[uCash/uShop] Transactions Addon With a 'message'

Hi

This is my first 'hack' per-say (released ), so do bear with me

This is a hack I had made for my site, for some weird reason I have no answer to ..anyways, it will add an option for your users to add a message when he/she donates to another person on your board, and displays transactions based on a userid input (e.g. transaction.php?userid=1), the default showing the transactions done by the person currently logged in, and a global transaction, showing all donations made on your board

BIG Thanks goes to Deaths for the help he provided me on in putting this hack together.

ChangeLog

• Version 1.2 (11/7/05)
  • Added "View {username}'s Transations" link into postbit(_legacy)
  • Fixed Page Generation issues
  • Phrase added to show error message if no transactions exist
  • Made the install file a bit easier to understand

That about sums it all up..please click INSTALL if you use this hack

[Deaths]

My pleasure mate .

[TyleR]

also: if anyone knows how to cut down an image (screenshot), i'll post them ..it said my ss was too big =\

[Polo]

Originally Posted by TanK DaWg

also: if anyone knows how to cut down an image (screenshot), i'll post them ..it said my ss was too big =\

save the images in gif format...

[Polo]

Originally Posted by TanK DaWg

also: if anyone knows how to cut down an image (screenshot), i'll post them ..it said my ss was too big =\

save the images in gif format...

[TyleR]

Originally Posted by Polo

save the images in gif format...

Tried to..same message (File Too Big...)

[Marco van Herwaarden]

Thanks for sharing. 2 remarks:
- You can set this to be an addon in the hack details page.
- You are creating a possible SQL insertion. First you do a globalize to an integer for the userid, this is good and would force it to be an integer and removing the SQL insertion possibility. In the query however you are using the $_REQUEST['userid'], making it possible to use a non integer value. Best would be to change this to simple $userid.

[Deaths]

Hmm, I told him to do so, he must've forgotten

[TyleR]

umm..it's in there?

PHP Code:

globalize($_REQUEST,  array('userid' => INT)); 


[Marco van Herwaarden]

Originally Posted by TanK DaWg

umm..it's in there?

PHP Code:

globalize($_REQUEST, array('userid' => INT)); 


Yes like i said it is in there, but so is:

PHP Code:

 $getuser = $DB_site->query('SELECT * from ' . TABLE_PREFIX . 'utt_store_history WHERE userid="' . $_REQUEST['userid'] . '" AND action="Donate" ORDER BY historyid DESC'); 


change "' . $_REQUEST['userid'] . '" to a simple $userid

[TyleR]

Changed & Updated. Thanks Marco

[Marco van Herwaarden]

Looking save now

Just one tip for future coding:

PHP Code:

    $getuser = $DB_site->query('SELECT * from ' . TABLE_PREFIX . 'utt_store_history WHERE userid="' . $userid . '" AND action="Donate" ORDER BY historyid DESC'); 


There is no need to stop the string and insert a variable if you use double-quotes (") around the the string. Also numerical var's in a query don't need to be quoted at all, and if quoting alphanumerical data best to use single quotes ('). So the above line could also be written as:

PHP Code:

    $getuser = $DB_site->query("SELECT * from " . TABLE_PREFIX . "utt_store_history WHERE userid=$userid AND action='Donate' ORDER BY historyid DESC"); 


[Vevina]

sweet installed

[TyleR]

heh

[TyleR]

if anyone can 'teach' me the pagination, please send me a PM