Member Avatar for MatthewYeend

Basically, I need to make a database viewing page and an input pag... The input page must take the First name, Surname, and the age. This should be sent to a script on your server via either a GET or POST, and inserts them into a MySQL database table. This must be secure against SQL injection. The display page should be generated by another script that pulls out everything from the table, creates a HTML table, and displays it. You may use either apache or Nginx, but any scripting language can be used. Also it's for linux.

Thanks for your help :D

  • 3 Contributors
  • 3 Replies
  • 355 Views
  • 4 Weeks Discussion Span
  • Latest Post Latest Post by been.coerced

Dani AI

Generated

A short, practical plan to get this working and secure (keeps and in mind): use a simple LAMP stack and PHP with PDO for parameterized queries, or CGI/perl if preferred. Break the task into three steps: (1) create a small MySQL table and a restricted DB user, (2) an HTML form that submits via POST to an insert script, and (3) a display script that selects rows and renders an HTML table with proper escaping.

Example minimal schema (create once):

CREATE TABLE people (
  id INT AUTO_INCREMENT PRIMARY KEY,
  first_name VARCHAR(50) NOT NULL,
  surname VARCHAR(50) NOT NULL,
  age TINYINT UNSIGNED NOT NULL
);

Security and validation notes: give the web app its own DB user with only INSERT/SELECT on that table; always use prepared statements (PDO or mysqli) to prevent SQL injection; validate server-side (trim, length limits, ctype_digit or filter_var for age) and cast to an integer before inserting; escape output with htmlspecialchars() when building the HTML table to prevent XSS; prefer POST for inserts and consider a CSRF token for completeness.

Minimal PHP patterns to follow (outline, not full app):

$pdo = new PDO('mysql:host=localhost;dbname=mydb;charset=utf8mb4', 'appuser', 'secret');
$stmt = $pdo->prepare('INSERT INTO people (first_name,surname,age) VALUES (:f,:s,:a)');
$stmt->execute([':f'=>$first,':s'=>$surname,':a'=>intval($age)]);

and for viewing:

$rows = $pdo->query('SELECT first_name,surname,age FROM people')->fetchAll(PDO::FETCH_ASSOC);
// loop rows and echo table cells wrapped with htmlspecialchars()

Common gotchas: file ownership/permissions for the webserver user, wrong DB credentials, missing PHP MySQL driver, and forgetting to escape output (XSS). This approach gives a minimal, auditable solution that meets the assignment goals while avoiding unsafe concatenated SQL.

Recommended Answers

All 3 Replies

Member Avatar for rubberman

Sorry, but we don't do your homework for you. Give it your best shot and post the code here with questions about problems you are still having. FWIW, I do this stuff for a living. Why should I help you cheat on your homework when I have had to learn this stuff the hard way, by doing it?

Member Avatar for MatthewYeend

I'm just struggling on where to start with it, I can do it once I've started, just finding hard to find where to start

Member Avatar for been.coerced

Read up on CGI (Common Gateway Interface), else check on PHP, perl etc. that might be embedded into the webserver of choice.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.