Using php to generate an image

[ProgrammingFun]

Hi,

I have to create a voting system for my school for which I need to output an image version of the table shown at http://test.victoriaparkci.com/poll2/
Is there any way that PHP can do such a thing? If so, how? Online tutorials were of no help for a noob like me

Thanks for the help.

[Sur_real]

Don't worry, I don't think there is such a thing.
Although you can do some research on imagegrabscreen or imagegrabwindow. Personally, I never bothered with them so dunno if they work.

I would just recommend doing it the old fashion way and create the image using PHP on-the-fly.

[Tony]

Sur_real @ Tue Feb 22, 2011 9:17 pm wrote:

Don't worry, I don't think there is such a thing.

Sorry, here it is

ImageMagick -- with bindings for just about everything, including PHP; http://www.imagemagick.org/script/api.php?ImageMagick=ea73rvnl8squ11fae2soiqitb2#php

[Sur_real]

O gawd how embarrassing
never heard of imagick but it does seem more comprehensive than GD (if they're even comparable). I wonder why I never found this before or was ever taught it...

[ProgrammingFun]

Thanks...on a related note, I want the following script to run before the page is redirected buy I keep getting an error:

PHP:

<?php session_start(); $_SESSION['visit'] += 1; $hacker = $_SESSION['visit']; if($hacker < 2){ if($_GET['vote'] == 'Vote'){ ?> <?php $con_v = mysql_connect(/** password, host and user removed ~dan */); $db = mysql_select_db("victori_practice",$con_v); $ans_array= $_GET['song']; for ($i=0; $i<count($ans_array); $i++) {   $q = mysql_query("SELECT Vote FROM hardwork WHERE id=$ans_array[$i]");     $v = mysql_fetch_array($q);   $count = $v['Vote'] + 1;   mysql_query("UPDATE hardwork SET Vote=$count WHERE id = $ans_array[$i]"); } $result = mysql_query("SELECT * FROM hardwork"); $total = 0; while($arr = mysql_fetch_array($result)){   $total += $arr['Vote']; } $result = mysql_query("SELECT * FROM hardwork"); while($arr2 = mysql_fetch_array($result)){   $perc = $arr2['Vote']/$total;   $perc *= 100;   mysql_query("UPDATE hardwork SET Percentage=Vote*100/$total"); } header('Location: http://test.victoriaparkci.com/poll2/results.php'); mysql_close($con_v); ?> <?php } ?>

ERROR wrote:

Warning: Cannot modify header information - headers already sent by (output started at /hsphere/local/home/victoria/test.victoriaparkci.com/poll2/process.php:10) in /hsphere/local/home/victoria/test.victoriaparkci.com/poll2/process.php on line 39

What am I doing wrong? I can't find any echos before the code so I do not think that that is the problem.

[Tony]

Quote:

output started at ... [line]:10

code:

?> <?php

whitespace is sending some response.

[ProgrammingFun]

Thanks!
I now get the following error:

ERROR wrote:

Parse error: syntax error, unexpected $end in /hsphere/local/home/victoria/test.victoriaparkci.com/poll4/process.php on line 44

PHP:

<?php session_start(); $_SESSION['visit'] += 1; $hacker = $_SESSION['visit']; if($hacker < 2){ if($_GET['vote'] == 'Vote'){ ?> <?php $con_v = mysql_connect(/* Password, host and user removed ~dan*/); $db = mysql_select_db("victori_practice",$con_v); $ans_array= $_GET['song']; for ($i=0; $i<count($ans_array); $i++) {   $q = mysql_query("SELECT Vote FROM hardwork WHERE id=$ans_array[$i]");     $v = mysql_fetch_array($q);   $count = $v['Vote'] + 1;   mysql_query("UPDATE hardwork SET Vote=$count WHERE id = $ans_array[$i]"); } $result = mysql_query("SELECT * FROM hardwork"); $total = 0; while($arr = mysql_fetch_array($result)){   $total += $arr['Vote']; } $result = mysql_query("SELECT * FROM hardwork"); while($arr2 = mysql_fetch_array($result)){   $perc = $arr2['Vote']/$total;   $perc *= 100;   mysql_query("UPDATE hardwork SET Percentage=Vote*100/$total"); } header('Location: http://test.victoriaparkci.com/poll2/results.php'); mysql_close($con_v); ?> <?php } ?>

[Tony]

You should probably start

Quote:

on line 44

and work backwards from there.

[Sur_real]

I hope those parameters of mysql_connect are not what I think they are...

[Tony]

Who cares about SQL injection vulnerabilities when the DB credentials are posted in plaintext

[ProgrammingFun]

Tony @ Wed Feb 23, 2011 9:35 pm wrote:

You should probably start

Quote:

on line 44

and work backwards from there.

I still don't understand...I am very new to PHP and this is my very fist time using it...

Tony @ Wed Feb 23, 2011 10:00 pm wrote:

Who cares about SQL injection vulnerabilities when the DB credentials are posted in plaintext

Is that a very big problem?
Can all databases on the server be hacked thru that?

Is there any way to make it more secure?

[Dan]

Quote:

Is that a very big problem?
Can all databases on the server be hacked thru that?

Is there any way to make it more secure?

Thats a very big problem. For exmaple i was able to login and view your database:

code:

mysql> show databases; +------------------+ | Database         | +------------------+ | victori_practice | +------------------+ 1 row in set (0.18 sec) mysql> show tables; +----------------------------+ | Tables_in_victori_practice | +----------------------------+ | hardwork                   | +----------------------------+ 1 row in set (0.03 sec)

I (or any one else who viewed this page) could delete everything in their, including the hole table or database. You need to change your password ASAP. Also consider limiting access to localhost (or where ever your site is hosted).

Secondly their is a sql injection vunerablity in this line:

code:

$q = mysql_query("SELECT Vote FROM hardwork WHERE id=$ans_array[$i]");

and possiblly

code:

mysql_query("UPDATE hardwork SET Vote=$count WHERE id = $ans_array[$i]");

For more info on sql injections see http://en.wikipedia.org/wiki/SQL_injection

[Tony]

Dan @ Wed Feb 23, 2011 10:20 pm wrote:

Also consider limiting access to localhost

It appears the the database and php are running on different servers.

[Dan]

Tony @ 23rd February 2011, 10:30 pm wrote:

Dan @ Wed Feb 23, 2011 10:20 pm wrote:

Also consider limiting access to localhost

It appears the the database and php are running on different servers.

Quote:

(or where ever your site is hosted).

mySQL should let you limit access to a set of hosts by ip or hostname.

[ProgrammingFun]

EDIT: NVM, I fixed everything to some extent. Thanks for the help!

Thanks for telling me that!
Can someone please edit my earlier posts to remove the sensitive information?

I still don't understand how I can fix the problem with line 44, if I remove that block, it says error on line 41. What am I doing wrong?

And how can I fix the SQL injection problem?
Sorry for all the noob questions.