Data is lost due to xss_clean in CI 3.x - codeigniter

In CI 3.x, I am cleaning the data before submitting it to database using the following line of code:
public function __construct() {
$this->CI =& get_instance();
}
public function cleanData($data) {
$data = trim($data);
$data = $this->CI->security->xss_clean($data);
$data = html_escape($data);
$data = strip_tags($data);
return $data;
}
Things work fine most of the times but today, while trying to store the following value in database, I get nothing but an empty string in result:
However, the Google Translate Plugin that they are using is not
permanent and was recently taken off by google and its 100% accuracy
is not guaranteed
On removing xss_clean, I get the data. Why xss_clean is making this line of data empty?

Related

Laravel api - how to upload file

I am building a web service for mobile application using Laravel. I need to let the users to upload images. I am using passport package. In developing environment I created a function store as follows
public function store(Request $request)
{
return $request;
}
and using Firefox poster I post contents. These are the parameters
The problem is the function store always returns empty array while I expect it to return information about the file. What is wrong here?
thanks
I found it. Firefox Poster has problems with this. I used Chrome Postman. I removed all the headers and set a key for file. as follows
it is header
and this is the code
public function store(Request $request)
{
$file = $request->file('image');
return $file->getClientOriginalExtension();
}
Returning $request will not work. If you want to check if the file exists, try return $request->allFiles()

Loading view inside a Library, issues with cached vars

I am trying to implement a widgets library using load->view. I know I can use include to call directly the file and avoid the vars cache issues but just wondering why it does not work.
Here is how I have structured my code:
My Controller:
class Page extends MY_Controller {
public $data = array();
public function __construct() {
parent::__construct();
...
$this->load->library('widgetmanager');
}
public function index($slug = '') {
echo $this->widgetmanager->show(2);
echo $this->widgetmanager->show(1);
}
}
My Library
class WidgetManager
{
private $CI;
public function __construct()
{
$this->CI = & get_instance();
}
public function show($widget_id) {
$data = array();
$widget_id = (int)$widget_id;
$this->CI->db->select('*');
$this->CI->db->from('widget');
$this->CI->db->where('id', $widget_id);
$query = $this->CI->db->get();
$item = $query->row_array();
$data['widget_title'] = $item['title'];
$data['widget_content'] = $item['content'];
$widget = $this->CI->load->view('widget/'.$item['source'], $data, TRUE);
$data['widget_title'] = '';
$data['widget_content'] = '';
$this->CI->load->view('widget/'.$item['source'], $data);
return $widget;
}
}
widget 1: Calls widget/content
widget 2: Calls widget/banner
What is happening is, the vars set on the first widget call (they are same name as second widget call), get cached, meaning values from the first call are passed to same call. It is weird because are different views.
I have tried:
Using clear_vars(): $this->CI->load->clear_vars(), before and after doing load->view on the library.
Calling load->view with empty array, null, etc
Tried to add a prefix with the widget slug to the vars (that works, but I have to send in some way the prefix to the view, so it is not possible due cache issue)
Any ideas?
Here is what should work.
(I took the liberty of simplifying your database call making it require much less processing.)
public function show($widget_id)
{
$data = array();
$widget_id = (int) $widget_id;
$item = $this->CI->db
->get_where('widget', array('id' => $widget_id))
->row_array();
$data['widget_title'] = $item['title'];
$data['widget_content'] = $item['content'];
$widget = $this->CI->load->view('widget/'.$item['source'], $data, TRUE);
//clear the cached variables so the next call to 'show()' is clean
$this->CI->load->clear_vars();
return $widget;
}
On further consideration The call $this->CI->load->clear_vars(); is probably pointless because each time WidgetManager::show() is called the $data var is recreated with exactly the same keys. When the $data var is passed to load->view the new values of $data['widget_title'] and $data['widget_content'] will replace the values in the cached vars using those keys.

Call multiple stored procedures from Codeigniter last result contains the previous

I'm using this library in Codeigniter to retrieve multiple result sets from stored procedures :
class Multi_Results
{
private $CI, $Data, $mysqli, $ResultSet;
/**
* The constructor
*/
function __construct()
{
$this->CI =& get_instance();
$this->Data = '';
$this->ResultSet = array();
$this->mysqli = $this->CI->db->conn_id;
}
public function GetMultiResults($SqlCommand)
{
/* execute multi query */
if (mysqli_multi_query($this->mysqli, $SqlCommand)) {
$i=1;
do
{
if ($result = $this->mysqli->store_result())
{
while ($row = $result->fetch_assoc())
{
$this->Data[$i][] = $row;
}
mysqli_free_result($result);
}
$i++;
}
while ($this->mysqli->more_results() && $this->mysqli->next_result());
}
return $this->Data;
}
}
I'm calling the procedure from the controller like
$result_array = $this->multi_results->GetMultiResults("CALL procedure_name($input_1, '$input_2')");
It does what it is supposed to do. The problem arises when I call 2 DIFFERENT procedures from the controller one after another and assign the results to different variables.
When I var_dump the second (last) result, it contains also the result set from the 1st result.
I have checked the connection dbdriver in database.php (it is set to MSQLI), I tried to implement some suggestions like :
CodeIgniter active records' problems calling multiple stored procedures and Calling a stored procedure from CodeIgniter's Active Record class
They both propose a solution with 'mysqli_free_result' however that is already done in the addon library (as you can see in the code snippet above).
Any suggestion will be highly appreciated!
Initiate $this->data = '' into the function GetMultiResults() instead into constructor.
I think this will solve your problem.

Codeigniter and Set Session in Model

I want to unset and set session in model function depend on passed id.
I have language field for every record and should change session considering that.
in sample word i have a link like this : http://www.mysite.com/report/2020
now this article by this id maybe saved by english language but current session is french.so I should change the session.
here is my code but it dos not work.
//function for checking language by id
public function lang($id)
{
$data = $this->db
->select('language')
->from('content')
->where('id',$id)
->get();
if ($data->num_rows > 0) {
return $data;
}else{
return false;
}
}
//function for reading data from db depend on id and language
public function report($id)
{
$cat=2;
$code=$id;
$langu= $this->lang($id)->row()->language;
if($langu==3){
$this->session->unset_userdata('lang');
$this->session->set_userdata('lang','dr');
}
if($langu==2){
$this->session->unset_userdata('lang');
$this->session->set_userdata('lang','pa');
}
if($langu==1){
$this->session->unset_userdata('lang');
$this->session->set_userdata('lang','en');
}
$language= $this->session->userdata('lang');
$lang=$language;
$data = $this->db
->select('*')
->from('content')
->where('category',$cat)
->where('language',$lang)
->where('id',$code)
->get();
if ($data->num_rows > 0) {
return $data;
}else{
return false;
}
}
the best way to session is:
you have to check the query in model, and call the model in controller, if its true set session data within controller....
Setting Session within the model is not a good idea for an MVC architecture.
Sometimes there is really need to set or get session data in model.
Use then Code Igniter instance like below:
$codeIgniter =& get_instance();
$codeIgniter->set_userdata('data', $data);
// or to read data:
$data = $codeIgniter->userdata('data');
Note that using $this to call set_userdata() or userdata() in model will not work correctly.

CodeIgniter Sql syntax not working

Okay here i am, be direct i need some advice
so here i have some code igniter problem with "Database", this is the code
$as="&";
$string1="title=";
$a= $this->input->post('title');
$string2="category=";
$b= $this->input->post('category');
$string3="length_comparison=";
$c= $this->input->post('length_comparison');
$string4="length=";
$d= $this->input->post('length');
$combine=$string1.$a.$as.$string2.$b.$as.$string3.$c.$as.$string4.$d;
$this->db->select('*');
$this->db->from('ci_query');
$this->db->where('ci_query.query_string',$combine);
$query = $this->db->get();
$rows=$query->result();
$count=0;
foreach($rows as $row)
{
$count=$count+1;
$query_id = $row->id;
}
if($count==0)
{
$query_id = $this->input->save_query($query_array);
}
redirect("films/display/$query_id");
Here is the logic
1. i got an input from a search form tittle,category,length_comparison,and length.
2. first case these logic will save all those input into a column in a table, all in 1 column, if there is no same parameter
"tittle,category,length_comparison,and length" in the table.
3. but if there is any same parameter it will not insert to the table, and just redirect to the page i choose
4. from the table we got the id and display instead of using long query string. display the search result.
My problem :
i've done the coding and it's work perfectly in my computer/pc. but when i use my laptop it's just doesn't work, anyone can give me some advice ? or my coding? or ci version? or what?
Update :
i think that is not the problem since i've override the lib, so i have this to use that function
function save_query($query_array) {
$CI =& get_instance();
$CI->db->insert('search', array('query_string' => http_build_query($query_array)));
return $CI->db->insert_id();
}
function load_query($query_id) {
$CI =& get_instance();
$rows = $CI->db->get_where('search', array('id' => $query_id))->result();
if (isset($rows[0])) {
parse_str($rows[0]->query_string, $_GET);
}
}
}
You need to use:
if($count==0)
{
$this->db->insert('ci_query', array('query_string' => $combine));
$query_id = $this->db->insert_id();
}
That way you are inserting the correct data, and you are reading the correct ID from the database.

Resources