This contribution is not mature

[limor01]

Excelent idea that needs more work.

 

 

1. it has SQL injection risks.

you need to make sure you clean the data from the URL before you insert it into your database as a query.

 

like:

$mfo_auction_query = mysql_fetch_object(
tep_db_query('select auctions_starting_price, expires_date, overbid_amount from ' . 
TABLE_AUCTIONS_PRODUCTS . ' where products_id = ' . $_GET['products_id'] . ' and status'));

 

2. it has many bugs in implementation and design.

For instance, If you use a module to make some of the code why not use two modules to make product_info as clean as possible.

 

 

3. Timestamp is not saved in the bid, mistakes with table names, forgotten code parts.

fixed:

							
$sql_auction = "insert into ".TABLE_AUCTIONS_BIDS." (auctions_bids_id, auctions_id,customers_id,bid_price,bid_status, 
bid_date_added) values('','$auction_id','$customers_id','$bid_price', '', now())";

 

thanks

I hope to add some bug fixes to this post.

[Guest]

Excelent idea that needs more work.

1. it has SQL injection risks.

you need to make sure you clean the data from the URL before you insert it into your database as a query.

 

like:

$mfo_auction_query = mysql_fetch_object(
tep_db_query('select auctions_starting_price, expires_date, overbid_amount from ' . 
TABLE_AUCTIONS_PRODUCTS . ' where products_id = ' . $_GET['products_id'] . ' and status'));

 

2. it has many bugs in implementation and design.

For instance, If you use a module to make some of the code why not use two modules to make product_info as clean as possible.

3. Timestamp is not saved in the bid, mistakes with table names, forgotten code parts.

fixed:

							
$sql_auction = "insert into ".TABLE_AUCTIONS_BIDS." (auctions_bids_id, auctions_id,customers_id,bid_price,bid_status, 
bid_date_added) values('','$auction_id','$customers_id','$bid_price', '', now())";

 

thanks

I hope to add some bug fixes to this post.

I wonder where this post belongs?

[bkellum]

Excelent idea that needs more work.

 

 

1. it has SQL injection risks.

you need to make sure you clean the data from the URL before you insert it into your database as a query.

 

like:

$mfo_auction_query = mysql_fetch_object(
tep_db_query('select auctions_starting_price, expires_date, overbid_amount from ' . 
TABLE_AUCTIONS_PRODUCTS . ' where products_id = ' . $_GET['products_id'] . ' and status'));

 

2. it has many bugs in implementation and design.

For instance, If you use a module to make some of the code why not use two modules to make product_info as clean as possible.

 

 

3. Timestamp is not saved in the bid, mistakes with table names, forgotten code parts.

fixed:

 
$sql_auction = "insert into ".TABLE_AUCTIONS_BIDS." (auctions_bids_id, auctions_id,customers_id,bid_price,bid_status, 
bid_date_added) values('','$auction_id','$customers_id','$bid_price', '', now())";

 

thanks

I hope to add some bug fixes to this post.

 

Hey Don,

What contribution are you making comments about?? :blink:

[JangoF]

The Auction contribution.