Viewing Thread:
"PHP Changes at Freeola"

I received an email from a client saying they'd entered the minimum criteria on my booking form i.e. a contact number or email address but were receiving the following message:

Not transmitted
Error:
Please supply your Telephone number or Email address!

I had a look at the form using Dreamweaver plus tested the form online, I was baffled so decided to check the Freeola website to see if any changes had been made and was annoyed to find the following:

UPDATE 7/6/04

Following a security upgrade, a change has been made to our PHP configuration to switch register_globals OFF. This basically means that statements such as:


echo $my_variable_name;


will no longer function correctly. There is a simple resolution to this problem in the form of some code that should be inserted into the top of your page. Here are some examples:

If the variable you are trying to access is passed via the URL string:


$my_variable_name=$_GET["my_variable_name"];


If the variable you are trying to access is passed via a form post operation:


$my_variable_name=$_POST["my_variable_name"];


If the variable you are trying to access is a server environment variable:


$my_variable_name=$_SERVER["HTTP_HOST"];



The code in my form is:

if ($tel == "" && $email == "")
{
echo "Not transmitted";
echo "
Error:
Please supply your Telephone number or Email address!
Click on the BACK button on your browser to return to the form";
}
else
{
echo "Successfully transmitted

";

Turbo - FYI any of this touch a nerve?
Arrogant:Having or displaying a sense of overbearing self-worth or self-importance. Marked by or arising from a feeling or assumption of one's superiority toward others. Also an anagram of TLYA

Leakest - Your comments seem mostly fair.

Noon - Nice to see a member of staff on these forums lately. Regarding this issue, it was a shame it took a dozen emails (via the support link) asking you to take a look at your own code for the form_to_mail.php code which hadn't been amended to take your own changes/recommendations on board before FREEOLA took some action...

Death?!

We had a status message up on both Freeola.info and our Technical Support Lines for over two weeks. Due to very few sites being affected by these changes we did not email all our members.

Please remember the following Terms and Conditions

11. Freeola.com does not guarantee continuous or uninterrupted use of any of the Freeola Services, especially where Freeola.com finds it necessary to carry out routine maintenance, repairs, reconfigurations or upgrades or where there are circumstances beyond its control. Freeola.com cannot and will not be liable to you for any failure of or interruptions to the Freeola Services. You are also responsible for backing up any information or other data posted or transmitted by you via the Freeola Services (including any website pages created and posted by you) and Freeola.com will not be liable for any loss or corruption of such information or data including the loss of incoming or outgoing message data or information in any form without exception. Please make a back-up copy.
14. Freeola.com does not exclude or limit its liability in negligence for death or personal injury, or for fraud, or otherwise insofar as any exclusion or limitation of its liability is void, prohibited or otherwise unenforceable by law. Subject to this, Freeola.com is not liable and will not be liable under any circumstances for any loss or damages which result or may result from your use of the Freeola Services (included but not limited to corruption or loss of data, defects or delays in transmission or any failure or unavailability of the Freeola Services) or for any reliance on or use of information, services or goods purchased on or through the Freeola Services. Freeola.com is also not liable to you for any act or omission of any other entity furnishing products or services which are required by you to use the Freeola Services.

Turbonutter wrote:
> Maybe learning with a multi-thousand pund business is a bit of a silly
> place to start then? You can't deny that your ignored a basic PHP
> groundrule, never rely on register_globals. You'll find that most PHP
> developers use superglobals to initialise form variables whether
> register_globals is on or off. This was YOUR mistake, not Freeola's.

All I wanted to know is did Freeola announce these changes by emailing domain name holders and at what date, if so then fair enough.

Maybe learning with a multi-thousand pund business is a bit of a silly place to start then? You can't deny that your ignored a basic PHP groundrule, never rely on register_globals. You'll find that most PHP developers use superglobals to initialise form variables whether register_globals is on or off. This was YOUR mistake, not Freeola's.

Turbonutter wrote:
> Try changing the double-quotes around HTTP_HOST to single quotes.
>
> For the record, I have no sympathy with you if you've lost business
> because you don't have a clue how to write PHP.

Thanks for the replies. Turbonutter I don't see the relationship between losing potentially thousands of pounds of business due to not knowing the security changes made at Freeola and not being an expert in PHP.

I was just trying to follow instructions given on the Freeola website i.e.

If the variable you are trying to access is a server environment variable:

$my_variable_name=$_SERVER["HTTP_HOST"];

monkey_man yeah harsh your correct!

Turbonutter wrote:
> Try changing the double-quotes around HTTP_HOST to single quotes.
>
> For the record, I have no sympathy with you if you've lost business
> because you don't have a clue how to write PHP.

Harsh, man, harsh. Everyone has to learn somewhere.

I'm all for this. I run a web host and we have register_globals off. It just leads to better script writing.

These changes have been put in place for security reasons, as many people know we had huge problems around two months ago in which two of our servers had malicious scripts executed.
I will point out almost no web host will have Register Globals on because of the large security risk it brings.

Also you may want to look at the following [URL]http://uk2.php.net/manual/en/function.import-request-variables.php[/URL] as it is another alternative to coding the way stated on our help pages.

Try changing the double-quotes around HTTP_HOST to single quotes.

For the record, I have no sympathy with you if you've lost business because you don't have a clue how to write PHP.