This can be useful if you only need to store the date or you need to group some results by date only.

SelectConvert([smalldatetime],floor(Convert([float],getdate(),(0))),(0))

This is an on going survey – we publish the results every month to see if there are any changes in trends.

The survey is located on the right hand side of the page http://www.withinweb.com/phpeseller/index.php

When you make a vote, you will be able to see the running totals of figures on the page.

We also publish the results once a month to review any changes.

An error on the other hand is not usually recoverable.  An example of an error would be forgetting to place a ; at the end of a line or not enclosing a string with ” marks.

In the case of divide by zero, if you use a try / catch block, program execution will continue because you have caught the exception.

Each try must have at least one corresponding catch block.  You can have multiple catch blocks to catch different classes of exceptions.

When an exception is thrown, the code following the statement will not be executed and PHP will then attempt to find the first matching catch block.

The general form of a try / catch block is :

try
{
$a = 1;
$b = 0;
$c = $a / $b;
}
catch (Exception $e)
{
echo($e->getMessage());
}

Other functions of the exception class are :

getMessage();        // message of exception
getCode();           // code of exception
getFile();           // source filename
getLine();           // source line
getTrace();          // an array of the backtrace()
getPrevious();       // previous exception
getTraceAsString();  // formatted string of trace

You may extend the exception class to create your own custom exceptions and the use them as multiple catch blocks to catch different classes of exception as shown in the following code :

<?php

//Extending the exception class

class WidgetNotFoundException extends Exception {}

function use_widget($widget_name) {
$widget = find_widget($widget_name);

if (!$widget) {
throw new WidgetNotFoundException(t(‘Widget %widget not found.’, array(‘%widget’ => $widget_name)));
}
}

//The try / catch block

try {
$widget = ‘thingie’;
$result = use_widget($widget);

// Continue processing the $result.
// If an exception is thrown by use_widget(), this code never gets called.
}
catch (WidgetNotFoundException $e) {
// Error handling specific to the absence of a widget.
}
catch (Exception $e) {
// Generic exception handling if something else gets thrown.
watchdog(‘widget’, $e->getMessage(), WATCHDOG_ERROR);
}

?>

//trigger exception in a “try” block
try
{
checkNum(2);//If the exception is thrown, this text will not be shownecho ‘If you see this, the number is 1 or below’;}
//catch exception
catch(Exception $e)
{
echo ‘Message: ‘ .$e->getMessage();
}
?>

//Example of fetching data from a database using PDO objects

# using the shortcut ->query() method here since there are no variable
# values in the select statement.

try {

$dbhost = “localhost”;
$dbname    = “users”;
$dbusername = “root”;
$dbpass = “”;

//Connect to the database
$dbh = new PDO(“mysql:host=” . $dbhost . “;dbname=” . $dbname, $dbusername, $dbpass);

//the sql query
$sql = “SELECT * FROM users”;

//statment handle
$sth = $dbh->query($sql);

# setting the fetch mode
$sth->setFetchMode(PDO::FETCH_ASSOC);

echo(“——————————————–<br/>”);
echo(“An example of a while loop<br/>”);
while($row = $sth->fetch()) {
echo( $row["first_name"] . “<br/>” );
$table[] = $row;
}

$dbh = null;

}  catch (PDOException $e) {
print “Error!: ” . $e->getMessage() . “<br/>”;
die();
}

echo(“<br/><br/>”);

echo(“——————————————–<br/>”);
echo(“An example of looping around an array<br/>”);

if ($table) {    //Check if there are any rows to be displayed
//Retrieve each element of the array
foreach($table as $d_row) {
echo( $d_row["first_name"] . ” ” . $d_row["last_name"] . “<br/>” );
}
}

echo(“——————————————–<br/>”);
echo(“An example of printing one element from the array<br/>”);
echo($table[0]["first_name"]);

?>

<?php

//Example of fetching data from a database using PDO objects

//This uses a prepared statement using named values

try {

$dbhost = “localhost”;
$dbname    = “users”;
$dbusername = “root”;
$dbpass = “”;

$first_name = “%paul%”;

//Connect to the database
$dbh = new PDO(“mysql:host=” . $dbhost . “;dbname=” . $dbname, $dbusername, $dbpass);

//the sql query using a named placeholder
$sql = “SELECT * FROM users WHERE first_name LIKE :first_name “;

//statment handle
$sth = $dbh->prepare($sql);

$sth->execute(array(“:first_name” => $first_name));

$sth->setFetchMode(PDO::FETCH_ASSOC);

echo(“<br/><br/>”);
echo(“——————————————–<br/>”);
echo(“An example of printing values from a select statement with parameters<br/>”);

while($row = $sth->fetch()) {
echo( $row["first_name"] . “<br/>” );
$table[] = $row;
}

$dbh = null;

}  catch (PDOException $e) {
print “Error!: ” . $e->getMessage() . “<br/>”;
die();
}

?>

foo     The string “foo”
^foo     ”foo” at the start of a string
foo$     ”foo” at the end of a string
^foo$     ”foo” when it is alone on a string
[abc]     a, b, or c
[a-z]     Any lowercase letter
[^A-Z]     Any character that is not a uppercase letter
(gif|jpg)     Matches either “gif” or “jpeg”
[a-z]+     One or more lowercase letters
[0-9\.\-]     ?ny number, dot, or minus sign
^[a-zA-Z0-9_]{1,}$     Any word of at least one letter, number or _
([wx])([yz])     wy, wz, xy, or xz
[^A-Za-z0-9]     Any symbol (not a number or a letter)
([A-Z]{3}|[0-9]{4})     Matches three letters or four numbers

if (!get_magic_quotes_gpc()) {
$item_name = addslashes($_POST['txtItem_Name']);
}
else
{
$item_name = $_POST['txtItem_Name'];
}

foo                                The string “foo”
^foo                            “foo” at the start of a string
foo$                            “foo” at the end of a string
^foo$                         “foo” when it is alone on a string
[abc]                           a, b, or c
[a-z]                           Any lowercase letter
[^A-Z]                      Any character that is not a uppercase letter
(gif|jpg)                   Matches either “gif” or “jpeg”
[a-z]+                       One or more lowercase letters
[0-9\.\-]                  any number, dot, or minus sign
^[a-zA-Z0-9_]{1,}$      Any word of at least one letter, number or _
([wx])([yz])                    wy, wz, xy, or xz
[^A-Za-z0-9]                 Any symbol (not a number or a letter)
([A-Z]{3}|[0-9]{4})     Matches three letters or four numbers

To test for these, use something like :

//——————————————————
/**
* Purpose : Check input for paticular characters
* Only allow a – z, A – Z , 0-9
* returns true if a match was found, false if no match was found
* @return boolean
*/
function is_valid_input($words) {

if ( preg_match( “/[^0-9a-zA-Z]/”, $words, $array ) )
return false;        //invalid characters
else
return true;        //valid characters

}

Set the permissions on the database username / password as tightly as possible.  If you are displaying data, there is no need for the user to have insert or update permissions into the database.  One solution is to have two usernames / passwords.  One would have select permissions, and would be used only for display.  The other would have select, insert and update permissions used only for forms that require data to be stored in the database.

Test all data input

All form data and all url query strings should be tested.

For example, if you are passing data using a query string any record id’s are usually integer, so test that they are actually integer values with a function such as is_numeric in PHP.

Use correct data types and data sizes in the database

This means that if you have a colunn which is a persons name, the data type size for that column only needs to be 40 characters. There is no need to have a data size any larger than required.
Convert text to html

Before storing text in a database, convert it into html.  This will change inputs such as the Javascript <script> to its html equilivant which cannot be executed on a web page.

Filter out any characters that may cause issues. and are not required.

Use parameterized queries

If you use parametized queries for connection to the database you eliminate string concatenation.  You should always use parametized queries rather than constucting the sql.

Check characters particlarly with username / password

If an entry is a username, it normally does not require any other characters other than a to z and 0 to 9 and it only needs to be say, 8 characters long.

In php, always use the mysql_real_escape_string

http://uk3.php.net/mysql_real_escape_string

SQL Injection pdf

http://dev.mysql.com/tech-resources/articles/guide-to-php-security-ch3.pdf

Description of paramised queries and slq injection in dot.net

http://msdn.microsoft.com/en-us/library/ms998271.aspx

Description of paramised queries and slq injection for php

http://stackoverflow.com/questions/60174/best-way-to-stop-sql-injection-in-php