TalkPHP
 
 
Account Login
Latest Articles
» The basic usage of PHPTAL, a XML/XHTML template library for PHP
» Vulnerable methods and the areas they are commonly trusted in.
» Simple way to protect a form from bot
» The Basics On: How Session Stealing Works
» How to keep your forms from double posting data
IRC Channel
IRC Speech Bubble Join the friendly bunch on IRC...
(#TalkPHP on Freenode)

...Also available via a web interface.

See this thread for information on the TalkPHP Free Hugs Initiative™. Subject to availability.
Associates
Associates
CSS Tutorials
Reply
 
LinkBack Thread Tools Search this Thread Display Modes
Old 01-09-2008, 11:33 AM   #1 (permalink)
The Contributor
Good Samaritan 
 
d4v1d's Avatar
 
Join Date: Dec 2007
Location: Durban, South Africa
Posts: 51
Thanks: 1
d4v1d is on a distinguished road
Arrow Database export to text file...

Hi guys, sorry to bother, just a bit stuck at the mo.

I need to code a newsletter subscription application in PHP with MySQL that collects the name and email address of the user. That's simple enough, but I need to have an option in an admin panel that allows the administrator to export that email address column to a text file that prompts the admin to download the file. i.e. i don't want to save it to a text file on the server. The format of which has to be line-separated. How do I go about this?
d4v1d is offline  
Reply With Quote
Old 01-09-2008, 12:52 PM   #2 (permalink)
The Addict
Top Contributor Good Samaritan 
 
Join Date: Jan 2008
Location: USA
Posts: 217
Thanks: 16
RobertK is on a distinguished road
Default

Well, to start off, you have to have decided upon your format. If you want it in plain XML it is quite simple. But human readable, at least quickly so, has to be done differently.

A good way to start is:
PHP Code:
// Make sure you test security, test the
// $_GET['var'] validity and sanitize all input.

// Mine: C:\Program Files\Xampp\htdocs
$szServerRoot   $_SERVER['DOCUMENT_ROOT'];
// .htaccess in this dir should deny from *
$szSecureFolder szServerRoot '/admin/downloads';
// A simple filename
$szFileName 'email_dump.txt';
$szFullName $szSecureFolder '/' $szFileName;

$db mysl(...) or die(mysql_error());
mysql_select_db('MyDb');

// The following command outputs each column seperated by a tab
// and a row seperated by a linefeed; plenty readable.
$result mysql_query('SELECT * FROM myTable INTO OUTFILE \''.$szFullName.'\';');

if(
$isValidRequest && $result) {
  
header('Pragma: public');
  
header('Expires: 0');
  
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
  
header('Cache-Control: public');
  
header('Content-Description: File Transfer');
  
header('Content-Type: plain/text');
  
header('Content-Disposition: attachment; filename='.$szFileName);
  
header('Content-Transfer-Encoding: ascii');
  
header('Content-Length: ' filesize($szFullName));

  @
readfile($szFullName);
} else {
  die(
'Error encountered: '.mysql_error());

__________________
Programmers are in a race with the Universe to create bigger and better idiot-proof programs, while the Universe is trying to create bigger and better idiots. So far the Universe is winning. - Rich Cook
RobertK is offline  
Reply With Quote
Old 01-09-2008, 02:03 PM   #3 (permalink)
The Contributor
Good Samaritan 
 
d4v1d's Avatar
 
Join Date: Dec 2007
Location: Durban, South Africa
Posts: 51
Thanks: 1
d4v1d is on a distinguished road
Default

Thanks a mil, I'm gonna test that out tonight... I'm guessing the ".htaccess in this dir should deny from *" would force it to download?
d4v1d is offline  
Reply With Quote
Old 01-09-2008, 02:17 PM   #4 (permalink)
The Addict
Top Contributor Good Samaritan 
 
Join Date: Jan 2008
Location: USA
Posts: 217
Thanks: 16
RobertK is on a distinguished road
Default

No! Don't mess with it unless you understand it! Wait a few while I edit an explanation into this post.

---

Okay, the .htaccess in the secure directory should read:
Code:
Deny from all
This means any database dumps that remain there cannot be access directly by HTTP, cURL, or like methods. This forces the download to route through the script, which I gave you a sample of above.

The download is forced by telling the browser that the file is an attachment, meaning "download this", and not .htaccess. The .htaccess file is for your security and preventing circumvention of your security.
__________________
Programmers are in a race with the Universe to create bigger and better idiot-proof programs, while the Universe is trying to create bigger and better idiots. So far the Universe is winning. - Rich Cook
RobertK is offline  
Reply With Quote
Old 01-09-2008, 04:29 PM   #5 (permalink)
The Contributor
Good Samaritan 
 
d4v1d's Avatar
 
Join Date: Dec 2007
Location: Durban, South Africa
Posts: 51
Thanks: 1
d4v1d is on a distinguished road
Default

lol you misunderstood me... I meant exactly what you just said now... by setting the .htaccess to deny all, it forces the text file to download instead of writing to the server... I know what the .htacess is for, i'm not a complete noob
d4v1d is offline  
Reply With Quote
Old 01-09-2008, 04:30 PM   #6 (permalink)
The Addict
Top Contributor Good Samaritan 
 
Join Date: Jan 2008
Location: USA
Posts: 217
Thanks: 16
RobertK is on a distinguished road
Default

Yeah, it was a little bit of a challenge to understand precisely what you meant. So I made sure to play it safe. Better safe, than searching for hours.
__________________
Programmers are in a race with the Universe to create bigger and better idiot-proof programs, while the Universe is trying to create bigger and better idiots. So far the Universe is winning. - Rich Cook
RobertK is offline  
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 01:05 PM.

 
     

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.1.0
Inactive Reminders By Icora Web Design