The idea here is SECURE database interaction. Follow these steps:

1. Create a database user with ONLY the permissions that you need for a given function. E.g. if you have a page that only needs to DISPLAY information, use a database user that only has SELECT privileges.

2. Create your database columns so they can ONLY store the types of information they need. E.g. if the field is for a phone number area code, make the column an INTEGER, not a CHAR, VARCHAR or TEXT field. Nothing bad can end up in an integer column… but if you have a wide open data-type, you could be asking for trouble.

3. Put your database connect functions ABOVE the html root directory. E.g. most web sites should utilize a directory structure with something like the following:
/html (contains all your html pages… this is the document root of the web site).
/lib (contains your database connect function and other PHP code).

4. Use regular expressions to sanitize any user input to a form. Javascript enhances the user experience, but it cannot stop someone from posting data directly to your submission page. E.g. you might have something like this to get only alpha-numeric input:

function get_alphanumeric_regex ($input) {
$pattern = '/\W/';
$input = preg_replace($pattern, ' ', $input);
return $input;
}


5. Finally, use prepared statements… they are MUCH safer than piecing together statements as strings. If someone hijacks your string, then they’ve hijacked your statement. A prepared statement can’t be messed with. With mysqli, they look something like this:

< ?php

/*————————————————————————-*/
function get_name_regex ($input) {
$pattern = ‘/(;|\||`|=|–|\/|\.|>|< |&|^|"|'."\n|\r".'|{|}|[|]|\)|\(|[0-9])/i';
$input = preg_replace($pattern, ' ', $input);
return trim(ucfirst($input));
}
?>

• Screen Callers
• Record calls on the fly and access recordings online
• Block Callers
• Receive Notifications
• One number that rings different phones based on who’s calling
• Personalize your voicemail greetings by caller or group
• Let people call you from a web page without showing your number
• Visual voicemail for your mobile phone
• And more!

The lesson I’ve learned from the Google Gods is that the NAME of your domain trumps your content to a huge degree. Bastards. As Frank Zappa might say “Who’s @#% do you have to suck to get some relevant ads around here?”

There are a couple ways to do this… the easiest is using javascript’s document.write:


<script type="text/javascript">
    document.write('Hello World');
</script>


This works great for simple little messages, but what if you have a large multi-line text string? What if your text has HTML tags and double quotes in it? Then you’re in for some trouble, because the nice little javascript examples will die on you most ingloriously. PHP to the rescue. Use PHP to replace the spaces (and double-quotes)… you may have to escape your double-quotes in the source text.

Extending that simple little example with some meaty text and some PHP, you end up with something like this:


<?php

That solution works (at least, it did before I had to replace all the tags with html entities to make this post). The text gets written at that point in the document once it loads on the client-side. Notice that the regular expressions replace double-quotes with 2 single quotes (tricky, eh?), and any excessive space is replaced. But what if you want something more complicated… what if you don’t like the regular expressions and having to escape your double-quotes? The above method is sorta techie for some, and prone to error. There is another solution: use an Ajax library to pipe HTML directly to a div tag. This solution is more scalable because you can put all the HTML in a separate file, and you don’t have to escape characters.

Download this Javascript library from http://www.prototypejs.org/ and copy the file somewhere in your site’s html directory (here I called it div_updater.js and put it in my js directory). Reference the file in a script tag using the ’src’ element, then use the Ajax.Updater function to specify 1) the div id where the text should be written and 2) the file to be included.


    <div id="target_div"></div>
    <script type="text/javascript" src="js/div_updater.js"></script>
    <script type="text/javascript">
        new Ajax.Updater('target_div', 'include_file.php');
    </script>


This solution will write the text to where-ever you have the target_div. Just make sure you use give the div an ‘id’ and that its name is referenced correctly by the Updater function. Using one of these solutions, you can utilize javascript to hide text from the search engines.