snoodle
07-12-2007, 11:54 PM
I'm confused (what else is new). I have a bunch of PHP files that begin with $q=$_GET["q"]; (for sql add, update, delete, fetch, etc), and a few that begin with $destfile=$_POST['destfile'];. So far, the only need for the POST PHP modules has been for doing AJAX file uploading.
So far I have 2 of these "upload" php modules. The first one uploads pict files, and inside the same php module a new file is created from the original, with new dimensions. That all works fine.
The 2nd upload module uploads a text file that I need to parse and extract data to be inserted into various tables in my database. My intention was to put that code in the same PHP file that is used for the upload. After the upload is done, "ProcessFile" is called to do all the MySQL updating. However, the mysql calls didn't work. I tried creating a new table ("test") and simply inserting some text into the table, but it wouldn't work. I moved the code into one of the other PHP files that started with $_GET instead of $_POST, and the same code worked fine.
So, I got around the problem by... from the javascript/ajax calling code, I wait for the file to be uploaded, then I ajax my way to another php file that uses $_GET and I'm able to do all the mysql'ing just fine.
My question is, is this some kind of weird security issue? What exactly is going on?
So far I have 2 of these "upload" php modules. The first one uploads pict files, and inside the same php module a new file is created from the original, with new dimensions. That all works fine.
The 2nd upload module uploads a text file that I need to parse and extract data to be inserted into various tables in my database. My intention was to put that code in the same PHP file that is used for the upload. After the upload is done, "ProcessFile" is called to do all the MySQL updating. However, the mysql calls didn't work. I tried creating a new table ("test") and simply inserting some text into the table, but it wouldn't work. I moved the code into one of the other PHP files that started with $_GET instead of $_POST, and the same code worked fine.
So, I got around the problem by... from the javascript/ajax calling code, I wait for the file to be uploaded, then I ajax my way to another php file that uses $_GET and I'm able to do all the mysql'ing just fine.
My question is, is this some kind of weird security issue? What exactly is going on?