0

I have a web site with php code that store values received from an http post in a database.

Is made by three files

add.php (to receive and store)

<?php
    include("connect.php");

    $link=Connection();

    $temp=$_POST["temp"];
    $lat =$_POST["lat"];
    $lng =$_POST["lng"];

    $query = "INSERT INTO `temptrac_temp` (`ID`, `temp`, `lat`, `lng`, `timestamp`) VALUES (NULL,'".$temp."', '".$lat."', '".$lng."', CURRENT_TIMESTAMP)";


    mysqli_query($link, $query);


    //mysqli_free_result($query);

    mysqli_close($link);

    header("Location: index.php");
?>

connect.php (to access to mysql server)

<?php

    function Connection(){


        $mysqli = new mysqli("localhost", "temptrac_temp", "temptrac_temp2846", "temptrac_temp");

        /* check connection */
        if ($mysqli->connect_errno) {
            printf("Connect failed: %s\n", $mysqli->connect_error);
            exit();
        }

        return $connection;
    }
?>

index.php (main page that list the data from the database)

<?php

    include("connect.php");     

    $link=Connection();

    $result=mysqli_query($link, "SELECT * FROM `temptrac_temp` ORDER BY `timestamp` DESC");
?>



<p>Temperature Arduino checker</p>

<p>The temperature is:</p>  

<table class="normal" border="2" cellspacing="1" cellpadding="1">

    <tr>
        <td>&nbsp;Temperature&nbsp;</td>
        <td>&nbsp;Latitude&nbsp;</td>
        <td>&nbsp;Longitude&nbsp;</td>
        <td>&nbsp;Timestamp&nbsp;</td>

    </tr>

    <?php 
        if($result!==FALSE){
            printf("porcozio");
            while($row = mysqli_fetch_array($result)) {
                printf("<tr><td> &nbsp;%s </td><td> &nbsp;%s&nbsp; </td><td> &nbsp;%s&nbsp; </td><td> &nbsp;%s&nbsp; </td></tr>", 
                    $row["temp"], $row["lat"], $row["lng"], $row["timestamp"]);

            }
            mysqli_free_result($result);
            mysqli_close();
        }else{

            printf("there is an error");

        }
    ?>

</table>

I do not receive any error so seem like that can connect to mysql server successfully and retrieve 0 rows from the table in the database.

I start to have problem when I modify the code because some function were deprecated and I move to the newer php version.

I remember that my database is already populated and I try different php version in my domine.

here my table

ID (int) | temp (temperature/float) | lat (latitude/float) | lng (longitude/float) | timestamp (timestamp)|

I make the http post by using this site https://www.hurl.it/

Unfortunately I'm not an expert with php and I wonder if there is a good debugger to understand what is really happening.

thanks in advice.

bye!

  • 4
    **WARNING** Your code is exposed to Sqllnjection!! https://www.owasp.org/index.php/SQL_Injection – Justinas Mar 21 '17 at 13:21
  • 1
    Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! [Don't believe it?](http://stackoverflow.com/q/38297105/1011527) – Jay Blanchard Mar 21 '17 at 13:22
  • *"I do not receive any error"*.. Also, make sure your error messages are not being ommited. http://php.net/manual/en/function.error-reporting.php – DontVoteMeDown Mar 21 '17 at 13:23
  • 1
    return $connection; what is the value in this variable? it should be $mysqli – Bhaskar Jain Mar 21 '17 at 13:24
  • thanks! Yes, the problem was the $mysqli variable. I will study how to prevent sql injection, but is still a clue for me ho to debug a php. I cannot use the inspect element console of chrome and the add.php file is not like the index.php file that has html code and you can see the page. Inspect element doesn't show php file so I cannot debug like a .js file. – Andrea Mancini Mar 23 '17 at 13:18

0 Answers0