Originally Posted by
ParallelLogic
Do you think I could get away with sending:
05f7ed476be430707109="ParallelLogic"
8311ac1c525b03a71ac5="TEST TITLE"
body="MESSAGE"
through the Java method you linked to?
From the form source, the message should be stored in "notebody", not "body". As for the other fields, they might be dynamically generated when the page is, in which case the above probably won't work. What your applet would need to do is request the page, parse it and extract the field names, then use that info to construct a message for the form handler. Depending on how you design your classes, it's not as bad as it sounds.
Originally Posted by
ParallelLogic
Do you know how I would send multiple variables through the Java method? Would I just use multiple write commands? The example only shows a single variable "string" that is being assigned, when compared to the three variables I'm working with.
It depends on what content type you're using. I believe the default is "application/x-www-form-urlencoded" (if not, you can explicitly set the Content-type header), which requires sending the data as a URL-encoded query string:
Code:
OutputStreamWriter out = new OutputStreamWriter(
connection.getOutputStream());
HashMap<String,String> vars = new HashMap<String,String>;
out.write("05f7ed476be430707109 =" + URLEncode.encode(recipients, "UTF-8")
+"&8311ac1c525b03a71ac5=" + URLEncode.encode(subject, "UTF-8")
+"¬ebody=" + URLEncode.encode(message, "UTF-8"));
For binary data and files, there's the multipart/form-data type.
Of course, you'll want to have a class that handles POST-ing form data to abstract away the HTTP details. Something like the following, which stores the form variables & values in a HashMap.
Code:
class HTTPForm {
protected HashMap<String, String> vars;
protected string url;
...
HTTPForm(URL url) {
this.url = url;
vars = new HashMap<String, String>();
}
HTTPForm(String url) {
this.(new URL(url));
}
HTTPForm(URL url, HashMap<String, String> vars) {
this.url = url;
this.vars = vars.clone();
}
public setVar(name, val) {
vars.put(name, val);
}
public setURL(URL url) {
this.url = url;
}
public static encode(HashMap<String, String> vars) {
StringList varPairs = new StringList();
vairPairs.ensureCapacity(vars.size());
for (Map.Entry<String,String> var: vars.entrySet()) {
varPairs.add(URLEncoder.encode(var.getKey() + '=' + var.getValue(), "UTF-8"));
}
return vairPairs.join("&");
}
public boolean send() {
send(url, vars);
}
public static send(URL url, HashMap<String, String> vars) {
String data = encode(vars);
URLConnection connection = url.openConnection();
connection.setDoOutput(true);
OutputStreamWriter out = new OutputStreamWriter(
connection.getOutputStream());
out.write(data);
out.close();
// now get & parse the response
// ...
}
}
....
// send like this:
msgHandlerURL=new URL("http://foospace.com/user/"+uid+"/send");
vars = new HashMap<String, String>();
vars.put('05f7ed476be430707109', recipients);
vars.put('8311ac1c525b03a71ac5', subject);
vars.put('notebody', message);
HTTPForm.send(msgHandlerURL, vars);
// or this:
HTTPForm msgForm = new HTTPForm(msgHandlerURL);
msgForm.setVar('05f7ed476be430707109', recipients);
msgForm.setVar('8311ac1c525b03a71ac5', subject);
msgForm.setVar('notebody', message);
msgForm.send();
You can easily overload the methods that take a URL to take a String, like the constructor HTTPForm(String).
If you want to examine interface designs, check out some of the interfaces for client-side SOAP and XML-RPC, though nothing beats Python's xmlrpclib, which turns native method calls into XML-RPC calls. It's pretty damn sweet.
Originally Posted by
ParallelLogic
Actually, after some experimentation, it seems I can't even connect with the notes system (for sending messages from one user to another -- I wouldn't be able to get the page source code I pasted above)) through Java, so I guess that's a moot point unless there's something I'm missing (I'm guessing Java can't handle the necessary cookies to be a virtual logged-in user?)
You have to take care of logging in and setting cookies yourself. See java.net.CookieHandler and a Java-and-Cookies how-to or two. Again, with a good design, it can all be quite simple to use and fairly simple to write.
Originally Posted by
ParallelLogic
One thing I've been somewhat curious about is when we were talking on another page
http://forums.x10hosting.com/program...tml#post554241 about privacy and protection, it was mentioned that setting a PHP page to protection 0600 would keep average users from being able to access it to get the password -- but there was still some odd way to access the password potentially. I'm wondering if it might be possible to have the Java app send the PHP file the password so that way the password has to be known before being able to sign on as a user of the MySQL database.
Mode 0600 keeps local users from reading the source code. For the most part, permissions won't apply in securing the file from remote users, as they won't be able to read the source directly. Note that another local user's website might have a security hole that allows reading arbitrary files, in which case mode 0600 will protect your script from that hole.
As for odd ways of accessing the password, imagine somehow a local user couldn't read the script but found a way to include it from another script (they couldn't, but imagine they could), or imagine that a visitor could somehow inject PHP code and get it interpreted (possible, but very unlikely), or suppose there's an exploit you haven't even thought of that lets a user get programmatic access to the script. A global variable or constant would be accessible in any of those cases. Take a page from OOP, the one that covers encapsulation and information hiding, to restrict programmatic access. You can use scope (storing the password as a local function variable) or visibility (storing the password in a private instance variable) to achieve information hiding. Of course, we still haven't addressed memory dumps, though only the superuser should be able to access the memory of other users' processes.
Originally Posted by
ParallelLogic
Originally Posted by
misson
Are you sure the query stops?
Well, what happens is I send in the query and have the PHP code echo all the results. The results stop getting sent back after the bad character.
Be sure to check the page source or have the PHP script output plain text rather than HTML (after setting the Content-type header). Does the DB driver error function (eg mysql_error, mysqli::error) report anything? A "<" shouldn't matter to MySQL, but it will matter to an HTML processor. Also check the size of the description field in the table. If you only checked one entry, it's possible the occurrence of the "<" is a coincidence and the value is being clipped due to size.
Originally Posted by
ParallelLogic
You mentioned FILTER_SANITIZE_SPECIAL_CHARS but that doesn't remove 'and " , I'm guessing I should also use FILTER_FLAG_ENCODE_HIGH ?
Use something like filter_var() with the FILTER_SANITIZE_SPECIAL_CHARS filter to handle HTML and prevent XSS, but also use prepared statements or a DB string escape function to prevent SQL injection.
LinkBack URL
About LinkBacks
Suggestions for best way to build a MySQL table from raw data?
Reply With Quote
. The problem is that I don't know the post codes (I also didn't know how to post directly either, so thank you for that link as well); I don't know how what varibles to post to...
