Very basic pastebin with Sqlite3

By [Plornt] on Mar 21, 2011

This is a very basic pastebin base I made for myself to use since pastebin went "pro".

It has absolutly no theme, it looks like shiz, but it did what I needed it to do, which was a one page small place where I could paste in my text and get a link to it without creating a mysql database.

It uses the SQLite3 class which is usually packaged with PHP >5 (Wamp on windows needs a little editing to make sure the DLL exstension is enabled).

I will probably annotate it with comments so others can read my code and also expand some of the brackets a bit instead of my attempt to oneline most of it.

Also a bit of HTML around it just to make the page slighty valid (Well >.> ).

If you choose to use it as is makes sure to go to ?page=setup to create the neccesary table.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Basic Paste</title>
</head>
<body>
<a href='?page=paste'>Create a new paste</a><br /><br />
<?php
$p = $_GET['page'];
$db = new SQLite3('pastes.db');
if (!$db) die ("I hate SQLite");
if ($p == 'setup') $db->query("CREATE TABLE if not exists pastes (id INTEGER PRIMARY KEY,paste BLOB);");
elseif ($p == 'paste') echo "<form method='post' action='?page=upload'><textarea name='paste' rows='20' cols='80'></textarea><br /><input type='submit' value='Paste!'></form>";
elseif ($p == 'upload')  {
    $paste = $db->escapeString($_POST['paste']);
    if ($paste) {
    $db->query("INSERT INTO pastes (id,paste) VALUES (null,'".$paste."')");
    echo "Paste successful view your paste <a href='?page=viewpaste&paste=".base64_encode($db->lastInsertRowID())."'>here</a>!";
    } 
    else echo "No id, no service!";
}
elseif ($p == 'viewpaste') {
    $id = base64_decode($_GET['paste']);
    if ($id && is_integer($id)) {
        $f = $db->query("SELECT * FROM pastes WHERE id='".$id."'");
        $f = $f->fetchArray();   
        if ($f['paste']) echo "<h1>Paste</h1><br /><br /><form method='post' action='?page=upload'><textarea name='paste' rows='20' cols='80'>".htmlspecialchars($f['paste'])."</textarea><br /><input type='submit' value='Make Ammendments as new paste'></form>";
        else header("Location: ?home"); 
    }
    else header("Location: ?home"); 
}
?>
</body>
</html>

Comments

Sign in to comment.
Atr   -  Mar 21, 2011

Very nice! This can come in handy for creating a place to dump code, without having to endure pastebin.com's recently-acquired fail-ness.

Nice work with the code, too. Short and sweet.

My only suggestion would be to make the links a bit shorter, as a base64-encode is a bit long for comfort in the short-URL world which we live in.

 Respond  
Hawkee   -  Mar 21, 2011

Yes, good catch. Even though you are doing a base64 decode it's still possible to encode the injection before submitting.

 Respond  
[Plornt]   -  Mar 21, 2011

Talking of escaping user input, how stupid of me to not do it on the ID parameter!

 Respond  
Hawkee   -  Mar 21, 2011

That's something I've been considering for some time, but it's a real technical challenge under the current infrastructure. I'll have to weigh the pros and cons and come up with an implementation plan. It might be nice to have, but it's currently not the top priority. I appreciate the suggestion, thank you.

 Respond  
[Plornt]   -  Mar 21, 2011

Changed again ^^ when putting it in the first time I didnt know where to put it >.<.

Also while youre here any chance we could get some sort of multiplatforms, might be only useful for web stuff but it would be nice to have somthing like PHP, HTML, CSS as one category or somthing.

 Respond  
Hawkee   -  Mar 21, 2011

That's good, it's a very important habit to get into. Now I might just be getting nit-picky, but in terms of readability and emphasis the title might be better as "Very Basic Pastebin with SQLite"

 Respond  
[Plornt]   -  Mar 21, 2011

Thanks :)
And yeah I usually escape most things, I try not to trust the user although just learning/getting used to the sqlite class today and im not sure if that escape string has any bugs etc but I suppose it should be sufficient.

Added it in the title!

 Respond  
Hawkee   -  Mar 21, 2011

Very clean and simple. I'm happy to see you've escaped the post variable. You might want to mention in the snippet title that this uses SQLite because that could catch somebody off guard.

 Respond  
Are you sure you want to unfollow this person?
Are you sure you want to delete this?
Click "Unsubscribe" to stop receiving notices pertaining to this post.
Click "Subscribe" to resume notices pertaining to this post.