Member Avatar for shaocpa

I am writing a program about shopping center
Please give me some advice!

  • 3 Contributors
  • 13 Replies
  • 195 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by shaocpa

Dani AI

Generated

Below are focused, practical notes that build on the thread so far (especially and ) and address the two problems you ran into: redirects/headers and image uploads. The goal is small, safe fixes you can apply now and a short checklist for a production-ready shop.

First, why redirects fail after output and how to fix it. HTTP headers must be sent before any page content; any echo, stray whitespace, or a UTF‑8 BOM will cause a "headers already sent" error. The simplest fixes are: perform redirects before you print anything, or start output buffering at the top of the script and call exit right after header() so execution stops. Example pattern:

<?php
ob_start();
// validate/process form and DB work here
header('Location: admin.php');
exit;
?>

Second, safer database handling and input validation. Avoid building SQL with concatenation or relying only on escaping. Use prepared statements (PDO or mysqli) and validate inputs from $_POST (use filter_input or explicit checks). Example (PDO):

<?php
$pdo = new PDO('mysql:host=localhost;dbname=shop','user','pass',[PDO::ATTR_ERRMODE=>PDO::ERRMODE_EXCEPTION]);
$stmt = $pdo->prepare('INSERT INTO news (title,content,created_at) VALUES (:t,:c,:d)');
$stmt->execute([':t'=>$title, ':c'=>$content, ':d'=>date('Y-m-d')]);
?>

Third, image upload differences between local and host — quick checklist to debug:

  • Ensure the HTML form uses enctype="multipart/form-data".
  • Check php.ini: file_uploads, upload_max_filesize, post_max_size, upload_tmp_dir.
  • Verify destination folder exists and is writable by the web server (correct owner/permissions).
  • Use is_uploaded_file() / move_uploaded_file() and check their return values.
  • Validate file type server-side (use finfo_file() or getimagesize()), limit size, and generate unique filenames before saving.
  • Store file paths in DB, not raw binary blobs unless you need to.
  • Turn on error reporting temporarily and inspect server logs if uploads silently fail.

If building from scratch is too time-consuming, consider a hosted store-builder as suggested. For learning and control, follow the above checklist and add CSRF tokens, password hashing, and session checks for every restricted page (a point raised earlier by ).

Recommended Answers

All 13 Replies

Member Avatar for Puckdropper

I don't have any idea what you're talking about, and that's likely one of your problems. What do you want to do, exactly? Write it all out, and then work on implementing your expectations.

Member Avatar for shaocpa

I have a friend ,she specialized manufacture and sale folk decoration ,
I am constructing a website for her
this website include: online order system ;member manag system; release news ETC
I have writed out all the code,but I an fied with this code, want to improve
THE WEBSITE:
who can give me some advice ?
PLSSSSS

Member Avatar for shaocpa

Thanks PUckdropper !

I want to know the information about "online order manage system"
DO you clear about our meaning?

Member Avatar for Puckdropper

Do you mean something where you have a list of products in a database and when an user wants to order something it verfies it's instock and lets them order it?

I'm not sure how exactly I can help, except to give you a couple tips:
1) Verify the login status for EVERY page that requires elevated user status.
2) Don't use links for destructive actions.
3) Protect yourself against SQL query injection. Validate ALL user input, use addslashes( $string ) or mysql_real_escape_string( $string ) at the minimum.

Member Avatar for shaocpa

Thanks a lot puckdropper
Your advice is very enlighten
Now I have one question
pls help me to solve the problem below is the code :
<?php
require ('dbconnect.php');
$title=$_POST;
$content=$_POST;
$now = date("Y-m-d");
$strsql="insert into xinwen(title,content,time) values('$title', '$content', '$now')";
mysql_query($strsql,$conn) or die ("error: ".mysql_error());
mysql_close($conn);
echo "alert('successful!')";
header("Location:admini.php");
?>
This error comes:
alert('successful!')
Warning: Cannot modify header information - headers already sent by (output started at D:\www\writenews.php:26) in D:\www\writenews.php on line 27

But when i delete "echo " alert('successful!')"; " ,It is no problem. why?
How to solve this problem？？

Member Avatar for Puckdropper

Swap the echo and header lines.

HTML headers (session_start, header etc) cannot be sent after anything is output. This includes any HTML code you turned off the PHP script for (see example below.)

This works:

<?
session_start();

?>

<HTML>
<h1>Example Page</h1>
</html>

This will not:

This works:

<HTML>
<h1>Example Page</h1>
</html>

<?
session_start();
?>

(The above code is not guaranteed to be correct, or executable at any point. It is presented as an example.)

Member Avatar for shaocpa

thanks a lot Puckdropper

if i have oter question ,I will inquire you

My MSN:

Member Avatar for Puckdropper

You're welcome. If you have any other questions, feel free to post them on the board!

Member Avatar for shaocpa

HI puckdropper
my friend!
pls help me!
i want to have some code about upload images and stuff to databases
i write some code
when i test this code on my own computer,it is successful.
but when i upload this code to special PHP space it is unsuccessful
why? are you have the same functional code?

Member Avatar for Puckdropper

At the point, you really should start a new thread. You're asking a question totally different to the one that started this thread.

Make sure your config is the same on both your personal and public sites. Also, run a few SQL queries to make sure the data is where you think it is.

Member Avatar for shaocpa

thanks a lot puckdropper

i am sorry! you are right!

i already have started a new thread.

i only want to ask you this question at here,
can i have your MSN or E-mail ? i need your help!

Member Avatar for zippee

shaocpa, I see all you need is a site generator or store creator/builder. there are plenty of service providers around (including us). What the service would include, in general:
1. a web front (may and may not include domain name)
2. product pages
3. integrated payment gateways to a list of providers
4. shopping cart
5. back-office control panel which allow you to change product details and inventory level.

This is deffinately save you three months of work!

Member Avatar for shaocpa

thanks ! zippee
my E-mail:


you can contact me by e-mail!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.