EQEmulator Forums - An all-purpose PHP-based tool ("custom")

EQEmulator Forums (https://www.eqemulator.org/forums/index.php)

- Development::Tools (https://www.eqemulator.org/forums/forumdisplay.php?f=593)

- - An all-purpose PHP-based tool ("custom") (https://www.eqemulator.org/forums/showthread.php?t=23892)

Ok here is the revised code. It displays the page perfectly, however when you click on the character name it does not bring you to the magelo-like page. It has an id box then when I type in an id it errors out. I don't mind displaying the ID's if I have to to get that back, I just don't want to display account names for security purposes.

Code:

<head>



<title>EQ Emu - Character List</title>



<?php



$time_start = microtime(true);

include "../includes/constants.php";

include "../includes/functions.php";



if (!isset($_GET["limit"])) {

        $_GET["limit"] = 10;

};

if ((!isset($_GET["offset"]) || ($_GET["offset"] == ""))) {

        $_GET["offset"] = 0;

};



?>



</head>



<body>



<center><h1>Character List</h1></center>



<table align="center" border="1">

        <form method="GET" action="">

        <caption align="top" style="text-align:right">

                <?php CreateResultLimit();?>

<!--                <input type="text" size="1" name="limit" value="<?php echo $_GET["limit"];?>"> Per Page

                <input type="hidden" name="offset" value="<?php echo $_GET["offset"];?>">

                <input type="hidden" name="sort" value="<?php echo $_GET["sort"];?>">

                <input type="hidden" name="dir" value="<?php echo $_GET["dir"];?>">

                <a href="?limit=<?php echo $_GET["limit"];?>&offset=<?php if ($_GET["offset"] - $_GET["limit"] >= 0) {echo $_GET["offset"] - $_GET["limit"];};?>&sort=<?php echo $_GET["sort"];?>&dir=<?php echo $_GET["dir"];?>">&lt;&lt;Prev</a>&nbsp;

                <a href="?limit=<?php echo $_GET["limit"];?>&offset=<?php echo $_GET["offset"] + $_GET["limit"];?>&sort=<?php echo $_GET["sort"];?>&dir=<?php echo $_GET["dir"];?>">Next&gt;&gt;</a>

-->        </caption>

        <tr>

                <th><?php SortLink(name,'Name');?></th>

                <th><?php SortLink(level,'Level','DESC');?></th>

                <th><?php SortLink('class','Class');?></th>

                </tr>

<?php flush(); ob_flush();?>        <tr>

                        <?php // CreateDropdown(name,character_);?>&nbsp;

                </td>

                <td>

                        <?php // CreateDropdown(level,character_);?>&nbsp;

                </td>

                <td>

                        <?php // CreateDropdown('class',character_);?>&nbsp;

                </td>

                </tr>

        </form>

<?php



if ($_GET["account_id"] != "") {

        $where = " WHERE account_id=" . $_GET["account_id"] . " ";

};

if (!isset($_GET["sort"]) || ($_GET["sort"] == "")) {

        $_GET["sort"] = "timelaston";

};

if (!isset($_GET["dir"]) || ($_GET["dir"] == "")) {

        $_GET["dir"] = "DESC";

};

$query1 = "SELECT name, class, level FROM character_" . $where . " ORDER BY " . $_GET["sort"] . " " . $_GET["dir"] . " ";

// Limit query if $_GET["limit"] is set

if ($_GET["limit"] != "") {

        $query1 .= " LIMIT " . $_GET["limit"] . " OFFSET " . $_GET["offset"] . " ";

};

$result1 = mysql_query($query1,$db);



// Display data if any found, message if none found



if ($db_row1 = mysql_fetch_array($result1)) {

        do {

                echo "\t<tr>

                <td><a href=\"../inventory/?id=" . $db_row1["id"] . "\">" . $db_row1["name"] . "</a></td>

                <td align=\"right\">" . $db_row1["level"] . "</td>

                <td>" . $Classes["{$db_row1["class"]}"] . "</td>

        </tr>\n";

        flush(); ob_flush();

        } while ($db_row1 = mysql_fetch_array($result1));

} else {

        echo "\t\t<td align=\"center\" colspan=\"11\">No records found</td>

        </tr>";

};



?>

</table>



<?php



include "../includes/footer.php";



?>



</body>



</html>

This works perfectly, it displays ID, character name, level, and class and links to magelo-like profile:

Code:

<head>



<title>EQ Emu - Character List</title>



<?php



$time_start = microtime(true);

include "../includes/constants.php";

include "../includes/functions.php";



if (!isset($_GET["limit"])) {

        $_GET["limit"] = 10;

};

if ((!isset($_GET["offset"]) || ($_GET["offset"] == ""))) {

        $_GET["offset"] = 0;

};



?>



</head>



<body>



<center><h1>Character List</h1></center>



<table align="center" border="1">

        <form method="GET" action="">

        <caption align="top" style="text-align:right">

                <?php CreateResultLimit();?>

<!--                <input type="text" size="1" name="limit" value="<?php echo $_GET["limit"];?>"> Per Page

                <input type="hidden" name="offset" value="<?php echo $_GET["offset"];?>">

                <input type="hidden" name="sort" value="<?php echo $_GET["sort"];?>">

                <input type="hidden" name="dir" value="<?php echo $_GET["dir"];?>">

                <a href="?limit=<?php echo $_GET["limit"];?>&offset=<?php if ($_GET["offset"] - $_GET["limit"] >= 0) {echo $_GET["offset"] - $_GET["limit"];};?>&sort=<?php echo $_GET["sort"];?>&dir=<?php echo $_GET["dir"];?>">&lt;&lt;Prev</a>&nbsp;

                <a href="?limit=<?php echo $_GET["limit"];?>&offset=<?php echo $_GET["offset"] + $_GET["limit"];?>&sort=<?php echo $_GET["sort"];?>&dir=<?php echo $_GET["dir"];?>">Next&gt;&gt;</a>

-->        </caption>

        <tr>

                <th><?php SortLink(id,'ID');?></th>

                <th><?php SortLink(name,'Name');?></th>

                <th><?php SortLink(level,'Level','DESC');?></th>

                <th><?php SortLink('class','Class');?></th>

                </tr>

<?php flush(); ob_flush();?>        <tr>

                <td align="right">

                        <?php // CreateDropdown(id,character_);?>&nbsp;

                </td>

                        <?php // CreateDropdown(name,character_);?>&nbsp;

                </td>

                <td>

                        <?php // CreateDropdown(level,character_);?>&nbsp;

                </td>

                <td>

                        <?php // CreateDropdown('class',character_);?>&nbsp;

                </td>

                </tr>

        </form>

<?php



if ($_GET["account_id"] != "") {

        $where = " WHERE account_id=" . $_GET["account_id"] . " ";

};

if (!isset($_GET["sort"]) || ($_GET["sort"] == "")) {

        $_GET["sort"] = "timelaston";

};

if (!isset($_GET["dir"]) || ($_GET["dir"] == "")) {

        $_GET["dir"] = "DESC";

};

$query1 = "SELECT character_.id, name, class, level FROM character_" . $where . " ORDER BY " . $_GET["sort"] . " " . $_GET["dir"] . " ";

// Limit query if $_GET["limit"] is set

if ($_GET["limit"] != "") {

        $query1 .= " LIMIT " . $_GET["limit"] . " OFFSET " . $_GET["offset"] . " ";

};

$result1 = mysql_query($query1,$db);



// Display data if any found, message if none found



if ($db_row1 = mysql_fetch_array($result1)) {

        do {

                echo "\t<tr>

                <td align=\"right\">" . $db_row1["id"] . "</td>

                <td><a href=\"../inventory/?id=" . $db_row1["id"] . "\">" . $db_row1["name"] . "</a></td>

                <td align=\"right\">" . $db_row1["level"] . "</td>

                <td>" . $Classes["{$db_row1["class"]}"] . "</td>

        </tr>\n";

        flush(); ob_flush();

        } while ($db_row1 = mysql_fetch_array($result1));

} else {

        echo "\t\t<td align=\"center\" colspan=\"4\">No records found</td>

        </tr>";

};



?>

</table>



<?php



include "../includes/footer.php";



?>



</body>



</html>

Thanks for all the help!

I finally made the jump to Google Code, so hopefully I'll make a few updates here every once in a while to make this a little more useful. If anyone is interested in contributing, feel free to send me a PM.

Quote:

Originally Posted by AndMetal (Post 159588)

This morning i spent doing a massive rehaul to this code to make it less exploitive (SQL injections are so abound it's frightening).

I'm cleaning up your constants.php to be more user friendly, and also make it so each feature can be turned on/off with a simple option inside it.
Going through and cleaning up tons of little options, I guess i'll PM you and see if you'd like to add me to your google SVN, even if your last post was over 9 months ago.