Phpauction - View feedback error

Question

Cobber 0 Newbie Poster

18 Years Ago

Hi,

I don't know if this is the right forum to post this, if not please move it or just delete it.

I installed Phpauction via Fantastico after trying several purchased scripts that just wouldn't work.

Everything is working fine except the "View Feedback" links which give the following error messages:

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/ozwww04/public_html/auction/yourfeedback.php on line 65

Warning: Cannot modify header information - headers already sent by (output started at /home/ozwww04/public_html/auction/yourfeedback.php:65) in /home/ozwww04/public_html/auction/includes/stats.inc.php on line 79

Warning: Cannot modify header information - headers already sent by (output started at /home/ozwww04/public_html/auction/yourfeedback.php:65) in /home/ozwww04/public_html/auction/themes/default/header.php.html on line 1

The feedback is still displayed, I just get these warnings at the top of the screen. I couldn't see any obvious errors in yourfeedback.php but then I'm not much good at PHP code.

I tried removing the entries at the end of the file for calling templates, but that really sent it nuts.

Here is the file. I would greatly appreciate it if anyone could "spot the obvious error" for me:

<?#//v.3.2.2

#///////////////////////////////////////////////////////
#// COPYRIGHT 2007 Phpauction.org ALL RIGHTS RESERVED //
#///////////////////////////////////////////////////////

include "./includes/config.inc.php";
include $include_path."dates.inc.php";
include $include_path."membertypes.inc.php";
foreach($membertypes as $idm => $memtypearr) {
  $memtypesarr[$memtypearr['feedbacks']]=$memtypearr;
}
ksort($memtypesarr,SORT_NUMERIC);

if (($_SERVER["REQUEST_METHOD"]=="GET" || !$_SERVER["REQUEST_METHOD"])) {
  $secid = $_SESSION['PHPAUCTION_LOGGED_IN'];
  $TPL_rater_nick=$_SESSION['PHPAUCTION_LOGGED_IN_USERNAME'];
  $sql="SELECT nick, rate_sum, rate_num FROM PHPAUCTIONXL_users WHERE id=".intval($secid);
  $res=mysql_query ($sql);
  if ($res) {
    if (mysql_num_rows($res)>0) {
      $arr=mysql_fetch_array ($res);
      $TPL_nick=$arr['nick'];
      $i=0;
      foreach ($memtypesarr as $k=>$l) {
        if($k >= $arr['rate_sum'] || $i++==(count($memtypesarr)-1)) {
          $TPL_rate_ratio_value="<img src=\"./images/icons/".$l['icon']."\" alt=\"".$l['icon']."\" />";
          break;
        }
      }
      $TPL_feedbacks_num=$arr['rate_num'];
      $TPL_feedbacks_sum=$arr['rate_sum'];
    } else {
      $TPL_err=1;
      $TPL_errmsg="$ERR_105";
    }
  } else {
    $TPL_err=1;
    $TPL_errmsg="$ERR_106";
  }

  if ($_GET[pg]==0)  $pg = 1;
  $lines = (int)$lines;
  if ($lines==0)  $lines = 5;
  $left_limit = ($_GET[pg]-1)*$lines;
  $rsl = mysql_query ( "SELECT count(*) FROM PHPAUCTIONXL_feedbacks WHERE rated_user_id=".intval($secid));
  if ($rsl) {
    $hash = mysql_fetch_array($rsl);
    $total = (int)$hash[0];
  } else $total = 0;
  $TPL_feedbacks_num=$total;
  
  /* get number of pages */
  $pages = ceil($total/$lines);
  
  $sql="SELECT f.*,a.title FROM PHPAUCTIONXL_feedbacks f
      LEFT OUTER JOIN PHPAUCTIONXL_auctions a
      ON a.id=f.auction_id
      WHERE rated_user_id='$secid' 
      ORDER by feedbackdate DESC 
      LIMIT $left_limit,$lines";
  $res=mysql_query ($sql);
  $i=0;
  $feed_disp=array();
  while ($arrfeed = mysql_fetch_array($res)) {
    $feed_disp[$i]["username"]=$arrfeed['rater_user_nick'];
    $feed_disp[$i]["auctionurl"]=(($arrfeed['title']) ? "<a href='item.php?id=".$arrfeed['auction_id']."'>".$arrfeed['title']."</a>":$MSG_113.$arrfeed['auction_id']);
    $feed_disp[$i]["feedback"]=nl2br(stripslashes($arrfeed['feedback']));
    $feed_disp[$i]["rate"]=$arrfeed['rate'];
    $feed_disp[$i]["feedbackdate"] = FormatDate($arrfeed['feedbackdate']);    
    $sql="SELECT id,rate_num,rate_sum FROM PHPAUCTIONXL_users WHERE nick='".$feed_disp[$i]["username"]."'";
    $usarr=mysql_fetch_array(mysql_query ($sql));
    $feed_disp[$i]['usfeed']=$usarr['rate_sum'];
    $feed_disp[$i]['usflink']="profile.php?user_id=".$usarr['id']."&auction_id=".$arrfeed['auction_id'];
    $j=0;
    foreach ($memtypesarr as $k=>$l) {
      if($k >= $usarr['rate_sum'] || $j++==(count($memtypesarr)-1)) {
        $feed_disp[$i]['usicon']="<img src=\"./images/icons/".$l['icon']."\" alt=\"".$l['icon']."\" />";
        break;
      }
    }
    switch($feed_disp[$i]['rate']) {
      case 1 : $feed_disp[$i]['img']="./images/positive.gif";
      break;
      case -1: $feed_disp[$i]['img']="./images/negative.gif";
          $sql="SELECT * FROM PHPAUCTIONXL_feedforum WHERE feed_id=".$arrfeed['id']." ORDER BY seqnum ASC";
          $res_=@mysql_query ($sql);
          if($res_ && mysql_num_rows($res_)>0) {
            while($feedfor=mysql_fetch_array($res_)) {
              $feedfor["commentdate"] = FormatDate($feedfor['commentdate']);    
              $feedfor['username']=($feedfor['user_id']==$secid) ? $TPL_nick : $arrfeed['rater_user_nick']; 
              $feedfor['comment']=nl2br(strip_tags(stripslashes(($feedfor['comment'])))); 
              $feed_disp[$i]['feedforum'][$feedfor['seqnum']]=$feedfor;
            }
            $nextfeedlink=end($feed_disp[$i]['feedforum']);
            if((($_SESSION['PHPAUCTION_LOGGED_IN']==$arrfeed['rated_user_id'] && $nextfeedlink['user_id']==$usarr['id'])
              || ($_SESSION['PHPAUCTION_LOGGED_IN']==$usarr['id'] && $nextfeedlink['user_id']==$arrfeed['rated_user_id'])) && $nextfeedlink['seqnum']<2)
              $feed_disp[$i]['nextfeedforum']="<a href='addfeedforum.php?feed_id=".$nextfeedlink['feed_id']."&seqnum=".$nextfeedlink['seqnum']."'>".$MSG_25_0201."</a>";
            else
              $feed_disp[$i]['nextfeedforum']="";
          } else {
            if($_SESSION['PHPAUCTION_LOGGED_IN']==$arrfeed['rated_user_id'])
              $feed_disp[$i]['nextfeedforum']="<a href='addfeedforum.php?feed_id=".$arrfeed['id']."&seqnum=0'>".$MSG_25_0201."</a>";
            else
              $feed_disp[$i]['nextfeedforum']="";
          }
          break;
      case 0 : $feed_disp[$i]['img']="./images/neutral.gif";
      break;
    }
    $i++;    
  }
  $echofeed="";
  for ($ind2=1; $ind2<=$pages; $ind2++) {
    if ($_GET[pg]!=$ind2) {
      $echofeed .="<a href=\"yourfeedback.php?pg=$ind2\">
                       $ind2</a>";
      if($ind2 != $pages) {
        $echofeed .= " | ";
      }
      
    } else {
      $echofeed .="$ind2";
      if($ind2 != $pages){
        $echofeed .= " | ";
      }
    }
  }
  $echofeed.="";
}

// Calls the appropriate templates

  include "header.php";
  include phpa_include("template_yourfeedback_php.html");
  include "footer.php";
?>

Thanks in advance,

Graham

mysql php

3 Contributors
6 Replies
194 Views
1 Year Discussion Span
Latest Post 16 Years Ago Latest Post by pcfix609

Dani AI

Generated 6 Months Ago

Short version: the SQL failed because the LIMIT got a negative offset (the “-5,5” in the MySQL error). That made mysql_query() return false, so mysql_fetch_array() complained and the warnings were printed before templates/headers were included — which in turn triggered the “headers already sent” messages. correctly pointed to the failing query; the underlying bug was inconsistent/unsafe handling of the page variable (the code checks $_GET[pg] and sets $pg in one place but uses $_GET[pg] again when calculating the offset). Quoted array keys and validated variables fix that reliably.

Use a single, validated page variable and never allow a negative LIMIT. For broad PHP compatibility, this pattern is safe:

// validate page and lines (works in older PHP too)
$pg = (isset($_GET['pg']) && is_numeric($_GET['pg']) && (int)$_GET['pg'] > 0) ? (int)$_GET['pg'] : 1;
$lines = (isset($lines) && (int)$lines > 0) ? (int)$lines : 5;
$left_limit = max(0, ($pg - 1) * $lines);

Always check query results before calling fetch and log errors instead of dumping them to the screen in production:

$res = mysql_query($sql);
if ($res === false) {
  error_log('yourfeedback.php MySQL error: '.mysql_error().' | SQL: '.$sql);
  // set a safe fallback (e.g. $total = 0) and show a friendly message in the template
} else {
  // process $res with mysql_fetch_assoc()
}

Notes and next steps: quote array keys ($_GET['pg']), avoid or die() in production, and disable display_errors on a live site (use logging). For long-term stability migrate away from old mysql_* calls to mysqli or PDO (prepared statements also prevent injection). The fix that suggested is essentially correct; applying the validated $pg + max(0, ...) guard will stop the negative-LIMIT error and eliminate the downstream warnings (as confirmed later by ).

All 6 Replies

nav33n 472 Purple hazed!

18 Years Ago

The 1st warning,

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/ozwww04/public_html/auction/yourfeedback.php on line 65

is because of this query.

SELECT f.*,a.title FROM PHPAUCTIONXL_feedbacks f
      LEFT OUTER JOIN PHPAUCTIONXL_auctions a
      ON a.id=f.auction_id
      WHERE rated_user_id='$secid' 
      ORDER by feedbackdate DESC 
      LIMIT $left_limit,$lines

Right after this query, you have $res=mysql_query ($sql); Instead, use $res=mysql_query ($sql) or die (mysql_error()); You will see why you are getting the warning.

nav33n 472 Purple hazed!

18 Years Ago

Hmm.. Well, Thats because the limits are not being set properly.

if ($_GET[pg]==0)  $pg = 1;
  $lines = (int)$lines;
  if ($lines==0)  $lines = 5;
  $left_limit = ($_GET[pg]-1)*$lines;

This block of code is the one causing you the problem. :) If you are in page1, $_GET will not be set (ie., it will be null and not 0). I can't guarantee you that this will work, but you can try this.

if ($_GET['pg']=="" || $_GET['pg']==0){
     $pg = 1;
} else {
  $pg = $_GET['pg'];
}
  $lines = (int)$lines;
  if ($lines==0) {
    $lines = 5;
  }
  $left_limit = ($pg-1)*$lines;

:) Cheers,
Naveen

Cobber commented: Fixed my problem +4

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Cobber 0 Newbie Poster · Answer 1 · 2008-07-01T23:37:08+00:00

Thanks Nav33n,

I tired that and now I just get a blank screen with the error message:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-5,5' at line 6

Don't know if that helps. Means nothing to me :$

2am now. Better turn this machine off.

Graham

Cobber 0 Newbie Poster · Answer 2 · 2008-07-02T11:57:48+00:00

Hi Naveen,

Thanks - that fixed it!

I have been making websites for seven years and usually manage to fumble my way through PHP mods by experimenting. This one was beyond me and I thought I might have SQL problems, which I won't even touch.

I appreciate your time and effort in looking at this for me.

I'm too old to learn any more new programming languages and sometimes think it's time to hang up my webmaster role. Things are just getting far too complicated for me now.

But your fix may help someone else in the future too, which is what is so good about Dani's forums.

Thanks again,

Graham

nav33n 472 Purple hazed! Team Colleague Featured Poster · Answer 3 · 2008-07-02T12:01:35+00:00

I'm too old to learn any more new programming languages

You are never too old to learn something ;)
Anyways, the problem is fixed! So, Yaay! :)

pcfix609 0 Newbie Poster · Answer 4 · 2010-05-31T20:10:55+00:00

Just letting you know that I had the same problem with PHPAuction and after doint some research, I came across your site and saw the fix. Your solution was an absolute fix. Thank you so much and here's wishing you more power. Now, I only have to worry about editing footnote.php. PHPAuction should hire you as a consultant.

Phpauction - View feedback error

Dani AI

Recommended Answers Collapse Answers

All 6 Replies

Recommended Answers