Hello.
I am trying to make a PHP script that echos a part of my mySQL database, as JSON.
When I access the script through my browser, I get the JSON output, but when I try to use it in C# or validate it with [url]http://jsonlint.com/[/url], I just get HTML output.
Output from browser:
[CODE][{"Name":"Test","Adress":"Testingstreet 9, 1337 Testtown","Link":"http:\/\/test.dk","Map":"\/maps\/test_map.jpg","Shops":"Apotek\nDagligvarer\nIsenkram\/Boligudstyr\nLyd & billede\n"}][/CODE]
Output from [url]http://jsonlint.com/:[/url]
[CODE]<!DOCTYPEhtmlPUBLIC"-//W3C//DTD HTML 4.01 Frameset//EN""http://www.w3.org/TR/html4/frameset.dtd"><html><head><title>vps.aggisoft.dk</title></head><framesetrows="100%"><framesrc="http://85.119.157.107/android/db_read.php?mName=%27Test%27"><noframes><p>Youruseragentdoesnotsupportframesoriscurrentlyconfigurednottodisplayframes.Howeveryoumayvisit<ahref="http://85.119.157.107/android/db_read.php?mName=%27Test%27">thepagethatwassupposedtobehere</a></p></noframes></frameset></html>[/CODE]
Result from [url]http://jsonlint.com/:[/url]
[CODE]Parse error on line 1: <!DOCTYPEhtmlPUBLIC" ^ Expecting '{', '['[/CODE]
My PHP script:
[CODE]<?php header("Content-type: application/json; charset=utf-8");
$response = array();
require_once __DIR__ . '/db_connect.php';
$db = new DB_CONNECT();
if(isset($_GET["mName"])) {
$mName = $_GET['mName'];
$result = mysql_query("SELECT * FROM malls WHERE Name = $mName");
if(!empty($result)) {
if(mysql_num_rows($result) > 0) {
$result = mysql_fetch_array($result);
$mall = array();
$mall["Name"] = $result["Name"];
$mall["Adress"] = $result["Adress"];
$mall["Link"] = $result["Link"];
$mall["Map"] = $result["Map"];
$mall["Shops"] = getShops($result["Shops"]);
$response = array();
array_push($response, $mall);
echo json_encode($response);
}
else {
echo "No rows";
}
}
else {
echo "DB array is empty.";
}
}
else {
echo "No user input";
}
function getShops($shopsLink) {
//settype($shopsLink, string);
$shopFile = fopen($shopsLink, "r");
if($shopFile != NULL) {
return fread($shopFile, filesize($shopsLink));
}
else {
echo "Shops file not found";
}
}
?>[/CODE]
How can I get the PHP script to output JSON and not the HTML?
Thanks.
I think you're visiting the wrong URL in your C# program.
Works fine for me, JSONLint is grabbing the proper output from [url]http://85.119.157.107/android/db_read.php?mName=%27Test%27[/url] .
Judging from your output you're trying access it from vps.aggisoft.dk which is set up to display your actual page in an iframe. You also might want to look into using mysqli/PDO instead of the deprecated mysql functions, preventing SQL injection and outputting your error messages as JSON too
It is working now, thank you very much :D
[QUOTE=siraggi;47092688]It is working now, thank you very much :D[/QUOTE]
I cannot stress this enough, but your code as posted in the OP allows anyone to run queries on your database. Try ?mName='' OR 1=1 for instance, or even worse: ''; DROP TABLE malls
Goz3rr is right, your code allows for MySQL injections. You have no sanity checking or validation on the user input var $_GET['mName']. Your setting yourself up for failure. Look into MySQLi, MySQL is depreciated and you should be migrating to MySQLi. You can use prepared statements which prevent injections. Over all though, assuming your user input is alphanumeric, doing a check with ctype_alnum would save you a lot of trouble.
[QUOTE]
<?php
...
if(!ctype_alnum($mName){
exit;
}
...
?>
[/QUOTE]
Sorry, you need to Log In to post a reply to this thread.
