PHP: Question about $_POST after upgrade to version 5.5

[Ben E Lou]

I'm not sure what version my server was on prior to this, but after the upgrade to 5.5.x, my old scripts that use forms aren't submitting their data properly. I've traced it to $_POST.

OLD WAY:

<form action='staffdrafttool.php?userid={$userid}' method='POST'>

And then later on...

<select name = 'desirefornew'>

Prior to this "upgrade," from there the $desirefornew variable would be populated once the form was submitted without any further code from me. That's not happening now. Instead, I have to do this for every variable to make it populate:

PHP Code:

$desirefornew=$_POST['desirefornew']; 


The issue is that I have some scripts with dozens of variables being submitted, so it'd be a royal pain to have to do that for every one. I'm wondering if there's a php.ini setting that I'm missing that'll set me free. Here are the ones I currently have that I think might be relevant:

variables_order = "EGPCS"
enable_post_data_reading=On
post_max_size = 16M
always_populate_raw_post_data = On

Thoughts?

[Drake]

$desirefornew=$_POST['desirefornew'];

...is standard practice (assuming you're wanting to manipulate $desirefornew elsewhere).

Related: though it's not required, it's best practice to declare all of your variables at the top of your script. Are you doing that, by any chance?

Or are you saying the $_POST variable is empty after the form submits?

[Ben E Lou]

No, I don't need to manipulate the variables at all after the form is submitted. I'm just inserting them into the database immediately. And to be clear, the script worked fine with thousands of submissions prior to the upgrade. The upgrade broke it, which is why I am guessing (ok, hoping) that there is a php.ini fix--that a server setting was either added in the new version or was set to a new default in the process

And no, the post variable is set when the form submits. It's $desirefornew that was populating pre-upgrade without the extra step, and is now empty unless I add that extra line.

[Drake]

Are you using an object oriented model or straight procedural php?

The reason I ask is that there's a significant difference between OO implementation in PHP 4 and PHP 5. If you're using an OO model, there could be something in one of your classes or methods that's working differently.

You might get a bit more insight if you alter your .ini (theoretically in a test environment) to show more robust error messaging. I assume you're suppressing most of your error messages in prod.

Having to add the explicit connection/variable suffing to $desirefornew suggests to me that is was previously being handled somewhere else (maybe even in a bit of javascript?) and that's not working now. My initial guess is in a class somewhere, but it's hard to tell with only a snippet of the code.

[cuervo72]

I ran into that a while ago, I thought with one of the FOBL/IHOF upgrades - query parameters weren't automatically being stored in their variable name. Like Drake says, just assign them at the top of your script. Though yes, converting may be a pain in the ass. I'm not sure if I consistently use $_POST or $_REQUEST (probably the latter, which is probably not proper, but eh - screw you, code fascists!)

[cuervo72]

I think this was the setting, fwiw: PHP: Description of core php.ini directives - Manual

[Drake]

Ooh, yeah. I missed the bit about register_globals.

I've never worked in a world where register_globals was turned on. We always considered it too big of a security risk.

(That said: depending on your audience, the sensitivity of your data, your overall attack surface, blah, blah, blah. There's best practice for professional work, and then there's best practice for my twinkie website where worst case scenario is that I dump my db and restore from backup.)

[Ben E Lou]

No, I'm not declaring my variables (as cuerv says, screw you, code fascists!) It's just for FOF MP league web sites. So, um, how do I even do that? (Syntax pls k thx)

[cuervo72]

Warning

This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.

Eh, if you're now on 5.5 I'm pretty sure you are.

[Ben E Lou]

I'm not declaring them at the beginning. (I assume that means to define them as string, boolean, etc., no?) For example, $username appears in line 10 of this particular code, right after the db login, session statements, etc.

(Oh, and Drake, definitely not classes. Stand-alone scripts with the occasional function.)

[cuervo72]

Oh, I thought you meant that you weren't going to change your code just because the fascists want you to.

Whatever query params are passed you'll need to throw them in the variable explicitly, like Drake said and in the format you put in your first post.

$foo = $_POST['foo'];

edit: but no, you don't have to cast them

[Drake]

My main reference manual:

[Ben E Lou]

Originally Posted by cuervo72

Oh, I thought you meant that you weren't going to change your code just because the fascists want you to.

Yeah, I get how you would have thought that. No, I was just saying that in the existing code I have not been declaring them, and the code fascists hate me for that.

Thanks for the help, gents.

And BOY do I regret upgrading to vBulletin 5 (which is what forced the php upgrade.)

[cuervo72]

Originally Posted by Drake

My main reference manual:

Hah!

It's become my opinion that to be an efficient programmer, you don't necessarily have to know how to code a solution out of thin air, you need to have a higher-level idea of how something should be done and know how to find someone who's already done it. It's like our open-booked tests in engineering and math; you don't need to memorize every equation, you just need to know which one to apply to a certain problem.

[Radii]

Originally Posted by cuervo72

Hah!

It's become my opinion that to be an efficient programmer, you don't necessarily have to know how to code a solution out of thin air, you need to have a higher-level idea of how something should be done and know how to find someone who's already done it.

+1

In the late 90s I loved collecting O'Reilly books, and I have considered buying some recently as I'm doing a couple personal projects that are way out of my comfort zone (windows GUI and some Web stuff, neither of which I've ever touched before for work), but so far stack overflow has gotten me everything i've needed even in completely new areas.

[Drake]

I'm pretty sure Stack Overflow is the only reason I still have a job some days.

AJAX was completely baffling to me, no matter how many tutorials and books I read, until I saw other dumbasses just like me having it broken down into the simplest elements. Same thing with SOAP services and a bunch of other technologies that turn out to be remarkably simple once you see them done the first time.

I've sometimes wondered how programmers before the internet ever figured shit out on their own.

[cuervo72]

AJAX was the same way for me until I wanted to have a page that updated pic and room condition information without reloading, then a search box that updated info in a div, then an auto-populating dropdown, then a search that updated after every keystroke. I don't 100% know what's going on (I can change one thing and screw everything up*) but I know enough. Same goes for using the Google Maps API. Would I have been able to do some of this on my own? Given a crapload of time, maybe. Maybe not. But in fairness, I haven't taken a programming class since C++ over 15 years ago. I'm learning all of this shit on my own.

I've been marveling at how cool the 538 real-time win probability page is, and looking at the html I'm realizing "hey, this isn't so hard after all." It's basically a number of svg with a bunch of lines. I've never coded svg, so they look like magic. In reality, not so much. And the auto-update, eh. Now, the actual calculations are probably pretty involved, but the presentation? Doable.

* JSON and APIs still have me scratching my head sometimes. First, I never know if what I am doing is failing because one site or another doesn't like cross-site scripting/calls. Also, the format doesn't seem 100% consistent. Like sometimes everything is enclosed in {}, sometimes []. y u do different ways???

[Radii]

Originally Posted by cuervo72

* JSON ... format doesn't seem 100% consistent. Like sometimes everything is enclosed in {}, sometimes []. y u do different ways???

[] means an array basically, multiple elements tied to the same header, {} means there is only a singular child element tied to the header, though there can be arrays defined using [] within that child if its a complex class. You can have arrays of fields, or arrays of objects, so you can see the [] notation pretty much anywhere within the JSON depending on how the data is being described.

Json Parser Online is a great online parser if you've got a big JSON string coming back from somewhere and are having trouble deciphering it, or to find errors in JSON you're generating. After something is parsed it has expand/hide buttons to click for all of the arrays, which will probably make it a lot easier to see.

[cuervo72]

Thanks Radii. I found one too where you enter a location for the JSON and it will parse it in a number of ways...of course now at home I can't find the one I think it was. But that one does really help with visualization. I think one of the things that was tripping my up was that the data wasn't necessarily all of the same format, not like dealing with regular query rows.

I have to look at my autocomplete stuff tomorrow - part of my issues were in building the JSON so it could actually be read correctly.

[Radii]

I'll be in daychat tomorrow, can try to help if ya need. many languages have json serializer or json_encode (and deserialize/decode) classes/functions that can do it automatically pretty darn well.

[cuervo72]

Oh, it's nothing I'm working on currently, but thanks. I may call on you in the future though.

(I was going to start a script in php using json_decode, but the need for it has been put off. I'm sure I'll get back to it at some point.)