Optimiz

[dhruva]

<div class='quotetop'>QUOTE (Numb @ Jan 12 2009, 08:50 PM) <{POST_SNAPBACK}></div>

$avlink = getavatar($item[2]);
if ($avlink!=""){
echo "<img src=\"$avlink\" height=\"25\" width=\"25\" alt=\"avatar\"/>
";
}else{
echo "<img src=\"images/nopic.jpg\" height=\"25\" width=\"25\" alt=\"avatar\"/>
";
}

here sumthing some ppl mabe looking for well i did and ppl here helped me to complete it use this code to see user avatar next to their names in online list forums etc[/b]

[subzero]

waste of a post ?

[djlee]

so youve optimised a piece of code .. so what about security .. for a start remove the braces , its a security threat, there not needed, second im not even gonna mention the major xss hole in that script.. but heres a tip .. if you really wanna optimise it...

echo "<img src=&#39;".(getavatar($item[2]) != "" ? htmlspecialchars(getavatar($item[2])) : "images/nopic.jpg")."&#39; height=&#39;25&#39; width=&#39;25&#39; alt=&#39;avatar&#39; />
";

so what have we done here .. first of all weve taken an if else statement which is 4 lines long and combined it into one. so wheres the optimisation?

1. we only change the src url. the rest is printed as is, even though only one of the two echos is outputted to the screen both are processed. here we only process teh image tag once through php and change the src accordingly

2. we are no longer populating $avlink, therefore its not uneeded useless var taking up memory space.

and the security?

1. patched the HUGE XSS hole.
2. removed braces to help prevent the correct execution of any injected malicious code.

[dhruva]

thanks buddy for helping me

[djlee]

no worries .. if theres any other snippets of code u need optimising ect just post um here .. just dont post whole scripts or ur entire base code as i&#39;ll just ignore ya lol

[dhruva]

can u tell me how to use avatars on the forums , guset books, blogs. because i tried to use them but not working. i am unable to define the variables

[djlee]

i dont use lavalair or any other premade script so i cant give you the code u need as i simply dont know how the script is coded, what queries are used ect

u need to get the avatar from the users table, then either populate a variable with that avatar or use it directly ..

i.e. on my site i would use

$res = sql_query("SELECT avatar FROM users WHERE id = ".(0+$CURUSER['id'])." LIMIT 1");
$arr = mysql_fetch_assoc($res);

echo "<img src=&#39;".htmlspecialchars($arr[&#39;avatar&#39;])."&#39; border=&#39;0&#39; alt=&#39;avatar&#39; />";