Source Viewer

index.php : this PHP coordinates page creation

<?php
//error_reporting(E_ALL);
//ini_set('display_errors', 'On');

include_once("../../inc/mysql2i.class.php");	// deprecated php5-mysql api to php7-mysqli, work-around

include('config.php');

$poll_id = (isset($_POST['poll_id'])) ? $_POST['poll_id'] : '';
  $newQ = (isset($_POST['Q'])) ? $_POST['Q'] : '';
  $vote = (isset($_POST['vote'])) ? $_POST['vote'] : '';
  $questions = (isset($_POST['questions'])) ? $_POST['questions'] : '';

$uinput = $poll_id . $newQ . $vote . $questions . implode($_REQUEST);
  if ((strstr($uinput,';') . strstr($uinput,'--') . strstr($uinput,'/*') . strstr($uinput,'#') .
      strstr($uinput,'()') . stristr($uinput,'select') . stristr($uinput,'union') . stristr($uinput,'script')) ||
      $uinput != strip_tags($uinput) ) {
        echo '<h4>Your input string violates security!</h4>';
        $error = '<h4>The generated query violates security!</h4>';
    	include('selectQ.php');
    	exit;
  }

// note: for mysql_... to work there must already be a connection
  $poll_id = mysql_real_escape_string(strip_tags($poll_id));
  $newQ = mysql_real_escape_string(strip_tags($newQ));
  $vote = mysql_real_escape_string(strip_tags($vote));
  $questions = mysql_real_escape_string(strip_tags($questions));

if($newQ && $poll_id!='') {
    if ($poll_id == 0) {	// special case tp allow injection, for purposes of testing eg:XSS: <script>alert("I got you");</script>
        $poll_id = 4;	// TBD not hard coded
    }
    $query = mysql_query("UPDATE poll SET name= '" . $newQ . "' WHERE id=" . $poll_id );
    include('selectQ.php');
    exit;
}

$uip = htmlspecialchars($_SERVER['REMOTE_ADDR']);	// determin User IP; as his identity
if(isset($_POST['vote']) && isset($_POST['questions'])) {
//    $query = mysql_query("SELECT `questions`.`pid` FROM  `responses`, `questions` WHERE `responses`.`qid`=`questions`.`id` AND `responses`.`ip`='".$uip."' AND pid=(SELECT pid FROM `questions` WHERE id='".$questions."' LIMIT 1)");
    $qid = $questions;
    $query = mysql_query("SELECT pid FROM `questions` WHERE id=$qid LIMIT 1");
    $poll = mysql_fetch_array($query);
    $pollId = $poll['pid'];
    $query = mysql_query("SELECT `questions`.`pid` FROM  `responses`, `questions` WHERE `responses`.`qid`=`questions`.`id` AND `responses`.`ip`='".$uip."' AND pid=$pollId LIMIT 1");

if(mysql_num_rows($query) == 0){
      $query = mysql_query("INSERT INTO `responses` (`qid`, `ip`) VALUES ('".$questions."', '".$uip."')");
    } else {
      $error = 'You Already Voted';
    }
  } else if(!isset($_POST['questions']) && !isset($_POST['vote'])){
    if(!isset($_REQUEST['poll_id'])) {
        $error = 'You Need To Select a Question';
    	include('selectQ.php');
    	exit;
    } else {
        $pollId = mysql_real_escape_string(strip_tags($_REQUEST['poll_id']));
    }

}

if (isset($error)) {
	echo $error;
  }
  include('poll.php');

selectQ.php : Creates the page for selecting a Question

<?php
  // This file is included by index.php
  // who BTW has sets up the MySQL configuration

$query = mysql_query("SELECT * FROM `poll` ORDER BY `id` ASC");
  $pollCnt = mysql_num_rows($query);
  // now set in index.php: $uip = htmlspecialchars($_SERVER['REMOTE_ADDR']);
?>

<h4 style="color: blue;"><center>Here are the Poll questions to select from.</center></h4>
<br/>
<table width="300" cellpadding="0" cellspacing="0" border="0" align="center">

</table>
<br/><br/>
<hr/>
 &nbsp;  &nbsp; OR<br/>
  <form method="post" action="<?php echo basename(htmlspecialchars($_SERVER['PHP_SELF'])); ?>">
	<input type="submit" value="Update last 'would-be' Poll question:"> &nbsp; 
	<input type="text" size="64" name="Q" value='<?php echo $pollQ; ?>'><br/>
	<input type="hidden" name="poll_id" value="<?php echo $pollCnt; ?>">
  </form>

<?php
// generate the site wide std bottom section of the page
$bottom = file_get_contents("../../inc/bottom_dialog_src.ssi");
echo $bottom;
?>

poll.php : creates the page showinf poll results

<?php
  // This file is included by index.php
  // who BTW sets up the MySQL configuration

//$query = mysql_query("SELECT * FROM `poll` ORDER BY `id` DESC LIMIT 1");
  $query = mysql_query("SELECT * FROM `poll` ORDER BY `id` ASC LIMIT 1");
  if (isset($pollId)) {
      $query = mysql_query("SELECT * FROM `poll` where `id`=$pollId");
  } else {
      $pollId = 1;
  }

$rows = mysql_num_rows($query);

if($rows > 0){
    $poll = mysql_fetch_array($query);
    $title = $poll['name'];
    $pollId = $poll['id'];
  } else {
    $title = 'No Poll Yet';
  }

// determin Max count for use in % scaling
  $query = mysql_query("SELECT COUNT(`id`) as hits FROM `responses` GROUP BY `qid`");
  while($row = mysql_fetch_array($query)){
    $me[] = $row['hits'];
  }
  $max = max($me);

// now set in index.php: $uip = htmlspecialchars($_SERVER['REMOTE_ADDR']);
  $query = mysql_query("SELECT `questions`.`pid` FROM  `responses`, `questions` WHERE `responses`.`qid`=`questions`.`id` AND `responses`.`ip`='".$uip."' AND pid='".$poll['id']."'");

if(mysql_num_rows($query) > 0){	   // already got response from this ip addr.
  // ===============================================================================
    $total = mysql_query("SELECT `questions`.`pid` FROM  `responses`, `questions` WHERE `responses`.`qid`=`questions`.`id` AND pid='".$poll['id']."'");
    $total = mysql_num_rows($total);
?>
<h3 style="color: blue;"><center>Latest Poll Results</center></h3>
<table width="300" cellpadding="0" cellspacing="0" border="0" align="center">
  <tr>
    <td valign="top" align="center"><?php echo $title; ?></td>
  </tr>
  <?php
    $query = mysql_query("SELECT * FROM `questions` WHERE `pid`='".$poll['id']."' ORDER BY `id`");
    $questions = mysql_num_rows($query);
    if($questions > 0){
  ?>

<tr>
    <td valign="top">
    <table width="100%" cellpadding="1" cellspacing="1" border="0">
      <?php
        while($question = mysql_fetch_array($query)){
          $responses = mysql_query("SELECT count(id) as total FROM `responses` WHERE qid='".$question['id']."'");
          $responses = mysql_fetch_array($responses);
          if($total > 0 && $responses['total'] > 0){
            $percentage = round(($responses['total'] / $total) * 100);
            // Now your bars are constructed in comparison to the most popular option!
			$percentage = round(($responses['total'] / $max) * 100);
          } else {
            $percentage = 0;
          }

$percentage2 = 100 - $percentage;
      ?>
        <tr>
          <td valign="top" style="padding-right: 10px;" nowrap="nowrap"><?php echo $question['question']; ?></td>
          <td valign="top" height="10" width="100%">
          <table width="100%" cellpadding="0" cellspacing="0" border="0">
            <tr>
              <td valign="top" width="<?php echo $percentage; ?>%" <?php if($percentage > 0){?>style="background: url('images/bar.jpg') repeat-x;"<?php } ?>><img src="images/dot.gif" width="1" height="19" /></td>
              <td valign="top" width="<?php echo $percentage2; ?>%"></td>
            </tr>
          </table>
          </td>
          <td valign="top" style="padding-left: 5px;"><?php echo $responses['total']; ?></td>
        </tr>
      <?php
      }
      ?>
      <tr>
        <td valign="top" colspan="3" align="center">Total Votes: <?php echo $total; ?></td>
      </tr>
    </table>
    </td>
  </tr>
  <?php
    }
  ?>
</table>
<?php
  } else {
  //              if new to survey let him take it.
  // ===============================================================================
  ?>

<?php	// report errors
      if(isset($error)){
    ?>
      <tr>
        <td valign="top" colspan="2" align="center"><?php echo $error; ?></td>
      </tr>
    <?php
      }
    ?>

<?php		// put up options
        while($question = mysql_fetch_array($query)){
      ?>
        <tr>
          <td valign="top"><input type="radio" name="questions" value="<?php echo $question['id']; ?>" /></td>
          <td valign="top" width="100%"><?php echo $question['question']; ?></td>
        </tr>
      <?php
      }
      ?>
      <tr>
        <td valign="top" colspan="2" align="center"><input type="submit" name="vote" value="Submit Your response" />
        &nbsp; &nbsp; You will then See Results so far.
        </td>
      </tr>
    </table>
    </form>
    </td>
  </tr>

<?php
    }
  ?>
</table>
<?php
  }

$query = mysql_query("SELECT * FROM `poll` ORDER BY `id` ASC");
  $pollCnt = mysql_num_rows($query);
?>

<?php
// generate the site wide std bottom section of the page
$bottom = file_get_contents("../../inc/bottom_dialog_src.ssi");
echo $bottom;
?>

bottom_src.ssi : provides a site standard set of links (with a src code link) at the bottom of the page

<font color=Black>
<div style="position:fixed; bottom:12px; left:24px;">
<a  href="viewSrc.php"> <b>VIEW SERVER CODE</b> </a>
</div>

<div style="position:fixed; bottom:12px; right:24px;">
<small>
| <a href='/'>Site Home</a>
| <span class='tag' style="color:blue" onclick='takeMessage();'><u>msg: Site Administrator</u></span>
| <strong> <font color='#008080'> RonMiller </strong></font>
 &copy;1999-2021
</small>
</div>
</font>

</body>
</html>

Viewing source code files from the server

which support rendering for: poll

index.php : this PHP coordinates page creation

selectQ.php : Creates the page for selecting a Question

poll.php : creates the page showinf poll results

bottom_src.ssi : provides a site standard set of links (with a src code link) at the bottom of the page