Customising the checkout_success page

[glennnz]

Hi

I have added the following to my checkout_success.php page:

<?php
$code_link = mysql_connect('localhost', 'username', 'password');
if (!$code_link)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db ('database' , $code_link);
$zv_orders_id = (isset($_SESSION['order_number_created']) && $_SESSION['order_number_created'] >= 1) ? $_SESSION['order_number_created'] : $orders_id;
$code_ordered = mysql_query("SELECT products_id FROM orders_products WHERE orders_products_id ='".$zv_orders_id."'");
while($row = mysql_fetch_array($code_ordered))
{
echo $code_ordered;
echo " | ";
if ($code_ordered == "192")
{
$code_quantity = mysql_query("SELECT products_quantity FROM orders_products WHERE orders_products_id ='".$zv_orders_id."'");
while($row = mysql_fetch_array($code_quantity))
{
echo $code_quantity;
}
}
else
echo " | None orderd";
}
?>


It won't work. I can't get the $code_ordered and $code_quantity to show.

I've taken it down at the moment so my store is functioning again.

Thanks

Glenn

[glennnz]

OK, I have this partly working..

What I am trying to achieve is find out whether or not my customer has bought product no. 192, and if so, return the number of these that have been bought. I will then use this number to implement another php script

If there is only the 192 product in the transaction, it works fine, but if there are other products in the shopping cart, then it returns the other item.

I have the following code:

<?php
$code_link = mysql_connect('localhost', 'username', 'password');
if (!$code_link)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db ('database' , $code_link);
$zv_orders_id = (isset($_SESSION['order_number_created']) && $_SESSION['order_number_created'] >= 1) ? $_SESSION['order_number_created'] : $orders_id;
$code_ordered = mysql_query("SELECT products_id FROM orders_products WHERE orders_id ='".$zv_orders_id."'");
$code_ordered_result = mysql_fetch_row($code_ordered);
echo print_r ($code_ordered_result,TRUE);
if ($code_ordered_result [0] == "192")
{
$code_quantity = mysql_query("SELECT products_quantity FROM orders_products WHERE orders_id ='".$zv_orders_id."'");
while ($code_quantity_result = mysql_fetch_row($code_quantity))
echo $code_quantity_result[0];
}
else
echo "None ordered";
?>

Help would be appreciated!! I also have a question about the security. Do I need to secure the data being passed to and from my database, or is Zen-Cart doing that for me?

Thanks

Glenn

[DrByte]

You're getting bad results because you're not looping through the available records -- thus you're likely only ever seeing the first item in the order.
If you use the Zen Cart database abstraction layer, you may end up with less confusion between queries.

Instead of what you've done, try this:

$sql = "SELECT products_id, products_qty from orders_products where orders_id = " . $zv_orders_id;
$result = $db->Execute($sql);
while(!$result->EOF) {
  if ($result->fields['products_id'] == 192) {
    echo $result->fields['products_quantity'];
  }
  $result->MoveNext();
}

[glennnz]

Legend, thank you.

Is this correct, now I can take $result and do other things with it?

Also, is this data secure as it is transferred to and from the database?

Glenn

[DrByte]

Is this correct, now I can take $result and do other things with it?

The same way you echo out the data, you can use the same value(s) in whatever custom functions you desire to write.

Also, is this data secure as it is transferred to and from the database?

I'm not sure what you're referring to. In what way would the data not be secure?

[glennnz]

I'm not sure what you're referring to. In what way would the data not be secure?

This is a comment from a web developer friend:

You need to make sure you are properly escaping and sanitising any values received from the browser before building the database query, otherwise you will lose your data in no time due to SQL Injection.
http://phpsec.org/projects/guide/3.html#3.2

Please tell me you have register_globals OFF also.
http://phpsec.org/projects/guide/1.html#1.3

See http://phpsec.org/projects/guide/ and http://phpsec.org/projects/guide/3.html#3.1 also.

You need to ensure you spend the time to understand the security implications and/or seek professional advice otherwise your code might be compromised...

Glenn

[DrByte]

Zen Cart takes security matters very seriously. If a vulnerability is found, a patch is issued as soon as possible, usually the same day. The latest version of Zen Cart includes fixes to all known problems and has taken into consideration best-practices in programming to prevent security vulnerabilities.

Zen Cart already sanitizes (including escaping) data it collects and stores into the database; so a straight out-of-the-box install is already "secure" in that regard.


However, I can't speak to the safety of any contributions or addon modules you might install or any custom code you might write yourself though. Perhaps your web developer friend might be willing to help you understand security implications of any custom code you write.



As to Register Globals, that's up to you and your hosting company to work out for your particular server.

[availableusername]

I'm working on a checkout_success mod myself, and I just wanted to clarify something (if there is an answer). Shouldn't mods to zen pages be created as separate files and stored in the appropriate /includes/modules/pages/ folder? Just as with overrides in the custom language folders, I thought that page script enhancements should be done separately so that upgrades are not broken.

I've been assuming all along that the checkout_success.php code should not be altered directly. Please advise one way or the other..

Thank you to all in advance!!

[DrByte]

/includes/modules/xxxxx.php files can support overrides by placing the revised files in /includes/modules/TEMPLATENAME/xxxxx.php

/includes/modules/pages/ folders do not support overrides. Any edits to those files must be direct edits.

[glennnz]

I'm trying to use

echo "<form method=\"post\" action=\"" .$_SERVER['PHP_SELF']. "\">";

to run some php on the results from my form. This directs back to the product listing without executing my php, how can I fix this?

Glenn