access denied

Discussion in 'PHP' started by ataloss, Nov 12, 2013.

  1. #1
    I have a couple of docs with the following warning. thanks for help.
    <HTML><body bgcolor="ccffff"><center>
    <form name="taxset" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
    Select state/rate <p><SELECT name="taxrate">
    <OPTION value=0.04000 selected>4% Alabama
    <OPTION value=0.05600 >5.6% Arkansas
    </Select>
    <p><CENTER><INPUT type=image height=24 alt="submit button" width=129 src="rollsubmit.gif"
      border=0>
    </FORM>
    HTML:
    <?php
    if(isset($_POST['submit']))
    {
    $taxrate = $_POST['taxrate'];
    }
    // error_reporting(0);
    error_reporting(E_ALL ^ E_NOTICE);
    mysql_connect("localhost","root"," ");
    mysql_select_db("numbersdb") or die( "Unable to select database");
    if(!empty($_POST["submit"]))
      {
    $id = $_POST['id'];
    $query="SELECT * FROM numbdata";
    // Where taxrate='$taxrate'
    $result=mysql_query($query);
    if($result)
      {
      } 
    else{echo "invalid entry, $taxrate.<br /> select another?<br />";
      }
      }
    if(!empty($_POST["update"]))
      {
    $sql = "UPDATE numbdata SET
    taxrate = '" . mysql_real_escape_string($_POST['taxrate']) . "'
      WHERE id ='".$_POST["id"]."'";
    mysql_query($sql) or die("Update query failed.");
    echo "taxrate has been set ...";
    }
    ?>
    PHP:
    <form name="settax" action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>" method="post">
    <br />
    <input type="text" name="taxrate"/> <p>
    <INPUT type=image height=24 alt="submit button" width=129 src="rollsubmit.gif border=0>
    </CENTER></form></body></html>
    HTML:

     
    ataloss, Nov 12, 2013 IP
  2. Pudge1

    Pudge1 Well-Known Member

    Messages:
    912
    Likes Received:
    6
    Best Answers:
    1
    Trophy Points:
    140
    Digital Goods:
    1
    #2
    Ensure that the database numbersdb exists as it appears that is the problem.

    EDIT: Also why are you still using the <center> tag? It was deprecated a long time ago
     
    Pudge1, Nov 12, 2013 IP
  3. PoPSiCLe

    PoPSiCLe Illustrious Member

    Messages:
    4,623
    Likes Received:
    725
    Best Answers:
    152
    Trophy Points:
    470
    #3
    You have a space here:
    
    mysql_connect("localhost","root"," ");<--- space between the two " " for password, hence your password is a space character
    
    Code (markup):
    you need to change it to this:
    
    mysql_connect("localhost","root","");
    
    Code (markup):
    Besides that... the code above is... pretty bad.

    Here's a quick and dirty version with mysqli instead of mysql, and proper HTML:
    
    <?php
    
    $dbconnect = mysqli_connect('localhost','root','');
       mysqli_select_db($dbconnect, 'numbersdb') or die( "Unable to select database");
    
       $taxrate = (isset($_POST['submit'])) ? mysqli_real_escape_string($dbconnect, $_POST['taxrate']) : '';
       $id = (isset($_POST['id'])) ? mysqli_real_escape_string($dbconnect, $_POST['id']) : '';
    
       $result = mysqli_query($dbconnect, "SELECT * FROM numbdata");
    
       if (!empty($_POST['update_taxrate'])) {
         $update = mysqli_query($dbconnect, "UPDATE numbdata SET taxrate = '$taxrate' WHERE id ='$id'");
         echo "Taxrate has been set ...";
       }
    
    ?>
    <!DOCTYPE html>
    
    <html>
       <head>
         <title>Select taxrate</title>
    
         <style type="text/css">
           body {
             background: #cff;
           }
           form {
             text-align: center;
           }
         </style>
       </head>
    <body>
       <form name="taxset" action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
         <p><label>Select state/rate</label>
           <select name="taxrate">
             <option value="0.04000" selected>4% Alabama</option>
             <option value="0.05600">5.6% Arkansas</option>
           </select>
         </p>
         <p><label>Update taxrate</label>
           <input type="text" name="update_taxrate">
         <p><input type="submit" name="submit" value="Submit values"></p>
       </form>
    </body>
    </html>
    
    Code (markup):
    Make a note that you don't have anything setting the ID (nor anywhere to get it, besides the first query to the database, which isn't really used for anything) so the update-query won't ever update anything at all, as it stands now.
     
    PoPSiCLe, Nov 12, 2013 IP
  4. nico_swd

    nico_swd Prominent Member

    Messages:
    4,153
    Likes Received:
    344
    Best Answers:
    18
    Trophy Points:
    375
    #4
    This is not a good idea since it makes the site vulnerable to XSS:
    
    <form name="taxset" action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
    
    PHP:
     
    nico_swd, Nov 13, 2013 IP
  5. ataloss

    ataloss Active Member

    Messages:
    79
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    63
    #5
    I got your code to work with few mods . Kinda, thanks. Got it copied for reference. What I'm trying to do is select once from the dropdown and use the selection to update the numbers database via the submit button. Thanks again for ur help.
     
    ataloss, Nov 13, 2013 IP
  6. PoPSiCLe

    PoPSiCLe Illustrious Member

    Messages:
    4,623
    Likes Received:
    725
    Best Answers:
    152
    Trophy Points:
    470
    #6
    Aha - sorry, then I misunderstood a little.
     
    PoPSiCLe, Nov 14, 2013 IP
  7. ezprint2008

    ezprint2008 Well-Known Member

    Messages:
    611
    Likes Received:
    15
    Best Answers:
    2
    Trophy Points:
    140
    Digital Goods:
    1
    #7
    is it pretty much what it says? your SQL is using a password
    does your SQL connect file have the password , its correct and the Top level folder directory is correct
     
    ezprint2008, Nov 16, 2013 IP