To add waybill search page. Please help!

[jay2015]

My zencart 1.5.4 with english and chinese.

I would like to add a waybill search text box at a page and side box. So my customers (or their customers) will be able to check the parcel status directly only input waybill No. without login their account. I'm using the orders_status_history data from my zencart database.

Since my company is a logistics company, I can only use our own database. I removed all checkout functions and products displaying. And I installed modeules:edit orders, admin new order, ty package tracker and super orders. I've made a separated page that is able to call the status and status comment when I input the correct waybill no. But when I add it at the define_page_2.php it failed!! I really don't know how to make it at page_2 and side box.

For the way bill no., I first input it by using ty package tracker, then there is a waybill no. record at "tracker_id". Then I use the following code to find the related order_id, and then show all of its orders status and comments.

<?php
mysql_connect("localhost","root","") or die("could not connect");
mysql_select_db ("testsite01") or die ("could not find db!");
mysql_query("SET NAMES 'UTF8'");
?>



<?php
$output = '';
$output2 ='';

//collect
if (!empty($_POST['wbsearch'])){
	$wbsearchq = $_POST['wbsearch'];
	$wbsearchq = preg_replace("#[^0-9a-z]#i","",$wbsearchq);
	$query = mysql_query("SELECT * FROM orders_status_history WHERE orders_status_history.track_id3 = '$wbsearchq' ")
	or die("No such waybill record.");
	$count = mysql_num_rows($query);
	if ($count == 0 ){
		$output = 'Could not find waybill no:'.$wbsearchq.' result!';	
	}else{
		while ($row = mysql_fetch_array($query)) {
			$order_id = $row['orders_id'];
			$date = $row['date_added'];
			$output.='<h3><div>waybill no:'.$wbsearchq.'tracking result:</div></h3>';
			
		}
		$query2 = mysql_query("SELECT * FROM orders_status_history inner join orders_status on orders_status_history.orders_status_id=orders_status.orders_status_id AND (orders_status.language_id=3) AND (orders_status_history.orders_id=38) ORDER BY date_added DESC")or die("No such waybill result.");
$count2 = mysql_num_rows($query2);
	if ($count2 == 0 ){
		$output2 = 'No result!';	
	}else{
		while ($row2 = mysql_fetch_array($query2)) {
			$date = $row2['date_added'];
			$createDate = new DateTime($date);
			$stripDate = $createDate->format('Y-m-d');
			$status = $row2['orders_status_name'];
			$comments = $row2['comments'];
			$output2.='<div>'.$stripDate.':&nbsp&nbsp'.$status.',&nbsp'.$comments.'</div>';
			
		}
		
	}
		
	}
	
}

?>


<form action="try3.php" method="post" >
  <input type="text" name="wbsearch" placeholder="Search for waybill no..." />
  <input type="submit" value=">>" />
</form>

<?php print("$output"); 



print ("$output2"); ?>

Could someone tell me how to do? Thank you very much!

[jay2015]

I've made a new page placing at the root directory. I can connect to server with the basic scripts as following.

mysql_connect("localhost","root","") or die("could not connect");
mysql_select_db ("testsite01") or die ("could not find db!");

But there should be security problem. How do I connect by using zencart connecting function? I've replaced the above scripts to

require('includes/application_top.php');

But I cannot call the data from database.

Could someone tell me what to do?

Thank you.

[mc12345678]

Would need more information to be able to assist.

What is it about this "new page" that it is to be in the root of your store? Why is it not a page loaded by zen cart as a main_page=new_page?

What data are you trying to obtain and what have you tried so far?

[jay2015]

Would need more information to be able to assist.

What is it about this "new page" that it is to be in the root of your store? Why is it not a page loaded by zen cart as a main_page=new_page?

What data are you trying to obtain and what have you tried so far?

Thank you for your assistance!

My purpose is to search waybill number in (new page, i.e. page 1) and using sidebox. I've installed ty tracker, so I can input carrier waybill number to the relative order. I would like to search the order status result just using that waybill number and no need login.

By now, I've embedded the following code to define_page_1:

<?php
mysql_connect("localhost","root","") or die("could not connect");
mysql_select_db ("testsite01") or die ("could not find db!");
mysql_query("SET NAMES 'UTF8'");
?>


<?php

$output = '';
$output2 ='';

//collect
if (!empty($_POST['p1_wbsearch'])){
	$wbsearchq = $_POST['p1_wbsearch'];
	$wbsearchq = preg_replace("#[^0-9a-z]#i","",$wbsearchq);
	$query = mysql_query("SELECT * FROM orders_status_history WHERE orders_status_history.track_id3 = '$wbsearchq' ")
	or die("Cannot access database!");
	$count = mysql_num_rows($query);
	if ($count == 0 ){
		$output = 'Waybill number '.$wbsearchq.'not found!';	
	}else{
		while ($row = mysql_fetch_array($query)) {
			$order_id = $row['orders_id'];
			$date = $row['date_added'];
			$output.='<h3><div>Waybill number:'.$wbsearchq.'tracking result:</div></h3>';
			
		}
		$query2 = mysql_query("SELECT * FROM orders_status_history inner join orders_status on orders_status_history.orders_status_id=orders_status.orders_status_id AND (orders_status.language_id=3) AND (orders_status_history.orders_id=38) ORDER BY date_added DESC")or die("Cannot access database!");
$count2 = mysql_num_rows($query2);
	if ($count2 == 0 ){
		$output2 = 'No record found!';	
	}else{
		while ($row2 = mysql_fetch_array($query2)) {
			$date = $row2['date_added'];
			$createDate = new DateTime($date);
			$stripDate = $createDate->format('Y-m-d');
			$status = $row2['orders_status_name'];
			$comments = $row2['comments'];
			$output2.='<div>'.$stripDate.':&nbsp&nbsp'.$status.',&nbsp'.$comments.'</div>';
			
		}
		
	}
		
	}
	
}

?>


<form action="index.php?main_page=page_1" method="post" >
  <input type="text" name="p1_wbsearch" placeholder="Search for waybill no..." />
  <input type="submit" value=">>" />
</form>

<?php 
	print("$output"); 
	print ("$output2"); 
?>

And I create a php file by using the above code and place it at root directory. I just change the input text name "p1_wbsearch" to "wbsearch" and form action move to submit. Then when I submit data, the side box will not display the result at the same time.

<form action="" method="post" >
  <input type="text" name="wbsearch" placeholder="Search for waybill no..." />
  <input type="submit" value=">>" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>"/>
</form>

Then I 'require' this php file in includes/modules/sideboxes/mytemplate/blank_sidebox.php

Below please find the images

Even I can call the data from database, I do know there is security problem as I put the id,password,database name in a page. But I really don't know how to make it to just load the login information in config.php.


Could you please tell me how to fix it?
Thank you for your help!

[mc12345678]

There's a lot that I would suggest to be done differently with this process. I haven't gone line for line on the code and I haven't evaluated the impact of code like this where such results are provided to identify the potential security issues involved with what is returned. But, it definitely looks like you need some assistance in how to access the data of ZC using the accessors already incorporated in it.

As to the page being updated while the user presses buttons (assuming that the page is not reloaded when they press the button), that would require javascript, jQuery, or similar...

So after you have require('includes/application_top.php');

Here are some things regarding queries.

The database is referenced as $db. You can execute a query ($db->Execute($sql); ) with the result returned to a variable: $result = $db->Execute($sql);.
In a select query, the results of the query are stored into the fields array of the $result: $result->fields['products_id'] would be the value of products_id for the current query result. To go to the next record, need to MoveNext() such as $result->MoveNext().

If the current record is the last record (or in the case of a query returning no results) then $result->EOF is true. It is also expected to be true that when a query returns no results that the RecordCount() == 0 such as $db->RecordCount() = 0

In ZC 1.5.4 and below, in order to go through all of the records of a query use the while(!$result->EOF) { //perform action;
$result->MoveNext();
}
routine.

See one of the reasons your code has a problem is that it is using mysql_ functions instead of mysqli_ as used by ZC 1.5.4. But by using the above accessor related functions, it doesn't matter what type of database is associated with the program, the code takes care of it.

I would almost say that your code could/should be in either a module or a separate function. But would not suggest that it be at the root of the store even if/with a check to be sure that the code is called from an active session from ZC.

[jay2015]

I really appreciate your help!

I'm just start learning PHP, I'm not exactly know how to modify it
But I'll keep searching some related topics and try to modify it by following your guideline.

Do you mean after I've require('includes/application_top.php') then it will connect to the ZC database and I can call the data by changing to mysqli_?

Thanks

[mc12345678]

Thank you for your assistance!

My purpose is to search waybill number in (new page, i.e. page 1) and using sidebox. I've installed ty tracker, so I can input carrier waybill number to the relative order. I would like to search the order status result just using that waybill number and no need login.

By now, I've embedded the following code to define_page_1:

<?php
mysql_connect("localhost","root","") or die("could not connect");
mysql_select_db ("testsite01") or die ("could not find db!");
mysql_query("SET NAMES 'UTF8'");
?>


<?php

$output = '';
$output2 ='';

//collect
if (!empty($_POST['p1_wbsearch'])){
    $wbsearchq = $_POST['p1_wbsearch'];
    $wbsearchq = preg_replace("#[^0-9a-z]#i","",$wbsearchq);
    $query = mysql_query("SELECT * FROM orders_status_history WHERE orders_status_history.track_id3 = '$wbsearchq' ")
    or die("Cannot access database!");
    $count = mysql_num_rows($query);
    if ($count == 0 ){
        $output = 'Waybill number '.$wbsearchq.'not found!';    
    }else{
        while ($row = mysql_fetch_array($query)) {
            $order_id = $row['orders_id'];
            $date = $row['date_added'];
            $output.='<h3><div>Waybill number:'.$wbsearchq.'tracking result:</div></h3>';
            
        }
        $query2 = mysql_query("SELECT * FROM orders_status_history inner join orders_status on orders_status_history.orders_status_id=orders_status.orders_status_id AND (orders_status.language_id=3) AND (orders_status_history.orders_id=38) ORDER BY date_added DESC")or die("Cannot access database!");
$count2 = mysql_num_rows($query2);
    if ($count2 == 0 ){
        $output2 = 'No record found!';    
    }else{
        while ($row2 = mysql_fetch_array($query2)) {
            $date = $row2['date_added'];
            $createDate = new DateTime($date);
            $stripDate = $createDate->format('Y-m-d');
            $status = $row2['orders_status_name'];
            $comments = $row2['comments'];
            $output2.='<div>'.$stripDate.':&nbsp&nbsp'.$status.',&nbsp'.$comments.'</div>';
            
        }
        
    }
        
    }
    
}

?>


<form action="index.php?main_page=page_1" method="post" >
  <input type="text" name="p1_wbsearch" placeholder="Search for waybill no..." />
  <input type="submit" value=">>" />
</form>

<?php 
    print("$output"); 
    print ("$output2"); 
?>

And I create a php file by using the above code and place it at root directory. I just change the input text name "p1_wbsearch" to "wbsearch" and form action move to submit. Then when I submit data, the side box will not display the result at the same time.

<form action="" method="post" >
  <input type="text" name="wbsearch" placeholder="Search for waybill no..." />
  <input type="submit" value=">>" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>"/>
</form>

Then I 'require' this php file in includes/modules/sideboxes/mytemplate/blank_sidebox.php

Below please find the images

Even I can call the data from database, I do know there is security problem as I put the id,password,database name in a page. But I really don't know how to make it to just load the login information in config.php.


Could you please tell me how to fix it?
Thank you for your help!

I really appreciate your help!

I'm just start learning PHP, I'm not exactly know how to modify it
But I'll keep searching some related topics and try to modify it by following your guideline.

Do you mean after I've require('includes/application_top.php') then it will connect to the ZC database and I can call the data by changing to mysqli_?

Thanks

After initiating a connection with the database and unless there is a specific need, use the ZC functions.

Here is a partial rewrite of the above code to just replace functionality with little to no other improvement.


define_page_1:

<?php
require('includes/application_top.php');
?>


<?php

$output = '';
$output2 ='';

//collect
if (!empty($_POST['p1_wbsearch'])){
    $wbsearchq = $_POST['p1_wbsearch'];
    $wbsearchq = preg_replace("#[^0-9a-z]#i","",$wbsearchq);
    $query = $db->Execute("SELECT * FROM orders_status_history WHERE orders_status_history.track_id3 = '$wbsearchq' ");
    $count = $query->RecordCount();
    if ($count == 0 ){
        $output = 'Waybill number '.$wbsearchq.'not found!';    
    }else{
        while (!$query->EOF){
            $row = $query->fields; // this is like setting $row = mysql_fetch_array($query)
            $order_id = $row['orders_id'];
            $date = $row['date_added'];
            $output.='<h3><div>Waybill number:'.$wbsearchq.'tracking result:</div></h3>';
            $query->MoveNext();
        }

// The above has been converted to use ZC database accessing functions. There have not been any real data cleansing applied and this is provided as a more detailed example of what was previously stated.


        $query2 = mysql_query("SELECT * FROM orders_status_history inner join orders_status on orders_status_history.orders_status_id=orders_status.orders_status_id AND (orders_status.language_id=3) AND (orders_status_history.orders_id=38) ORDER BY date_added DESC")or die("Cannot access database!");
$count2 = mysql_num_rows($query2);
    if ($count2 == 0 ){
        $output2 = 'No record found!';    
    }else{
        while ($row2 = mysql_fetch_array($query2)) {
            $date = $row2['date_added'];
            $createDate = new DateTime($date);
            $stripDate = $createDate->format('Y-m-d');
            $status = $row2['orders_status_name'];
            $comments = $row2['comments'];
            $output2.='<div>'.$stripDate.':&nbsp&nbsp'.$status.',&nbsp'.$comments.'</div>';
            
        }
        
    }
        
    }
    
}

?>


<form action="index.php?main_page=page_1" method="post" >
<?php echo zen_hide_session_id(); ?>
  <input type="text" name="p1_wbsearch" placeholder="Search for waybill no..." />
  <input type="submit" value=">>" />
</form>

<?php 
    print("$output"); 
    print ("$output2"); 
?>

[jay2015]

Thank you very much,mc12345678!

(i) I've copied your modified code to define_page_1.php, the footer and sidebox disappear.


And I found the logs message:
PHP Fatal error: Cannot redeclare securityPatchSanitizePostVariableId() (previously declared in D:\xampp\htdocs\testsite01\includes\extra_configures\security_patch_v138_2008091 9.php:33) in D:\xampp\htdocs\testsite01\includes\extra_configures\security_patch_v138_2008091 9.php on line 54

(ii) I wonder if I should change the require path, so I tried

<?php
require('testsite01/includes/application_top.php');
?>

But still no footer and sidebox, the logs message shown:
PHP Warning: require(testsite01/includes/application_top.php): failed to open stream: No such file or directory in D:\xampp\htdocs\testsite01\includes\languages\schinese\html_includes\define_page _1.php on line 6

PHP Fatal error: require(): Failed opening required 'testsite01/includes/application_top.php' (include_path='D:\xampp\php\PEAR') in D:\xampp\htdocs\testsite01\includes\languages\schinese\html_includes\define_page _1.php on line 6

(iii) Finally, I change the require path

<?php
require('/testsite01/includes/application_top.php');
?>

Still no footer and sidebox, and the dreamweaver design page display this:

$len) { $contaminated = true; break; } } } } unset($paramsToCheck, $paramsToAvoid, $key); if ($contaminated) { header('HTTP/1.1 406 Not Acceptable'); exit(0); } unset($contaminated, $len); /* *** END OF INNOCULATION *** */ /** * boolean used to see if we are in the admin script, obviously set to false here. */ define('IS_ADMIN_FLAG', false); /** * integer saves the time at which the script started. */ define('PAGE_PARSE_START_TIME', microtime()); // define('DISPLAY_PAGE_PARSE_TIME', 'true'); @ini_set("arg_separator.output","&"); @ini_set("html_errors","0"); /** * Set the local configuration parameters - mainly for developers */ if (file_exists('includes/local/configure.php')) { /** * load any local(user created) configure file. */ include('includes/local/configure.php'); } /** * boolean if true the autoloader scripts will be parsed and their output shown. For debugging purposes only. */ define('DEBUG_AUTOLOAD', false); /** * set the level of error reporting * * Note STRICT_ERROR_REPORTING should never be set to true on a production site.
* It is mainly there to show php warnings during testing/bug fixing phases.
*/ if (defined('STRICT_ERROR_REPORTING') && STRICT_ERROR_REPORTING == true) { @ini_set('display_errors', TRUE); error_reporting(version_compare(PHP_VERSION, 5.3, '>=') ? E_ALL & ~E_DEPRECATED & ~E_NOTICE : version_compare(PHP_VERSION, 5.4, '>=') ? E_ALL & ~E_DEPRECATED & ~E_NOTICE & ~E_STRICT : E_ALL & ~E_NOTICE); } else { error_reporting(0); } /* * turn off magic-quotes support, for both runtime and sybase, as both will cause problems if enabled */ if (version_compare(PHP_VERSION, 5.3, '<') && function_exists('set_magic_quotes_runtime')) set_magic_quotes_runtime(0); if (version_compare(PHP_VERSION, 5.4, '<') && @ini_get('magic_quotes_sybase') != 0) @ini_set('magic_quotes_sybase', 0); /* * Get time zone info from PHP config */ if (version_compare(PHP_VERSION, 5.3, '>=')) { @date_default_timezone_set(date_default_timezone_get()); } /** * check for and include load application parameters */ if (file_exists('includes/configure.php')) { /** * load the main configure file. */ include('includes/configure.php'); } else if (!defined('DIR_FS_CATALOG') && !defined('HTTP_SERVER') && !defined('DIR_WS_CATALOG') && !defined('DIR_WS_INCLUDES')) { $problemString = 'includes/configure.php not found'; require('includes/templates/template_default/templates/tpl_zc_install_suggested_default.php'); exit; } /** * if main configure file doesn't contain valid info (ie: is dummy or doesn't match filestructure, display assistance page to suggest running the installer) */ if (!defined('DIR_FS_CATALOG') || !is_dir(DIR_FS_CATALOG.'/includes/classes')) { $problemString = 'includes/configure.php file contents invalid. ie: DIR_FS_CATALOG not valid or not set'; require('includes/templates/template_default/templates/tpl_zc_install_suggested_default.php'); exit; } /** * include the list of extra configure files */ if ($za_dir = @dir(DIR_WS_INCLUDES . 'extra_configures')) { while ($zv_file = $za_dir->read()) { if (preg_match('~^[^\._].*\.php$~i', $zv_file) > 0) { /** * load any user/contribution specific configuration files. */ include(DIR_WS_INCLUDES . 'extra_configures/' . $zv_file); } } $za_dir->close(); unset($za_dir); } $autoLoadConfig = array(); if (isset($loaderPrefix)) { $loaderPrefix = preg_replace('/[^a-z_]/', '', $loaderPrefix); } else { $loaderPrefix = 'config'; } $loader_file = $loaderPrefix . '.core.php'; require('includes/initsystem.php'); /** * determine install status */ if (( (!file_exists('includes/configure.php') && !file_exists('includes/local/configure.php')) ) || (DB_TYPE == '') || (!file_exists('includes/classes/db/' .DB_TYPE . '/query_factory.php')) || !file_exists('includes/autoload_func.php')) { $problemString = 'includes/configure.php file empty or file not found, OR wrong DB_TYPE set, OR cannot find includes/autoload_func.php which suggests paths are wrong or files were not uploaded correctly'; require('includes/templates/template_default/templates/tpl_zc_install_suggested_default.php'); header('location: zc_install/index.php'); exit; } /** * load the autoloader interpreter code. */ require('includes/autoload_func.php'); /** * load the counter code **/ if ($spider_flag == false) { // counter and counter history require(DIR_WS_INCLUDES . 'counter.php'); } // get customers unique IP that paypal does not touch $customers_ip_address = $_SERVER['REMOTE_ADDR']; if (!isset($_SESSION['customers_ip_address'])) { $_SESSION['customers_ip_address'] = $customers_ip_address; }


And the logs message:

PHP Warning: require(/testsite01/includes/application_top.php): failed to open stream: No such file or directory in D:\xampp\htdocs\testsite01\includes\languages\schinese\html_includes\define_page _1.php on line 6

PHP Fatal error: require(): Failed opening required '/testsite01/includes/application_top.php' (include_path='D:\xampp\php\PEAR') in D:\xampp\htdocs\testsite01\includes\languages\schinese\html_includes\define_page _1.php on line 6


Is there anything I missed when I copied your modified code?

Thanks again!

[mc12345678]

The need or inclusion of the require('includes/application_top.php') completely depends on how the file is used and incorporated.

It almost appears as if you don't need that first require because based on the described system response the file is actually in line with an existing call to the same file rather than being a file all by itself. I thought this file was being treated from the root of your store not incorporated into a define file that was being called by the site.

[jay2015]

The need or inclusion of the require('includes/application_top.php') completely depends on how the file is used and incorporated.

It almost appears as if you don't need that first require because based on the described system response the file is actually in line with an existing call to the same file rather than being a file all by itself. I thought this file was being treated from the root of your store not incorporated into a define file that was being called by the site.

I've just tried removing the code "require('includes/application_top.php')", sidebox and foot appear, but it cannot access to database when I input waybill number!

logs message:
PHP Warning: require(testsite01/includes/application_top.php): failed to open stream: No such file or directory in D:\xampp\htdocs\testsite01\try3.php on line 2

PHP Fatal error: require(): Failed opening required 'testsite01/includes/application_top.php' (include_path='D:\xampp\php\PEAR') in D:\xampp\htdocs\testsite01\try3.php on line 2

Is there anything I should try?

Thanks