headers sent issue

**Rik** · Aug 14 '06, 11:35 AM

Re: headers sent issue

Jerry Stuckle wrote:

Mladen Gogala wrote:

>On Sun, 13 Aug 2006 20:38:11 -0400, Jerry Stuckle wrote:

>>And BTW - it doesn't even have to be PHP which causes the output to
>>be
>>sent. A space or new line character before the first "<?php" is
>>enough
>>to do it. And PHP isn't even involved.
>>>
>>>I've had pages working without a hitch on Linux or Solaris and
>>>reporting "headers already sent" on Windows 2000.
>>>
>>I rest my case. If they were coded properly you wouldn't have that
>>problem.

>>
>Call to ob_start() resolved the issue extremely quickly. This also
>breaks your argument, for if it was a protocol problem, it would be
>a protocol problem on both systems. Network protocols are, by
>definition, independent of the operating system.
>>

>
Sure, You're getting around the real problem.
>
And it doesn't break my argument at all. ob_start() just tells PHP to
do some buffering. It doesn't fix your problem at all. Just bypasses
it - for now.

The fact of the matter is: there is no real reason NOT to use ob_start().
Hell, it can be very usefull. If you're using it to be able to send headers
without regard to output, it shouldn't be necessary however. The script
doesn't break, there isn't a real security issue. It's just a sign of you
coding practices: sloppy. When using this kind of 'hack' to use sessions,
possibilities are you use a lot more bad coding practices. It may be your
only vice, or one of many, but if I see your code and this is one of the
first things I see, my trust in the coder diminishes quickly. I'd suspect
(either correct or incorrect) you don't give a shit about notices like
constants having to be turned into strings and the like.

I don't have the time to check up on entire scripts of coders which are
working on a project, I'll have to trust them. And I'll have to be able to
trust particular code to work elsewhere, undependant of hacks at the
beginning of a script (allthough one can make _some_ requirements, but only
the strictly necessary).

When discovering this sloppy work the trust will be gone, and so will the
assignments to the particular coder be. They will go to someone who DOES
know how to code with care and correctly.

Grtz,
--
Rik Wasmus

**Mladen Gogala** · Aug 14 '06, 01:45 PM

Re: headers sent issue

On Mon, 14 Aug 2006 06:29:08 -0400, Jerry Stuckle wrote:

Nope, you post in this forum and you might get some advice - whether you
want it or not.

There is a very simple solution for that: plonk!

--

大红鹰娱乐-2026世界杯官方指定投注平台

http://www.mgogala.com

大红鹰娱乐平台采用顶级加密技术，确保用户数据与交易的安全无虞，让玩家能够放心畅玩。

**Mladen Gogala** · Aug 14 '06, 02:05 PM

Re: headers sent issue

On Mon, 14 Aug 2006 13:42:58 +0200, Rik wrote:

The fact of the matter is: there is no real reason NOT to use ob_start().
Hell, it can be very usefull. If you're using it to be able to send headers
without regard to output, it shouldn't be necessary however. The script
doesn't break, there isn't a real security issue. It's just a sign of you
coding practices: sloppy.

Actually, not necessarily. I use ob_start() in scripts like this one:

<?php ob_start(); session_start() ;?>
<html>
<head>
<title>Kill Session</title>
</head>
<body bgcolor="#EFECC 7">
<center>
<h2>
Warning: kill session <?=$_REQUEST['sid'] ?>, <?=$_REQUEST['serial'] ?>?
</h2>
<hr>
<?php
require_once ('config.php');
require_once ('HTML/Form.php');
$DSN = $_SESSION['DSN'];
$invoker = $_SESSION['invoker'];
$db = NewADOConnectio n("oci8");
if (!empty($_GET['sid'])) {
$sid = $_GET['sid'];
$serial = $_GET['serial'];
} else {
$sid = $_POST['sid'];
$serial = $_POST['serial'];
}
if (empty($sid)) die("Kill session: sid cannot be empty!");
$kill = @$_POST['kill'];
if (empty($kill)) {
$form = new HTML_Form($_SER VER['PHP_SELF'], "POST");
$form->addSubmit("kil l", "Yes");
$form->addSubmit("kil l", "No");
$form->addHidden('sid ', $sid);
$form->addHidden('ser ial', $serial);
$form->display();
exit;
}
if (strtolower($ki ll) != 'yes') {
header("Locatio n: $invoker");
exit;
}
$SQL = "alter system disconnect session '$sid,$serial' immediate";
try {
$db->Connect($DSN['database'], $DSN['username'], $DSN['password']);
$rs = $db->Execute($SQL );
$db->close();
header("Locatio n: $invoker");
}
catch(Exception $e) {
die($e->getMessage() );
}
?>
</center>
</body>
</html>

Here I deliberately and explicitly send HTML headers in such a way that I
can set the background color and write a line of text in HTML. I don't see
why would I program those things in PHP when HTML is made for presenting
static information in an easy way. PHP was designed to mix freely with
HTML. All I want to do in this script is to print a warning and, if
answered with "yes", kill the session, then go back to the invoker.
Without "ob_start() " in the beginning, I am unable to use header()
function on Win2k/Apache 2.0.54/PHP 5.1.4. How will ob_start() byte me
later?

--

大红鹰娱乐-2026世界杯官方指定投注平台

http://www.mgogala.com

大红鹰娱乐平台采用顶级加密技术，确保用户数据与交易的安全无虞，让玩家能够放心畅玩。

**Rik** · Aug 14 '06, 02:25 PM

Re: headers sent issue

Mladen Gogala wrote:

On Mon, 14 Aug 2006 13:42:58 +0200, Rik wrote:
>

>The fact of the matter is: there is no real reason NOT to use
>ob_start(). Hell, it can be very usefull. If you're using it to be
>able to send headers without regard to output, it shouldn't be
>necessary however. The script doesn't break, there isn't a real
>security issue. It's just a sign of you coding practices: sloppy.

>
Actually, not necessarily. I use ob_start() in scripts like this one:
>
><snip code>
>
Here I deliberately and explicitly send HTML headers in such a way
that I can set the background color and write a line of text in HTML.
I don't see why would I program those things in PHP when HTML is made
for presenting static information in an easy way. PHP was designed to
mix freely with
HTML. All I want to do in this script is to print a warning and, if
answered with "yes", kill the session, then go back to the invoker.
Without "ob_start() " in the beginning, I am unable to use header()
function on Win2k/Apache 2.0.54/PHP 5.1.4. How will ob_start() byte me
later?

Well, on a server you generating and trashing content that didn't need to
be build in the first place. Not necessarily an issue, but a huge waste of
resources, cpu & memory.

What's the problem with the following flow?

1. start session
2. if form is submitted and answer is yes, destroy session and redirect
3. else show form

It will produce a lot less overhead.
--
Rik Wasmus

**Mladen Gogala** · Aug 14 '06, 04:15 PM

Re: headers sent issue

On Mon, 14 Aug 2006 16:29:56 +0200, Rik wrote:

Well, on a server you generating and trashing content that didn't need to
be build in the first place. Not necessarily an issue, but a huge waste of
resources, cpu & memory.

What is a waste of resources? Which part?

>
What's the problem with the following flow?
>
1. start session
2. if form is submitted and answer is yes, destroy session and redirect
3. else show form
>
It will produce a lot less overhead.

The largest single wait is for an Oracle connection to be established. I
want to postpone that for as long as I can and create a connection only
if necessary. This script is invoked from a link, and I don't want to kill
session or establish connection if someone has accidentally clicked on the
link. The full complement of the scripts is available on my page. I'd be
grateful if you decide to take a look.

--

大红鹰娱乐-2026世界杯官方指定投注平台

http://www.mgogala.com

大红鹰娱乐平台采用顶级加密技术，确保用户数据与交易的安全无虞，让玩家能够放心畅玩。

**Rik** · Aug 14 '06, 08:05 PM

Re: headers sent issue

Mladen Gogala wrote:

On Mon, 14 Aug 2006 16:29:56 +0200, Rik wrote:
>

>Well, on a server you generating and trashing content that didn't
>need to be build in the first place. Not necessarily an issue, but a
>huge waste of resources, cpu & memory.

>
What is a waste of resources? Which part?

You are using memory for buffering that hypothetically could be needed
elsewhere. True, it's a very low usage, but hey, if there are thousands on
your site at once, and your server resources are limited, it might shave of
something.

As long as the code stays readable, why not choose the order & checks that
will keep the use of memory & CPU to a minimum. Don't overdo it, but if
either option is OK, why not choose the easiest on the server?

>What's the problem with the following flow?
>>
>1. start session
>2. if form is submitted and answer is yes, destroy session and
>redirect
>3. else show form
>>
>It will produce a lot less overhead.

>
The largest single wait is for an Oracle connection to be
established. I want to postpone that for as long as I can and create
a connection only
if necessary.

That has absolutely NOTHING to do with where it is in the script. Surrounded
by a conditional, it could be anywhere, and never be called when it's not
necessary.

As I've yet to set up a testserver here to start to check the
oracle-database, I'll refrain from commenting on the way you use it, but I
doubt wether this construction is safe (could be wrong though):

$sid = $_POST['sid'];
$serial = $_POST['serial'];
$SQL = "alter system disconnect session '$sid,$serial' immediate";
$rs = $db->Execute($SQL );

Is oracle that well build this isn't wide open to attack?

This script is invoked from a link, and I don't want to
kill session or establish connection if someone has accidentally
clicked on the link. The full complement of the scripts is available
on my page. I'd be grateful if you decide to take a look.

Well, I haven't looked at your page yet, but let's just say this rewrite of
your posted code works perfectly. (which demonstrated further bad coding
practices like <?=$var ?>, exiting without letting your HTML tags close on
form completion....) . It's made with simple reasoning: if you have to check
with code what the actual intent of the visitor is, check for the
fastest/easiest things first.

<?php
session_start() ;
$invoker = $_SESSION['invoker'];

/* I'm not sure what's in here, so I'll put it here:*/
require_once ('config.php');

/* First check: if $sid is not set, all the rest is useless */
if(!isset($_REQ UEST['sid'])) die("Kill session: sid cannot be empty!");

/* On a cancel the user will also be directed back asap */
if(isset($_POST['kill'] && strtolower($_PO ST['kill'])!='yes'){
header("Locatio n: $invoker");
exit;
}
$sid = $_REQUEST['sid'];
$serial = $_REQUEST['serial'];

/* a simple check wether we should delete or display the form: */
if(strtolower($ _POST['kill'])=='yes'){
$DSN = $_SESSION['DSN'];
/* If you're that worried about your db-connection, let's make a nice
shutdown: */
function closedb(){
global $db;
$db->close();
}
register_shutdo wn_function('cl osedb');

$db = NewADOConnectio n("oci8");
$SQL = "alter system disconnect session '$sid,$serial' immediate";
try {
$db->Connect($DSN['database'], $DSN['username'], $DSN['password']);
$rs = $db->Execute($SQL );
$db->close();
header("Locatio n: $invoker");
exit;
}
catch(Exception $e) {
die($e->getMessage() );
}
/* If the user get's here we need to display HTML */
?>
<html>
<head>
<title>Kill Session</title>
</head>
<body bgcolor="#EFECC 7" style="text-align:center">
<h2>Warning: kill session <?php
echo $_REQUEST['sid'].', '.$_REQUEST['serial']; ?>?</h2>
<hr>
<?php
/* only now do we need a form, so we require it */
require_once ('HTML/Form.php');
$form = new HTML_Form($_SER VER['PHP_SELF'], "POST");
$form->addSubmit("kil l", "Yes");
$form->addSubmit("kil l", "No");
$form->addHidden('sid ', $sid);
$form->addHidden('ser ial', $serial);
$form->display();
/* we had an exit here, let's not begin to tell you why that's bullshit, and
even very bad */
}
?>
</body>
</html>

This took me about 4 minutes with the code you made (no, I haven't checked
for typo's/copy paste errors). Hell, if you take out the comments and empty
lines, it's even shorter.

Also, seeing your code my statement:" When using this kind of 'hack' to use
sessions, possibilities are you use a lot more bad coding practices." has
proven right. Note this is not a personal attack, it's still only an attack
on using ob_start() to use sessions/headers, and will now also go one about
<?= ?syntax, and a warning to let you HTML tags close if you exit;, unless
on fatal errors.

If this was alt.html, I'd add that <centerhas been deprecated for a very
long time now, since HTML4.0.....

Grtz,
--
Rik Wasmus

**Jerry Stuckle** · Aug 15 '06, 01:45 AM

Re: headers sent issue

Rik wrote:

Mladen Gogala wrote:
>

>>On Mon, 14 Aug 2006 16:29:56 +0200, Rik wrote:
>>
>>

>>>Well, on a server you generating and trashing content that didn't
>>>need to be build in the first place. Not necessarily an issue, but a
>>>huge waste of resources, cpu & memory.

>>
>>What is a waste of resources? Which part?

>
>
You are using memory for buffering that hypothetically could be needed
elsewhere. True, it's a very low usage, but hey, if there are thousands on
your site at once, and your server resources are limited, it might shave of
something.
>
As long as the code stays readable, why not choose the order & checks that
will keep the use of memory & CPU to a minimum. Don't overdo it, but if
either option is OK, why not choose the easiest on the server?
>
>

>>>What's the problem with the following flow?
>>>
>>>1. start session
>>>2. if form is submitted and answer is yes, destroy session and
>>>redirect
>>>3. else show form
>>>
>>>It will produce a lot less overhead.

>>
>>The largest single wait is for an Oracle connection to be
>>established . I want to postpone that for as long as I can and create
>>a connection only
>>if necessary.

>
>
That has absolutely NOTHING to do with where it is in the script. Surrounded
by a conditional, it could be anywhere, and never be called when it's not
necessary.
>
As I've yet to set up a testserver here to start to check the
oracle-database, I'll refrain from commenting on the way you use it, but I
doubt wether this construction is safe (could be wrong though):
>
$sid = $_POST['sid'];
$serial = $_POST['serial'];
$SQL = "alter system disconnect session '$sid,$serial' immediate";
$rs = $db->Execute($SQL );
>
Is oracle that well build this isn't wide open to attack?
>
>

>>This script is invoked from a link, and I don't want to
>>kill session or establish connection if someone has accidentally
>>clicked on the link. The full complement of the scripts is available
>>on my page. I'd be grateful if you decide to take a look.

>
>
Well, I haven't looked at your page yet, but let's just say this rewrite of
your posted code works perfectly. (which demonstrated further bad coding
practices like <?=$var ?>, exiting without letting your HTML tags close on
form completion....) . It's made with simple reasoning: if you have to check
with code what the actual intent of the visitor is, check for the
fastest/easiest things first.
>
<?php
session_start() ;
$invoker = $_SESSION['invoker'];
>
/* I'm not sure what's in here, so I'll put it here:*/
require_once ('config.php');
>
/* First check: if $sid is not set, all the rest is useless */
if(!isset($_REQ UEST['sid'])) die("Kill session: sid cannot be empty!");
>
/* On a cancel the user will also be directed back asap */
if(isset($_POST['kill'] && strtolower($_PO ST['kill'])!='yes'){
header("Locatio n: $invoker");
exit;
}
$sid = $_REQUEST['sid'];
$serial = $_REQUEST['serial'];
>
/* a simple check wether we should delete or display the form: */
if(strtolower($ _POST['kill'])=='yes'){
$DSN = $_SESSION['DSN'];
/* If you're that worried about your db-connection, let's make a nice
shutdown: */
function closedb(){
global $db;
$db->close();
}
register_shutdo wn_function('cl osedb');
>
$db = NewADOConnectio n("oci8");
$SQL = "alter system disconnect session '$sid,$serial' immediate";
try {
$db->Connect($DSN['database'], $DSN['username'], $DSN['password']);
$rs = $db->Execute($SQL );
$db->close();
header("Locatio n: $invoker");
exit;
}
catch(Exception $e) {
die($e->getMessage() );
}
/* If the user get's here we need to display HTML */
?>
<html>
<head>
<title>Kill Session</title>
</head>
<body bgcolor="#EFECC 7" style="text-align:center">
<h2>Warning: kill session <?php
echo $_REQUEST['sid'].', '.$_REQUEST['serial']; ?>?</h2>
<hr>
<?php
/* only now do we need a form, so we require it */
require_once ('HTML/Form.php');
$form = new HTML_Form($_SER VER['PHP_SELF'], "POST");
$form->addSubmit("kil l", "Yes");
$form->addSubmit("kil l", "No");
$form->addHidden('sid ', $sid);
$form->addHidden('ser ial', $serial);
$form->display();
/* we had an exit here, let's not begin to tell you why that's bullshit, and
even very bad */
}
?>
</body>
</html>
>
This took me about 4 minutes with the code you made (no, I haven't checked
for typo's/copy paste errors). Hell, if you take out the comments and empty
lines, it's even shorter.
>
Also, seeing your code my statement:" When using this kind of 'hack' to use
sessions, possibilities are you use a lot more bad coding practices." has
proven right. Note this is not a personal attack, it's still only an attack
on using ob_start() to use sessions/headers, and will now also go one about
<?= ?syntax, and a warning to let you HTML tags close if you exit;, unless
on fatal errors.
>
If this was alt.html, I'd add that <centerhas been deprecated for a very
long time now, since HTML4.0.....
>
Grtz,

Better be careful, Rik. You came up with an intelligent argument. Hi
just might plonk you, too! :-)

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

**Rik** · Aug 15 '06, 10:25 AM

Re: headers sent issue

Jerry Stuckle wrote:

Better be careful, Rik. You came up with an intelligent argument. Hi
just might plonk you, too! :-)

Well, if we're both plonked, he will no longer disagree with us. Problem
solved :-)

Grtz,
--
Rik Wasmus

headers sent issue

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment