How to make a search engine safe

Question

games1124u 0 Newbie Poster

11 Years Ago

Hello, i want to know if somebody could help me to make this script safe. Like how to put mysql_real_escape_string.

Or how to use preg_split, or htmletities....

<?php include 'extern/connect.php';

  $categories = file_get_contents('extern/categories.php');
  $footer = file_get_contents('extern/footer.php');
  $logo = file_get_contents('extern/logo.php');
  $report = file_get_contents('extern/report.php');
 ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="keywords" content="//////" />
<meta name="description" content="/////" />
<title>///////<title>
<link rel="shortcut icon" href="images/favicon.ico"  />
<link rel="stylesheet" type="text/css" href="/css/style.css" />
<!--[if IE]>
<link rel="stylesheet" type="text/css" href="/css/ie-style.css" />
<![endif]-->

<script type="text/javascript" src="extern/stats.js" ></script>
<script type='text/javascript' src='ajax/jquery-1.8.1.js'></script>

        <script type="text/javascript">
            $(document).ready(function(){
                $('._bxn').click(function(){
                    var file_id = $(this).attr('id');
                    $.ajax({
                        type: "POST",
                        url: 'ajax/count.php',
                        data: 'file_id=' + file_id
                    });
                });
            });
        </script>
</head>
<body>
<div id="container">

<div id="header">
<div class="img"><?php echo $logo; ?></div>
<div id="form">
<form action='search.php' class='form-srch sr' method='GET'>
    <input type='text' name='search' placeholder='Search here...' required>
    <button type='submit' name='submit'>Search</button>
  </form> 
</div>
</div>
<div id="categories">
<?php echo $categories; ?>
</div>
<?php 
$button = $_GET ['submit'];
$search = $_GET ['search']; 
echo "<div id='containerbartop'>
<div id='dateadded'>Watch funny videos <b>$search</b> </div>
<div id='populair'><a href='populair.php'>Populair</a></div></div><div id='thumbcontainer'><ul class='mainv'>";
include 'extern/connectsearch.php';
$search_exploded = explode (" ", $search);
foreach($search_exploded as $funny)
{
$x++;
if($x==1)
$construct .="title LIKE '%funny%'";
else
$construct .="AND title LIKE '%funny%'";

$constructs ="SELECT * FROM videos WHERE $construct";
$run = mysql_query($constructs);

$foundnum = mysql_num_rows($run);

if ($foundnum==0)

echo "Please try something else";

$per_page = 36;  
$id = $_GET['id'];
$max_pages = ceil($foundnum / $per_page);
if(!$id)
$id=0;                          
$getquery = mysql_query("SELECT * FROM videos WHERE $construct ORDER BY date DESC LIMIT $id, $per_page");

$thumbs = $runrows ['thumbs'];
$title = $runrows ['title'];
$channel = $runrows ['channel'];
$url = $runrows ['url'];
$duration = $runrows ['duration'];

 while($runrows = mysql_fetch_assoc($getquery))
{
echo '<li class="thumbcontent"><a href="'. $runrows['url'] .'" class="_bxn" id="'. $runrows['id'] .'" target="_blank"><img src="'. $runrows['thumbs'].'" class="thumb" name="'. $runrows['title'] .'" alt="'. $runrows['title'] .'" title="'. $runrows['title'] .'" width="240" height="180" />          
</a><span class="thumbreport"><a href="raport.php?url= '. $runrows['url'] .'&thumb='. $runrows['thumbs'] .'&title='. $runrows['title'] .' " target="_blank">Report</a></span><span class="duration">'. $runrows['duration'].'</span><span class="out"><a href="'. $runrows['exlink']. '">'. $runrows['ex'] .'</a></span></li>
              ';

 }
echo "<center>";

  ?>
</ul>
 </div>
   <div id="containerbarbottom">
<?php
//Pagination ids
echo "<center>";
$prev = $id - $per_page;
$next = $id + $per_page;

$adjacents = 5;
$last = $max_pages - 1;

if($max_pages > 1)
{   

//previous button
if (!($id<=0)) 
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$prev'>Prev</a> </div>";    

//pages 
if ($max_pages < 7 + ($adjacents * 2))   //not enough pages to bother breaking it up
{
$i = 0;   
for ($counter = 1; $counter <= $max_pages; $counter++)
{
if ($i == $id){
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'><font color=orange><b>$counter</b></font></a></div> ";
}
else {
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'>$counter</a></div> ";
}  
$i = $i + $per_page;                 
}
}
elseif($max_pages > 5 + ($adjacents * 2))    //enough pages to hide some
{
//close to beginning; only hide later pages
if(($id/$per_page) < 1 + ($adjacents * 2))        
{
$i = 0;
for ($counter = 1; $counter < 4 + ($adjacents * 2); $counter++)
{
if ($i == $id){
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'><font color=orange><b>$counter</b></font></a></div> ";
}
else {
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'>$counter</a></div> ";
} 
$i = $i + $per_page;                                       
}

}
//in middle; hide some front and some back
elseif($max_pages - ($adjacents * 2) > ($id / $per_page) && ($id / $per_page) > ($adjacents * 2))
{
echo " <div class='paginate'><a href='funny.php?search=$search&submit=search&id=0'>1</a></div> ";
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$per_id'>2</a> ....</div> ";

$i = $id;                 
for ($counter = ($id/$per_page)+1; $counter < ($id / $per_page) + $adjacents + 2; $counter++)
{
if ($i == $id){
echo " <div class='paginate'><a href='funny.php?search=$search&submit=search&id=$i'><font color=orange><b>$counter</b></font></a></div>";
}
else {
echo " <div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'>$counter</a></div> ";
}   
$i = $i + $per_page;                
}

}
//close to end; only hide early pages
else
{
echo " <div class='paginate'> <a href='funny.php?search=$search&submit=search&id=0'>1</a></div> ";
echo " <div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$per_id'>2</a> ....</div> ";

$i = $id;                
for ($counter = ($id / $per_page) + 1; $counter <= $max_pages; $counter++)
{
if ($i == $id){
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'><font color=orange><b>$counter</b></font></a></div>";
}
else {
echo " <div class='paginate'><a href='funny.php?search=$search&submit=search&id=$i'>$counter</a></div> ";   
} 
$i = $i + $per_page;              
}
}
}

//next button
if (!($id >=$foundnum-$per_page))
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$next'>Next</a></div> ";    
}   
echo "</center>";
} 

?>

</div>
<div id="reclame">

<iframe src="ifr.html" height="275" width="1050" frameborder="0" scrolling="no"></iframe>

</div>

<div id="footer">
<?php echo $footer; ?></div>

</div>
</body>
</html>

Thanks.

mysql php

3 Contributors
14 Replies
378 Views
2 Days Discussion Span
Latest Post 11 Years Ago Latest Post by pritaeas

diafol

11 Years Ago

That's a lot of code to read :(

I'd suggest that you don't use mysql_* functions at all - so no mysql_real_escape_string().
Instead use mysqli_* or PDO wrapper and use parametized queries where you bind values.

pritaeas 2,194 ¯\_(ツ)_/¯

11 Years Ago

this is not working

What is not working? What did you expect? What was the outcome?

pritaeas 2,194 ¯\_(ツ)_/¯

11 Years Ago

Warning: explode() expects parameter 2 to be string, array given in /home/ on line 66

What value are you trying to explode?

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /home/ on line 79

Your query failed. You can check by doing something like this:

$result = mysql_query($yourQuery) or die(mysql_error() . '<br/>' . $yourQuery);

and posting the result here.

diafol

11 Years Ago

It looks as though you're trying to explode a string but have instead got an array

$search = $_GET ['search']; 
$search_exploded = explode (" ", $search);

How did you manage to get an array into a querystring parameter? The only thing I can think of is that you've got multiple textboxes all with the same name. If you go this, then you've already got your array.

If this is what you've done and you can have more than one keyword in each textbox, implode on " " and $_GET['search'] or $search and then do the explode. But this is getting very contrived.

SHow your form and how you expect it to work.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

games1124u 0 Newbie Poster · Answer 1 · 2013-07-01T11:24:09+00:00

This is what i changed from line 54

$search = mysql_real_escape_string(htmlentities(trim ($_POST['search'])));
$search = preg_split('/[\s]+/', $search);

But this is not working what is wrong here please help me.. Thanks

games1124u 0 Newbie Poster · Answer 2 · 2013-07-01T12:39:33+00:00

This is what i get when i paste it in to the scritpt..

Warning: explode() expects parameter 2 to be string, array given in /home/ on line 66

Warning: Invalid argument supplied for foreach() in /home/ on line 67

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /home/ on line 79
Sorry, there are no matching result for Array.

Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /home/

games1124u 0 Newbie Poster · Answer 3 · 2013-07-01T20:58:48+00:00

Everything works fine.... but this is not safe enough or not at all, the only thing i need to do now is to make it a safe. I am not a pro with php i am learning, i am also looking for somebody to make a search engine and pagination for me with money.. i just find somebody but is to expensive..

So my question is is it hard to make this script safe or do i need a bether script ?

Thanks for the replys.

diafol · Answer 4 · 2013-07-01T22:32:52+00:00

It's not hard to make it safe. BUT the script is pretty horrible. All that mixed up html/php and deprecated html tags. I'll ask again, show your form, so maybe we can suggest a different approach or tweaks to your code. At the moment we have no idea what data the $_GET['search'] is holding. In the dark.

games1124u 0 Newbie Poster · Answer 5 · 2013-07-02T22:08:47+00:00

This is the search form:

<form action='search.php' class='form-srch sr' method='GET'>
    <input type='text' name='search' placeholder='Search here...' required>
    <button type='submit' name='submit'>Search</button>
  </form>

This is the search engine which works fine:

<?php 
$button = $_GET ['submit'];
$search = $_GET ['search']; 
echo "// INFO";
include 'extern/connectsearch.php';
$search_exploded = explode (" ", $search);
foreach($search_exploded as $funny)
{
$x++;
if($x==1)
$construct .="title LIKE '%funny%'";
else
$construct .="AND title LIKE '%funny%'";
$constructs ="SELECT * FROM videos WHERE $construct";
$run = mysql_query($constructs);
$foundnum = mysql_num_rows($run);
if ($foundnum==0)
echo "Please try something else";
$per_page = 36;  
$id = $_GET['id'];
$max_pages = ceil($foundnum / $per_page);
if(!$id)
$id=0;                          
$getquery = mysql_query("SELECT * FROM videos WHERE $construct ORDER BY date DESC LIMIT $id, $per_page");
$thumbs = $runrows ['thumbs'];
$title = $runrows ['title'];
$channel = $runrows ['channel'];
$url = $runrows ['url'];
$duration = $runrows ['duration'];
 while($runrows = mysql_fetch_assoc($getquery))
{
echo '// MAIN INFO';
 }
echo "<center>";
  ?>

And here is the pagination which work also fine:

<?php
//Pagination ids
echo "<center>";
$prev = $id - $per_page;
$next = $id + $per_page;
$adjacents = 5;
$last = $max_pages - 1;
if($max_pages > 1)
{   
//previous button
if (!($id<=0)) 
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$prev'>Prev</a> </div>";    
//pages 
if ($max_pages < 7 + ($adjacents * 2))   //not enough pages to bother breaking it up
{
$i = 0;   
for ($counter = 1; $counter <= $max_pages; $counter++)
{
if ($i == $id){
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'><font color=orange><b>$counter</b></font></a></div> ";
}
else {
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'>$counter</a></div> ";
}  
$i = $i + $per_page;                 
}
}
elseif($max_pages > 5 + ($adjacents * 2))    //enough pages to hide some
{
//close to beginning; only hide later pages
if(($id/$per_page) < 1 + ($adjacents * 2))        
{
$i = 0;
for ($counter = 1; $counter < 4 + ($adjacents * 2); $counter++)
{
if ($i == $id){
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'><font color=orange><b>$counter</b></font></a></div> ";
}
else {
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'>$counter</a></div> ";
} 
$i = $i + $per_page;                                       
}
}
//in middle; hide some front and some back
elseif($max_pages - ($adjacents * 2) > ($id / $per_page) && ($id / $per_page) > ($adjacents * 2))
{
echo " <div class='paginate'><a href='funny.php?search=$search&submit=search&id=0'>1</a></div> ";
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$per_id'>2</a> ....</div> ";
$i = $id;                 
for ($counter = ($id/$per_page)+1; $counter < ($id / $per_page) + $adjacents + 2; $counter++)
{
if ($i == $id){
echo " <div class='paginate'><a href='funny.php?search=$search&submit=search&id=$i'><font color=orange><b>$counter</b></font></a></div>";
}
else {
echo " <div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'>$counter</a></div> ";
}   
$i = $i + $per_page;                
}
}
//close to end; only hide early pages
else
{
echo " <div class='paginate'> <a href='funny.php?search=$search&submit=search&id=0'>1</a></div> ";
echo " <div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$per_id'>2</a> ....</div> ";
$i = $id;                
for ($counter = ($id / $per_page) + 1; $counter <= $max_pages; $counter++)
{
if ($i == $id){
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$i'><font color=orange><b>$counter</b></font></a></div>";
}
else {
echo " <div class='paginate'><a href='funny.php?search=$search&submit=search&id=$i'>$counter</a></div> ";   
} 
$i = $i + $per_page;              
}
}
}
//next button
if (!($id >=$foundnum-$per_page))
echo "<div class='paginate'> <a href='funny.php?search=$search&submit=search&id=$next'>Next</a></div> ";    
}   
echo "</center>";
} 
?>

@Diafol did you mean like this ?

If i do this in the browser:
htp://www.example.com/funny.php?search=&submit=search&id=-108%20order%20by%2010--

I get this error:
Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /home/pc28/domains/example.com/public_html/funny.php on line 94

diafol · Answer 6 · 2013-07-02T22:20:49+00:00

OK, I'm to take it that

SELECT * FROM videos WHERE $construct ORDER BY date DESC LIMIT $id, $per_page

is causing the error...
If so, change to this

$query = "SELECT * FROM videos WHERE $construct ORDER BY date DESC LIMIT $id, $per_page";
$getquery = mysql_query($query) or die("Query = $query <br />" . mysql_error());

It should print out the actual query and then give you the specific error. If you can't work out what you then need to do, copy the error code and post it here.

games1124u 0 Newbie Poster · Answer 7 · 2013-07-02T22:34:36+00:00

games1124u 0 Newbie Poster

11 Years Ago

That works fine !

diafol · Answer 8 · 2013-07-03T07:02:33+00:00

So where's the problem now - or is it solved?

games1124u 0 Newbie Poster · Answer 9 · 2013-07-03T11:44:33+00:00

if i type this:
htp://www.example.com/funny.php?search=&submit=search&id=-108%20order%20by%2010--

now i get this error:
Query = SELECT * FROM videos WHERE title LIKE '%funny%' ORDER BY date DESC LIMIT -108 order by 10--, 36
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-108 order by 10--, 36' at line 1

if i type i a other browser something like this -108%20order%20by%2010-- nothing happen the browser dont react....

but if i do that in my own website and i type this in: -108%20order%20by%2010-- i get that warning so that is what i want to do.

pritaeas 2,194 ¯\_(ツ)_/¯ Moderator Featured Poster · Answer 10 · 2013-07-03T11:50:02+00:00

LIMIT comes after ORDER BY and it cannot accept negative values. You also have two ORDER BY's which isn't allowed. 10-- is not a valid expression for ORDER BY either.