplewebsite.com/propduct?id=xyz

An SQL Injection attack occurs when the recipient page takes the XYZ in the URL and makes a query with the database without verifying first that it doesn’t contain any additional and unexpected nasties.

How do I stop Injection attacks?

The key is that every time you retrieve a variable which you intend on passing to the database, check that it is in the expected format. Usually a product ID would be numeric, and not include any other characters. A date might be in the dd/mm/yyyy format. Once you have predetermined what format you expect each variable to be in, create a rule to check it prior to submitting it to the database – and if it fails stop the process.

I know what format I expect it to be in, but how do I check it?

The PHP code preg_match is probably the best method as it allows you very specific controls.

The following would check the variable $input for a date in the format yyyy-mm-dd. If there are any other characters, the page would be redirected to a page where no database queries are made, so stopping the threat.

if (!preg_match(‘/^[\-+]?[0-9]*\-?[0-9]*\-?[0-9]+$/’, $input)) {
header(“Location: http://www.examplewebsite.com/404redirect.php);
exit;
}

The following test just allows numeric characters, any number of them, but anything else kicks it out:

if (!preg_match(‘/^[\-+]?[0-9]+$/’, $input))

You can also allow alphabetical characters, in the following case any character in either upper or lower case:

if (!preg_match(‘/^[\-+]?[a-zA-Z]*+$/’, $input))

There are plenty of guides on the Internet about how to use preg-match()

Simplify the process

You will probably find that you use one or two formats a lot, so create a function where you pass the variable and the type of format expected, then each time you retrieve a variable run it through your function to verify it is of the expected format.