How to fix XSS vulnerabilites

How to fix XSS vulnerabilites - java

We're using fortify to scan java source code & it is complaining below error:
Method abc() sends unvalidated data to a web browser on line 200, which can result in the browser executing malicious code.
We've below code on line 200:
Product
And Util.java hsa below code in getProduct method:
String prod = request.getParameter("prod");
Can any one tell me how to fix this XSS vulnerability?
Thanks!

You need to escape the output of Util.getProduct(request). Typically this is done using JSTL and a <c:out> tag and EL:
Product
N.B. you'll have to use a fairly up-to-date implementation of EL (as per JSTL or JSP 2.0 EL for getter with argument and Parameters in EL methods) in order to pass an argument to the getter method.
Since the code in your question contains scriptlets, I will strongly suggest that you read How to avoid Java code in JSP files? This question covers reasons to use JSTL+EL instead of scriptlets, as well as a bit of information about what those two acronyms actually refer to.

In case you don't have JSTL for this website, you can fix the problem by making sure you only print valid products:
public String getProduct( String prod ) throws InputValidationException {
if ( prod.equals( "myProduct1" )
|| prod.equals( "myProduct2" )
|| prod.equals( "myProduct3" )
// etc.
) {
return "/foo/page.jsp?product=" + safeProduct;
}
else {
throw new InputValidationException( "Invalid product key provided." );
}
}

Related

User Register Activity won't add user to DB [duplicate]

I'm running a PHP script and continue to receive errors like:
Notice: Undefined variable: my_variable_name in C:\wamp\www\mypath\index.php on line 10
Notice: Undefined index: my_index C:\wamp\www\mypath\index.php on line 11
Warning: Undefined array key "my_index" in C:\wamp\www\mypath\index.php on line 11
Line 10 and 11 looks like this:
echo "My variable value is: " . $my_variable_name;
echo "My index value is: " . $my_array["my_index"];
What is the meaning of these error messages?
Why do they appear all of a sudden? I used to use this script for years and I've never had any problem.
How do I fix them?
This is a General Reference question for people to link to as duplicate, instead of having to explain the issue over and over again. I feel this is necessary because most real-world answers on this issue are very specific.
Related Meta discussion:
What can be done about repetitive questions?
Do “reference questions” make sense?

Notice / Warning: Undefined variable
Although PHP does not require a variable declaration, it does recommend it in order to avoid some security vulnerabilities or bugs where one would forget to give a value to a variable that will be used later in the script. What PHP does in the case of undeclared variables is issue an error of E_WARNING level.
This warning helps a programmer to spot a misspelled variable name. Besides, there are other possible issues with uninitialized variables. As it's stated in the PHP manual,
Relying on the default value of an uninitialized variable is problematic in the case of including one file into another which uses the same variable name.
Means being uninitialized in the main file, this variable may be rewritten by a variable from the included file, that may lead to unpredictable results. To avoid that, all variables in a php file are best to be initialized
Ways to deal with the issue:
Recommended: Declare your variables, for example when you try to append a string to an undefined variable. Or use isset() to check if they are declared before referencing them, as in:
//Initializing a variable
$value = ""; //Initialization value; 0 for int, [] for array, etc.
echo $value; // no error
Suppress the error with null coalescing operator.
// Null coalescing operator
echo $value ?? '';
For the ancient PHP versions (< 7.0) isset() with ternary can be used
echo isset($value) ? $value : '';
Be aware though, that it's still essentially an error suppression, though for just one particular error. So it may prevent PHP from helping you by marking an unitialized variable.
Suppress the error with the # operator. Left here for the historical reasons but seriously, it just shouldn't happen.
Note: It's strongly recommended to implement just point 1.
Notice: Undefined index / Undefined offset / Warning: Undefined array key
This notice/warning appears when you (or PHP) try to access an undefined index of an array.
Ways to deal with the issue are pretty much the same:
Recommended: Declare your array elements:
//Initializing a variable
$array['value'] = ""; //Initialization value; 0 for int, [] for array, etc.
echo $array['value']; // no error
Suppress the error with null coalescing operator":
echo $_POST['value'] ?? '';
With arrays this operator is more justified, because it can be used with outside variables you don't have control for. Therefore, consider using it for the outside variables only, such as $_POST / $_GET / $_SESSION or JSON input. While all internal arrays are best to be predefined/initialized first.
Better yet, validate all input, assign it to local variables, and use them all the way in the code. So every variable you're going to access deliberately exists.
Related:
Notice: Undefined variable
Notice: Undefined Index

Try these
Q1: this notice means $varname is not
defined at current scope of the
script.
Q2: Use of isset(), empty() conditions before using any suspicious variable works well.
// recommended solution for recent PHP versions
$user_name = $_SESSION['user_name'] ?? '';
// pre-7 PHP versions
$user_name = '';
if (!empty($_SESSION['user_name'])) {
$user_name = $_SESSION['user_name'];
}
Or, as a quick and dirty solution:
// not the best solution, but works
// in your php setting use, it helps hiding site wide notices
error_reporting(E_ALL ^ E_NOTICE);
Note about sessions:
When using sessions, session_start(); is required to be placed inside all files using sessions.
http://php.net/manual/en/features.sessions.php

Error display # operator
For undesired and redundant notices, one could use the dedicated # operator to »hide« undefined variable/index messages.
$var = #($_GET["optional_param"]);
This is usually discouraged. Newcomers tend to way overuse it.
It's very inappropriate for code deep within the application logic (ignoring undeclared variables where you shouldn't), e.g. for function parameters, or in loops.
There's one upside over the isset?: or ?? super-supression however. Notices still can get logged. And one may resurrect #-hidden notices with: set_error_handler("var_dump");
Additonally you shouldn't habitually use/recommend if (isset($_POST["shubmit"])) in your initial code.
Newcomers won't spot such typos. It just deprives you of PHPs Notices for those very cases. Add # or isset only after verifying functionality.
Fix the cause first. Not the notices.
# is mainly acceptable for $_GET/$_POST input parameters, specifically if they're optional.
And since this covers the majority of such questions, let's expand on the most common causes:
$_GET / $_POST / $_REQUEST undefined input
First thing you do when encountering an undefined index/offset, is check for typos:
$count = $_GET["whatnow?"];
Is this an expected key name and present on each page request?
Variable names and array indicies are case-sensitive in PHP.
Secondly, if the notice doesn't have an obvious cause, use var_dump or print_r to verify all input arrays for their curent content:
var_dump($_GET);
var_dump($_POST);
//print_r($_REQUEST);
Both will reveal if your script was invoked with the right or any parameters at all.
Alternativey or additionally use your browser devtools (F12) and inspect the network tab for requests and parameters:
POST parameters and GET input will be be shown separately.
For $_GET parameters you can also peek at the QUERY_STRING in
print_r($_SERVER);
PHP has some rules to coalesce non-standard parameter names into the superglobals. Apache might do some rewriting as well.
You can also look at supplied raw $_COOKIES and other HTTP request headers that way.
More obviously look at your browser address bar for GET parameters:
http://example.org/script.php?id=5&sort=desc
The name=value pairs after the ? question mark are your query (GET) parameters. Thus this URL could only possibly yield $_GET["id"] and $_GET["sort"].
Finally check your <form> and <input> declarations, if you expect a parameter but receive none.
Ensure each required input has an <input name=FOO>
The id= or title= attribute does not suffice.
A method=POST form ought to populate $_POST.
Whereas a method=GET (or leaving it out) would yield $_GET variables.
It's also possible for a form to supply action=script.php?get=param via $_GET and the remaining method=POST fields in $_POST alongside.
With modern PHP configurations (≥ 5.6) it has become feasible (not fashionable) to use $_REQUEST['vars'] again, which mashes GET and POST params.
If you are employing mod_rewrite, then you should check both the access.log as well as enable the RewriteLog to figure out absent parameters.
$_FILES
The same sanity checks apply to file uploads and $_FILES["formname"].
Moreover check for enctype=multipart/form-data
As well as method=POST in your <form> declaration.
See also: PHP Undefined index error $_FILES?
$_COOKIE
The $_COOKIE array is never populated right after setcookie(), but only on any followup HTTP request.
Additionally their validity times out, they could be constraint to subdomains or individual paths, and user and browser can just reject or delete them.

Generally because of "bad programming", and a possibility for mistakes now or later.
If it's a mistake, make a proper assignment to the variable first: $varname=0;
If it really is only defined sometimes, test for it: if (isset($varname)), before using it
If it's because you spelled it wrong, just correct that
Maybe even turn of the warnings in you PHP-settings

It means you are testing, evaluating, or printing a variable that you have not yet assigned anything to. It means you either have a typo, or you need to check that the variable was initialized to something first. Check your logic paths, it may be set in one path but not in another.

I didn't want to disable notice because it's helpful, but I wanted to avoid too much typing.
My solution was this function:
function ifexists($varname)
{
return(isset($$varname) ? $varname : null);
}
So if I want to reference to $name and echo if exists, I simply write:
<?= ifexists('name') ?>
For array elements:
function ifexistsidx($var,$index)
{
return(isset($var[$index]) ? $var[$index] : null);
}
In a page if I want to refer to $_REQUEST['name']:
<?= ifexistsidx($_REQUEST, 'name') ?>

It’s because the variable '$user_location' is not getting defined. If you are using any if loop inside, which you are declaring the '$user_location' variable, then you must also have an else loop and define the same. For example:
$a = 10;
if($a == 5) {
$user_location = 'Paris';
}
else {
}
echo $user_location;
The above code will create an error as the if loop is not satisfied and in the else loop '$user_location' was not defined. Still PHP was asked to echo out the variable. So to modify the code you must do the following:
$a = 10;
if($a == 5) {
$user_location='Paris';
}
else {
$user_location='SOMETHING OR BLANK';
}
echo $user_location;

The best way for getting the input string is:
$value = filter_input(INPUT_POST, 'value');
This one-liner is almost equivalent to:
if (!isset($_POST['value'])) {
$value = null;
} elseif (is_array($_POST['value'])) {
$value = false;
} else {
$value = $_POST['value'];
}
If you absolutely want a string value, just like:
$value = (string)filter_input(INPUT_POST, 'value');

In reply to ""Why do they appear all of a sudden? I used to use this script for years and I've never had any problem."
It is very common for most sites to operate under the "default" error reporting of "Show all errors, but not 'notices' and 'deprecated'". This will be set in php.ini and apply to all sites on the server. This means that those "notices" used in the examples will be suppressed (hidden) while other errors, considered more critical, will be shown/recorded.
The other critical setting is the errors can be hidden (i.e. display_errors set to "off" or "syslog").
What will have happened in this case is that either the error_reporting was changed to also show notices (as per examples) and/or that the settings were changed to display_errors on screen (as opposed to suppressing them/logging them).
Why have they changed?
The obvious/simplest answer is that someone adjusted either of these settings in php.ini, or an upgraded version of PHP is now using a different php.ini from before. That's the first place to look.
However it is also possible to override these settings in
.htconf (webserver configuration, including vhosts and sub-configurations)*
.htaccess
in php code itself
and any of these could also have been changed.
There is also the added complication that the web server configuration can enable/disable .htaccess directives, so if you have directives in .htaccess that suddenly start/stop working then you need to check for that.
(.htconf / .htaccess assume you're running as apache. If running command line this won't apply; if running IIS or other webserver then you'll need to check those configs accordingly)
Summary
Check error_reporting and display_errors php directives in php.ini has not changed, or that you're not using a different php.ini from before.
Check error_reporting and display_errors php directives in .htconf (or vhosts etc) have not changed
Check error_reporting and display_errors php directives in .htaccess have not changed
If you have directive in .htaccess, check if they are still permitted in the .htconf file
Finally check your code; possibly an unrelated library; to see if error_reporting and display_errors php directives have been set there.

The quick fix is to assign your variable to null at the top of your code:
$user_location = null;

Why is this happening?
Over time, PHP has become a more security-focused language. Settings which used to be turned off by default are now turned on by default. A perfect example of this is E_STRICT, which became turned on by default as of PHP 5.4.0.
Furthermore, according to PHP documentation, by default, E_NOTICE is disabled in file php.ini. PHP documentation recommends turning it on for debugging purposes. However, when I download PHP from the Ubuntu repository–and from BitNami's Windows stack–I see something else.
; Common Values:
; E_ALL (Show all errors, warnings and notices including coding standards.)
; E_ALL & ~E_NOTICE (Show all errors, except for notices)
; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)
; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)
; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED
; Development Value: E_ALL
; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT
; http://php.net/error-reporting
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
Notice that error_reporting is actually set to the production value by default, not to the "default" value by default. This is somewhat confusing and is not documented outside of php.ini, so I have not validated this on other distributions.
To answer your question, however, this error pops up now when it did not pop up before because:
You installed PHP and the new default settings are somewhat poorly documented but do not exclude E_NOTICE.
E_NOTICE warnings like undefined variables and undefined indexes actually help to make your code cleaner and safer. I can tell you that, years ago, keeping E_NOTICE enabled forced me to declare my variables. It made it a LOT easier to learn C. In C, not declaring variables is much bigger of a nuisance.
What can I do about it?
Turn off E_NOTICE by copying the "Default value" E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED and replacing it with what is currently uncommented after the equals sign in error_reporting =. Restart Apache, or PHP if using CGI or FPM. Make sure you are editing the "right" php.ini file. The correct one will be Apache if you are running PHP with Apache, fpm or php-fpm if running PHP-FPM, cgi if running PHP-CGI, etc. This is not the recommended method, but if you have legacy code that's going to be exceedingly difficult to edit, then it might be your best bet.
Turn off E_NOTICE on the file or folder level. This might be preferable if you have some legacy code but want to do things the "right" way otherwise. To do this, you should consult Apache 2, Nginx, or whatever your server of choice is. In Apache, you would use php_value inside of <Directory>.
Rewrite your code to be cleaner. If you need to do this while moving to a production environment or don't want someone to see your errors, make sure you are disabling any display of errors, and only logging your errors (see display_errors and log_errors in php.ini and your server settings).
To expand on option 3: This is the ideal. If you can go this route, you should. If you are not going this route initially, consider moving this route eventually by testing your code in a development environment. While you're at it, get rid of ~E_STRICT and ~E_DEPRECATED to see what might go wrong in the future. You're going to see a LOT of unfamiliar errors, but it's going to stop you from having any unpleasant problems when you need to upgrade PHP in the future.
What do the errors mean?
Undefined variable: my_variable_name - This occurs when a variable has not been defined before use. When the PHP script is executed, it internally just assumes a null value. However, in which scenario would you need to check a variable before it was defined? Ultimately, this is an argument for "sloppy code". As a developer, I can tell you that I love it when I see an open source project where variables are defined as high up in their scopes as they can be defined. It makes it easier to tell what variables are going to pop up in the future and makes it easier to read/learn the code.
function foo()
{
$my_variable_name = '';
//....
if ($my_variable_name) {
// perform some logic
}
}
Undefined index: my_index - This occurs when you try to access a value in an array and it does not exist. To prevent this error, perform a conditional check.
// verbose way - generally better
if (isset($my_array['my_index'])) {
echo "My index value is: " . $my_array['my_index'];
}
// non-verbose ternary example - I use this sometimes for small rules.
$my_index_val = isset($my_array['my_index'])?$my_array['my_index']:'(undefined)';
echo "My index value is: " . $my_index_val;
Another option is to declare an empty array at the top of your function. This is not always possible.
$my_array = array(
'my_index' => ''
);
//...
$my_array['my_index'] = 'new string';
(Additional tip)
When I was encountering these and other issues, I used NetBeanss IDE (free) and it gave me a host of warnings and notices. Some of them offer very helpful tips. This is not a requirement, and I don't use IDEs anymore except for large projects. I'm more of a vim person these days :).

I used to curse this error, but it can be helpful to remind you to escape user input.
For instance, if you thought this was clever, shorthand code:
// Echo whatever the hell this is
<?=$_POST['something']?>
...Think again! A better solution is:
// If this is set, echo a filtered version
<?=isset($_POST['something']) ? html($_POST['something']) : ''?>
(I use a custom html() function to escape characters, your mileage may vary)

In PHP 7.0 it's now possible to use the null coalescing operator:
echo "My index value is: " . ($my_array["my_index"] ?? '');
Is equals to:
echo "My index value is: " . (isset($my_array["my_index"]) ? $my_array["my_index"] : '');
PHP manual PHP 7.0

I use my own useful function, exst(), all time which automatically declares variables.
Your code will be -
$greeting = "Hello, " . exst($user_name, 'Visitor') . " from " . exst($user_location);
/**
* Function exst() - Checks if the variable has been set
* (copy/paste it in any place of your code)
*
* If the variable is set and not empty returns the variable (no transformation)
* If the variable is not set or empty, returns the $default value
*
* #param mixed $var
* #param mixed $default
*
* #return mixed
*/
function exst(& $var, $default = "")
{
$t = "";
if (!isset($var) || !$var) {
if (isset($default) && $default != "")
$t = $default;
}
else {
$t = $var;
}
if (is_string($t))
$t = trim($t);
return $t;
}

In a very simple language:
The mistake is you are using a variable $user_location which is not defined by you earlier, and it doesn't have any value. So I recommend you to please declare this variable before using it. For example: $user_location = '';Or $user_location = 'Los Angles';
This is a very common error you can face. So don't worry; just declare the variable and enjoy coding.

Keep things simple:
<?php
error_reporting(E_ALL); // Making sure all notices are on
function idxVal(&$var, $default = null) {
return empty($var) ? $var = $default : $var;
}
echo idxVal($arr['test']); // Returns null without any notice
echo idxVal($arr['hey ho'], 'yo'); // Returns yo and assigns it to the array index. Nice
?>

An undefined index means in an array you requested for an unavailable array index. For example,
<?php
$newArray[] = {1, 2, 3, 4, 5};
print_r($newArray[5]);
?>
An undefined variable means you have used completely not an existing variable or which is not defined or initialized by that name. For example,
<?php print_r($myvar); ?>
An undefined offset means in an array you have asked for a nonexisting key. And the solution for this is to check before use:
php> echo array_key_exists(1, $myarray);

Regarding this part of the question:
Why do they appear all of a sudden? I used to use this script for years and I've never had any problem.
No definite answers but here are a some possible explanations of why settings can 'suddenly' change:
You have upgraded PHP to a newer version which can have other defaults for error_reporting, display_errors or other relevant settings.
You have removed or introduced some code (possibly in a dependency) that sets relevant settings at runtime using ini_set() or error_reporting() (search for these in the code)
You changed the webserver configuration (assuming apache here): .htaccess files and vhost configurations can also manipulate php settings.
Usually notices don't get displayed / reported (see PHP manual)
so it is possible that when setting up the server, the php.ini file could not be loaded for some reason (file permissions??) and you were on the default settings. Later on, the 'bug' has been solved (by accident) and now it CAN load the correct php.ini file with the error_reporting set to show notices.

Using a ternary operator is simple, readable, and clean:
Pre PHP 7
Assign a variable to the value of another variable if it's set, else assign null (or whatever default value you need):
$newVariable = isset($thePotentialData) ? $thePotentialData : null;
PHP 7+
The same except using the null coalescing operator. There's no longer a need to call isset() as this is built in, and no need to provide the variable to return as it's assumed to return the value of the variable being checked:
$newVariable = $thePotentialData ?? null;
Both will stop the Notices from the OP's question, and both are the exact equivalent of:
if (isset($thePotentialData)) {
$newVariable = $thePotentialData;
} else {
$newVariable = null;
}
If you don't require setting a new variable then you can directly use the ternary operator's returned value, such as with echo, function arguments, etc.:
Echo:
echo 'Your name is: ' . isset($name) ? $name : 'You did not provide one';
Function:
$foreName = getForeName(isset($userId) ? $userId : null);
function getForeName($userId)
{
if ($userId === null) {
// Etc
}
}
The above will work just the same with arrays, including sessions, etc., replacing the variable being checked with e.g.:
$_SESSION['checkMe']
Or however many levels deep you need, e.g.:
$clients['personal']['address']['postcode']
Suppression:
It is possible to suppress the PHP Notices with # or reduce your error reporting level, but it does not fix the problem. It simply stops it being reported in the error log. This means that your code still tried to use a variable that was not set, which may or may not mean something doesn't work as intended - depending on how crucial the missing value is.
You should really be checking for this issue and handling it appropriately, either serving a different message, or even just returning a null value for everything else to identify the precise state.
If you just care about the Notice not being in the error log, then as an option you could simply ignore the error log.

If working with classes you need to make sure you reference member variables using $this:
class Person
{
protected $firstName;
protected $lastName;
public function setFullName($first, $last)
{
// Correct
$this->firstName = $first;
// Incorrect
$lastName = $last;
// Incorrect
$this->$lastName = $last;
}
}

Another reason why an undefined index notice will be thrown, would be that a column was omitted from a database query.
I.e.:
$query = "SELECT col1 FROM table WHERE col_x = ?";
Then trying to access more columns/rows inside a loop.
I.e.:
print_r($row['col1']);
print_r($row['col2']); // undefined index thrown
or in a while loop:
while( $row = fetching_function($query) ) {
echo $row['col1'];
echo "<br>";
echo $row['col2']; // undefined index thrown
echo "<br>";
echo $row['col3']; // undefined index thrown
}
Something else that needs to be noted is that on a *NIX OS and Mac OS X, things are case-sensitive.
Consult the followning Q&A's on Stack:
Are table names in MySQL case sensitive?
mysql case sensitive table names in queries
MySql - Case Sensitive issue of tables in different server

One common cause of a variable not existing after an HTML form has been submitted is the form element is not contained within a <form> tag:
Example: Element not contained within the <form>
<form action="example.php" method="post">
<p>
<input type="text" name="name" />
<input type="submit" value="Submit" />
</p>
</form>
<select name="choice">
<option value="choice1">choice 1</option>
<option value="choice2">choice 2</option>
<option value="choice3">choice 3</option>
<option value="choice4">choice 4</option>
</select>
Example: Element now contained within the <form>
<form action="example.php" method="post">
<select name="choice">
<option value="choice1">choice 1</option>
<option value="choice2">choice 2</option>
<option value="choice3">choice 3</option>
<option value="choice4">choice 4</option>
</select>
<p>
<input type="text" name="name" />
<input type="submit" value="Submit" />
</p>
</form>

These errors occur whenever we are using a variable that is not set.
The best way to deal with these is set error reporting on while development.
To set error reporting on:
ini_set('error_reporting', 'on');
ini_set('display_errors', 'on');
error_reporting(E_ALL);
On production servers, error reporting is off, therefore, we do not get these errors.
On the development server, however, we can set error reporting on.
To get rid of this error, we see the following example:
if ($my == 9) {
$test = 'yes'; // Will produce an error as $my is not 9.
}
echo $test;
We can initialize the variables to NULL before assigning their values or using them.
So, we can modify the code as:
$test = NULL;
if ($my == 9) {
$test = 'yes'; // Will produce an error as $my is not 9.
}
echo $test;
This will not disturb any program logic and will not produce a Notice even if $test does not have a value.
So, basically, it’s always better to set error reporting ON for development.
And fix all the errors.
And on production, error reporting should be set to off.

I asked a question about this and I was referred to this post with the message:
This question already has an answer here:
“Notice: Undefined variable”, “Notice: Undefined index”, and “Notice:
Undefined offset” using PHP
I am sharing my question and solution here:
This is the error:
Line 154 is the problem. This is what I have in line 154:
153 foreach($cities as $key => $city){
154 if(($city != 'London') && ($city != 'Madrid') && ($citiesCounterArray[$key] >= 1)){
I think the problem is that I am writing if conditions for the variable $city, which is not the key but the value in $key => $city. First, could you confirm if that is the cause of the warning? Second, if that is the problem, why is it that I cannot write a condition based on the value? Does it have to be with the key that I need to write the condition?
UPDATE 1: The problem is that when executing $citiesCounterArray[$key], sometimes the $key corresponds to a key that does not exist in the $citiesCounterArray array, but that is not always the case based on the data of my loop. What I need is to set a condition so that if $key exists in the array, then run the code, otherwise, skip it.
UPDATE 2: This is how I fixed it by using array_key_exists():
foreach($cities as $key => $city){
if(array_key_exists($key, $citiesCounterArray)){
if(($city != 'London') && ($city != 'Madrid') && ($citiesCounterArray[$key] >= 1)){

Probably you were using an old PHP version until and now upgraded PHP that’s the reason it was working without any error till now from years.
Until PHP 4 there was no error if you are using variable without defining it but as of PHP 5 onwards it throws errors for codes like mentioned in question.

If you are sending data to an API, simply use isset():
if(isset($_POST['param'])){
$param = $_POST['param'];
} else {
# Do something else
}
If it is an error is because of a session, make sure you have started the session properly.

Those notices are because you don't have the used variable defined and my_index key was not present into $my_array variable.
Those notices were triggered every time, because your code is not correct, but probably you didn't have the reporting of notices on.
Solve the bugs:
$my_variable_name = "Variable name"; // defining variable
echo "My variable value is: " . $my_variable_name;
if(isset($my_array["my_index"])){
echo "My index value is: " . $my_array["my_index"]; // check if my_index is set
}
Another way to get this out:
ini_set("error_reporting", false)

When dealing with files, a proper enctype and a POST method are required, which will trigger an undefined index notice if either are not included in the form.
The manual states the following basic syntax:
HTML
<!-- The data encoding type, enctype, MUST be specified as below -->
<form enctype="multipart/form-data" action="__URL__" method="POST">
<!-- MAX_FILE_SIZE must precede the file input field -->
<input type="hidden" name="MAX_FILE_SIZE" value="30000" />
<!-- Name of input element determines name in $_FILES array -->
Send this file: <input name="userfile" type="file" />
<input type="submit" value="Send File" />
</form>
PHP
<?php
// In PHP versions earlier than 4.1.0, $HTTP_POST_FILES should be used instead
// of $_FILES.
$uploaddir = '/var/www/uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
echo '<pre>';
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
echo "File is valid, and was successfully uploaded.\n";
} else {
echo "Possible file upload attack!\n";
}
echo 'Here is some more debugging info:';
print_r($_FILES);
print "</pre>";
?>
Reference:
POST method uploads

In PHP you need first to define the variable. After that you can use it.
We can check if a variable is defined or not in a very efficient way!
// If you only want to check variable has value and value has true and false value.
// But variable must be defined first.
if($my_variable_name){
}
// If you want to check if the variable is defined or undefined
// Isset() does not check that variable has a true or false value
// But it checks the null value of a variable
if(isset($my_variable_name)){
}
Simple Explanation
// It will work with: true, false, and NULL
$defineVariable = false;
if($defineVariable){
echo "true";
}else{
echo "false";
}
// It will check if the variable is defined or not and if the variable has a null value.
if(isset($unDefineVariable)){
echo "true";
}else{
echo "false";
}

Can't send mp4 file to folder [duplicate]

I'm running a PHP script and continue to receive errors like:
Notice: Undefined variable: my_variable_name in C:\wamp\www\mypath\index.php on line 10
Notice: Undefined index: my_index C:\wamp\www\mypath\index.php on line 11
Warning: Undefined array key "my_index" in C:\wamp\www\mypath\index.php on line 11
Line 10 and 11 looks like this:
echo "My variable value is: " . $my_variable_name;
echo "My index value is: " . $my_array["my_index"];
What is the meaning of these error messages?
Why do they appear all of a sudden? I used to use this script for years and I've never had any problem.
How do I fix them?
This is a General Reference question for people to link to as duplicate, instead of having to explain the issue over and over again. I feel this is necessary because most real-world answers on this issue are very specific.
Related Meta discussion:
What can be done about repetitive questions?
Do “reference questions” make sense?

Try these
Q1: this notice means $varname is not
defined at current scope of the
script.
Q2: Use of isset(), empty() conditions before using any suspicious variable works well.
// recommended solution for recent PHP versions
$user_name = $_SESSION['user_name'] ?? '';
// pre-7 PHP versions
$user_name = '';
if (!empty($_SESSION['user_name'])) {
$user_name = $_SESSION['user_name'];
}
Or, as a quick and dirty solution:
// not the best solution, but works
// in your php setting use, it helps hiding site wide notices
error_reporting(E_ALL ^ E_NOTICE);
Note about sessions:
When using sessions, session_start(); is required to be placed inside all files using sessions.
http://php.net/manual/en/features.sessions.php

Error display # operator
For undesired and redundant notices, one could use the dedicated # operator to »hide« undefined variable/index messages.
$var = #($_GET["optional_param"]);
This is usually discouraged. Newcomers tend to way overuse it.
It's very inappropriate for code deep within the application logic (ignoring undeclared variables where you shouldn't), e.g. for function parameters, or in loops.
There's one upside over the isset?: or ?? super-supression however. Notices still can get logged. And one may resurrect #-hidden notices with: set_error_handler("var_dump");
Additonally you shouldn't habitually use/recommend if (isset($_POST["shubmit"])) in your initial code.
Newcomers won't spot such typos. It just deprives you of PHPs Notices for those very cases. Add # or isset only after verifying functionality.
Fix the cause first. Not the notices.
# is mainly acceptable for $_GET/$_POST input parameters, specifically if they're optional.
And since this covers the majority of such questions, let's expand on the most common causes:
$_GET / $_POST / $_REQUEST undefined input
First thing you do when encountering an undefined index/offset, is check for typos:
$count = $_GET["whatnow?"];
Is this an expected key name and present on each page request?
Variable names and array indicies are case-sensitive in PHP.
Secondly, if the notice doesn't have an obvious cause, use var_dump or print_r to verify all input arrays for their curent content:
var_dump($_GET);
var_dump($_POST);
//print_r($_REQUEST);
Both will reveal if your script was invoked with the right or any parameters at all.
Alternativey or additionally use your browser devtools (F12) and inspect the network tab for requests and parameters:
POST parameters and GET input will be be shown separately.
For $_GET parameters you can also peek at the QUERY_STRING in
print_r($_SERVER);
PHP has some rules to coalesce non-standard parameter names into the superglobals. Apache might do some rewriting as well.
You can also look at supplied raw $_COOKIES and other HTTP request headers that way.
More obviously look at your browser address bar for GET parameters:
http://example.org/script.php?id=5&sort=desc
The name=value pairs after the ? question mark are your query (GET) parameters. Thus this URL could only possibly yield $_GET["id"] and $_GET["sort"].
Finally check your <form> and <input> declarations, if you expect a parameter but receive none.
Ensure each required input has an <input name=FOO>
The id= or title= attribute does not suffice.
A method=POST form ought to populate $_POST.
Whereas a method=GET (or leaving it out) would yield $_GET variables.
It's also possible for a form to supply action=script.php?get=param via $_GET and the remaining method=POST fields in $_POST alongside.
With modern PHP configurations (≥ 5.6) it has become feasible (not fashionable) to use $_REQUEST['vars'] again, which mashes GET and POST params.
If you are employing mod_rewrite, then you should check both the access.log as well as enable the RewriteLog to figure out absent parameters.
$_FILES
The same sanity checks apply to file uploads and $_FILES["formname"].
Moreover check for enctype=multipart/form-data
As well as method=POST in your <form> declaration.
See also: PHP Undefined index error $_FILES?
$_COOKIE
The $_COOKIE array is never populated right after setcookie(), but only on any followup HTTP request.
Additionally their validity times out, they could be constraint to subdomains or individual paths, and user and browser can just reject or delete them.

Generally because of "bad programming", and a possibility for mistakes now or later.
If it's a mistake, make a proper assignment to the variable first: $varname=0;
If it really is only defined sometimes, test for it: if (isset($varname)), before using it
If it's because you spelled it wrong, just correct that
Maybe even turn of the warnings in you PHP-settings

It means you are testing, evaluating, or printing a variable that you have not yet assigned anything to. It means you either have a typo, or you need to check that the variable was initialized to something first. Check your logic paths, it may be set in one path but not in another.

I didn't want to disable notice because it's helpful, but I wanted to avoid too much typing.
My solution was this function:
function ifexists($varname)
{
return(isset($$varname) ? $varname : null);
}
So if I want to reference to $name and echo if exists, I simply write:
<?= ifexists('name') ?>
For array elements:
function ifexistsidx($var,$index)
{
return(isset($var[$index]) ? $var[$index] : null);
}
In a page if I want to refer to $_REQUEST['name']:
<?= ifexistsidx($_REQUEST, 'name') ?>

It’s because the variable '$user_location' is not getting defined. If you are using any if loop inside, which you are declaring the '$user_location' variable, then you must also have an else loop and define the same. For example:
$a = 10;
if($a == 5) {
$user_location = 'Paris';
}
else {
}
echo $user_location;
The above code will create an error as the if loop is not satisfied and in the else loop '$user_location' was not defined. Still PHP was asked to echo out the variable. So to modify the code you must do the following:
$a = 10;
if($a == 5) {
$user_location='Paris';
}
else {
$user_location='SOMETHING OR BLANK';
}
echo $user_location;

The best way for getting the input string is:
$value = filter_input(INPUT_POST, 'value');
This one-liner is almost equivalent to:
if (!isset($_POST['value'])) {
$value = null;
} elseif (is_array($_POST['value'])) {
$value = false;
} else {
$value = $_POST['value'];
}
If you absolutely want a string value, just like:
$value = (string)filter_input(INPUT_POST, 'value');

The quick fix is to assign your variable to null at the top of your code:
$user_location = null;

Why is this happening?
Over time, PHP has become a more security-focused language. Settings which used to be turned off by default are now turned on by default. A perfect example of this is E_STRICT, which became turned on by default as of PHP 5.4.0.
Furthermore, according to PHP documentation, by default, E_NOTICE is disabled in file php.ini. PHP documentation recommends turning it on for debugging purposes. However, when I download PHP from the Ubuntu repository–and from BitNami's Windows stack–I see something else.
; Common Values:
; E_ALL (Show all errors, warnings and notices including coding standards.)
; E_ALL & ~E_NOTICE (Show all errors, except for notices)
; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)
; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)
; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED
; Development Value: E_ALL
; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT
; http://php.net/error-reporting
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
Notice that error_reporting is actually set to the production value by default, not to the "default" value by default. This is somewhat confusing and is not documented outside of php.ini, so I have not validated this on other distributions.
To answer your question, however, this error pops up now when it did not pop up before because:
You installed PHP and the new default settings are somewhat poorly documented but do not exclude E_NOTICE.
E_NOTICE warnings like undefined variables and undefined indexes actually help to make your code cleaner and safer. I can tell you that, years ago, keeping E_NOTICE enabled forced me to declare my variables. It made it a LOT easier to learn C. In C, not declaring variables is much bigger of a nuisance.
What can I do about it?
Turn off E_NOTICE by copying the "Default value" E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED and replacing it with what is currently uncommented after the equals sign in error_reporting =. Restart Apache, or PHP if using CGI or FPM. Make sure you are editing the "right" php.ini file. The correct one will be Apache if you are running PHP with Apache, fpm or php-fpm if running PHP-FPM, cgi if running PHP-CGI, etc. This is not the recommended method, but if you have legacy code that's going to be exceedingly difficult to edit, then it might be your best bet.
Turn off E_NOTICE on the file or folder level. This might be preferable if you have some legacy code but want to do things the "right" way otherwise. To do this, you should consult Apache 2, Nginx, or whatever your server of choice is. In Apache, you would use php_value inside of <Directory>.
Rewrite your code to be cleaner. If you need to do this while moving to a production environment or don't want someone to see your errors, make sure you are disabling any display of errors, and only logging your errors (see display_errors and log_errors in php.ini and your server settings).
To expand on option 3: This is the ideal. If you can go this route, you should. If you are not going this route initially, consider moving this route eventually by testing your code in a development environment. While you're at it, get rid of ~E_STRICT and ~E_DEPRECATED to see what might go wrong in the future. You're going to see a LOT of unfamiliar errors, but it's going to stop you from having any unpleasant problems when you need to upgrade PHP in the future.
What do the errors mean?
Undefined variable: my_variable_name - This occurs when a variable has not been defined before use. When the PHP script is executed, it internally just assumes a null value. However, in which scenario would you need to check a variable before it was defined? Ultimately, this is an argument for "sloppy code". As a developer, I can tell you that I love it when I see an open source project where variables are defined as high up in their scopes as they can be defined. It makes it easier to tell what variables are going to pop up in the future and makes it easier to read/learn the code.
function foo()
{
$my_variable_name = '';
//....
if ($my_variable_name) {
// perform some logic
}
}
Undefined index: my_index - This occurs when you try to access a value in an array and it does not exist. To prevent this error, perform a conditional check.
// verbose way - generally better
if (isset($my_array['my_index'])) {
echo "My index value is: " . $my_array['my_index'];
}
// non-verbose ternary example - I use this sometimes for small rules.
$my_index_val = isset($my_array['my_index'])?$my_array['my_index']:'(undefined)';
echo "My index value is: " . $my_index_val;
Another option is to declare an empty array at the top of your function. This is not always possible.
$my_array = array(
'my_index' => ''
);
//...
$my_array['my_index'] = 'new string';
(Additional tip)
When I was encountering these and other issues, I used NetBeanss IDE (free) and it gave me a host of warnings and notices. Some of them offer very helpful tips. This is not a requirement, and I don't use IDEs anymore except for large projects. I'm more of a vim person these days :).

I used to curse this error, but it can be helpful to remind you to escape user input.
For instance, if you thought this was clever, shorthand code:
// Echo whatever the hell this is
<?=$_POST['something']?>
...Think again! A better solution is:
// If this is set, echo a filtered version
<?=isset($_POST['something']) ? html($_POST['something']) : ''?>
(I use a custom html() function to escape characters, your mileage may vary)

In PHP 7.0 it's now possible to use the null coalescing operator:
echo "My index value is: " . ($my_array["my_index"] ?? '');
Is equals to:
echo "My index value is: " . (isset($my_array["my_index"]) ? $my_array["my_index"] : '');
PHP manual PHP 7.0

I use my own useful function, exst(), all time which automatically declares variables.
Your code will be -
$greeting = "Hello, " . exst($user_name, 'Visitor') . " from " . exst($user_location);
/**
* Function exst() - Checks if the variable has been set
* (copy/paste it in any place of your code)
*
* If the variable is set and not empty returns the variable (no transformation)
* If the variable is not set or empty, returns the $default value
*
* #param mixed $var
* #param mixed $default
*
* #return mixed
*/
function exst(& $var, $default = "")
{
$t = "";
if (!isset($var) || !$var) {
if (isset($default) && $default != "")
$t = $default;
}
else {
$t = $var;
}
if (is_string($t))
$t = trim($t);
return $t;
}

In a very simple language:
The mistake is you are using a variable $user_location which is not defined by you earlier, and it doesn't have any value. So I recommend you to please declare this variable before using it. For example: $user_location = '';Or $user_location = 'Los Angles';
This is a very common error you can face. So don't worry; just declare the variable and enjoy coding.

Keep things simple:
<?php
error_reporting(E_ALL); // Making sure all notices are on
function idxVal(&$var, $default = null) {
return empty($var) ? $var = $default : $var;
}
echo idxVal($arr['test']); // Returns null without any notice
echo idxVal($arr['hey ho'], 'yo'); // Returns yo and assigns it to the array index. Nice
?>

An undefined index means in an array you requested for an unavailable array index. For example,
<?php
$newArray[] = {1, 2, 3, 4, 5};
print_r($newArray[5]);
?>
An undefined variable means you have used completely not an existing variable or which is not defined or initialized by that name. For example,
<?php print_r($myvar); ?>
An undefined offset means in an array you have asked for a nonexisting key. And the solution for this is to check before use:
php> echo array_key_exists(1, $myarray);

Regarding this part of the question:
Why do they appear all of a sudden? I used to use this script for years and I've never had any problem.
No definite answers but here are a some possible explanations of why settings can 'suddenly' change:
You have upgraded PHP to a newer version which can have other defaults for error_reporting, display_errors or other relevant settings.
You have removed or introduced some code (possibly in a dependency) that sets relevant settings at runtime using ini_set() or error_reporting() (search for these in the code)
You changed the webserver configuration (assuming apache here): .htaccess files and vhost configurations can also manipulate php settings.
Usually notices don't get displayed / reported (see PHP manual)
so it is possible that when setting up the server, the php.ini file could not be loaded for some reason (file permissions??) and you were on the default settings. Later on, the 'bug' has been solved (by accident) and now it CAN load the correct php.ini file with the error_reporting set to show notices.

Using a ternary operator is simple, readable, and clean:
Pre PHP 7
Assign a variable to the value of another variable if it's set, else assign null (or whatever default value you need):
$newVariable = isset($thePotentialData) ? $thePotentialData : null;
PHP 7+
The same except using the null coalescing operator. There's no longer a need to call isset() as this is built in, and no need to provide the variable to return as it's assumed to return the value of the variable being checked:
$newVariable = $thePotentialData ?? null;
Both will stop the Notices from the OP's question, and both are the exact equivalent of:
if (isset($thePotentialData)) {
$newVariable = $thePotentialData;
} else {
$newVariable = null;
}
If you don't require setting a new variable then you can directly use the ternary operator's returned value, such as with echo, function arguments, etc.:
Echo:
echo 'Your name is: ' . isset($name) ? $name : 'You did not provide one';
Function:
$foreName = getForeName(isset($userId) ? $userId : null);
function getForeName($userId)
{
if ($userId === null) {
// Etc
}
}
The above will work just the same with arrays, including sessions, etc., replacing the variable being checked with e.g.:
$_SESSION['checkMe']
Or however many levels deep you need, e.g.:
$clients['personal']['address']['postcode']
Suppression:
It is possible to suppress the PHP Notices with # or reduce your error reporting level, but it does not fix the problem. It simply stops it being reported in the error log. This means that your code still tried to use a variable that was not set, which may or may not mean something doesn't work as intended - depending on how crucial the missing value is.
You should really be checking for this issue and handling it appropriately, either serving a different message, or even just returning a null value for everything else to identify the precise state.
If you just care about the Notice not being in the error log, then as an option you could simply ignore the error log.

If working with classes you need to make sure you reference member variables using $this:
class Person
{
protected $firstName;
protected $lastName;
public function setFullName($first, $last)
{
// Correct
$this->firstName = $first;
// Incorrect
$lastName = $last;
// Incorrect
$this->$lastName = $last;
}
}

Another reason why an undefined index notice will be thrown, would be that a column was omitted from a database query.
I.e.:
$query = "SELECT col1 FROM table WHERE col_x = ?";
Then trying to access more columns/rows inside a loop.
I.e.:
print_r($row['col1']);
print_r($row['col2']); // undefined index thrown
or in a while loop:
while( $row = fetching_function($query) ) {
echo $row['col1'];
echo "<br>";
echo $row['col2']; // undefined index thrown
echo "<br>";
echo $row['col3']; // undefined index thrown
}
Something else that needs to be noted is that on a *NIX OS and Mac OS X, things are case-sensitive.
Consult the followning Q&A's on Stack:
Are table names in MySQL case sensitive?
mysql case sensitive table names in queries
MySql - Case Sensitive issue of tables in different server

One common cause of a variable not existing after an HTML form has been submitted is the form element is not contained within a <form> tag:
Example: Element not contained within the <form>
<form action="example.php" method="post">
<p>
<input type="text" name="name" />
<input type="submit" value="Submit" />
</p>
</form>
<select name="choice">
<option value="choice1">choice 1</option>
<option value="choice2">choice 2</option>
<option value="choice3">choice 3</option>
<option value="choice4">choice 4</option>
</select>
Example: Element now contained within the <form>
<form action="example.php" method="post">
<select name="choice">
<option value="choice1">choice 1</option>
<option value="choice2">choice 2</option>
<option value="choice3">choice 3</option>
<option value="choice4">choice 4</option>
</select>
<p>
<input type="text" name="name" />
<input type="submit" value="Submit" />
</p>
</form>

These errors occur whenever we are using a variable that is not set.
The best way to deal with these is set error reporting on while development.
To set error reporting on:
ini_set('error_reporting', 'on');
ini_set('display_errors', 'on');
error_reporting(E_ALL);
On production servers, error reporting is off, therefore, we do not get these errors.
On the development server, however, we can set error reporting on.
To get rid of this error, we see the following example:
if ($my == 9) {
$test = 'yes'; // Will produce an error as $my is not 9.
}
echo $test;
We can initialize the variables to NULL before assigning their values or using them.
So, we can modify the code as:
$test = NULL;
if ($my == 9) {
$test = 'yes'; // Will produce an error as $my is not 9.
}
echo $test;
This will not disturb any program logic and will not produce a Notice even if $test does not have a value.
So, basically, it’s always better to set error reporting ON for development.
And fix all the errors.
And on production, error reporting should be set to off.

I asked a question about this and I was referred to this post with the message:
This question already has an answer here:
“Notice: Undefined variable”, “Notice: Undefined index”, and “Notice:
Undefined offset” using PHP
I am sharing my question and solution here:
This is the error:
Line 154 is the problem. This is what I have in line 154:
153 foreach($cities as $key => $city){
154 if(($city != 'London') && ($city != 'Madrid') && ($citiesCounterArray[$key] >= 1)){
I think the problem is that I am writing if conditions for the variable $city, which is not the key but the value in $key => $city. First, could you confirm if that is the cause of the warning? Second, if that is the problem, why is it that I cannot write a condition based on the value? Does it have to be with the key that I need to write the condition?
UPDATE 1: The problem is that when executing $citiesCounterArray[$key], sometimes the $key corresponds to a key that does not exist in the $citiesCounterArray array, but that is not always the case based on the data of my loop. What I need is to set a condition so that if $key exists in the array, then run the code, otherwise, skip it.
UPDATE 2: This is how I fixed it by using array_key_exists():
foreach($cities as $key => $city){
if(array_key_exists($key, $citiesCounterArray)){
if(($city != 'London') && ($city != 'Madrid') && ($citiesCounterArray[$key] >= 1)){

Probably you were using an old PHP version until and now upgraded PHP that’s the reason it was working without any error till now from years.
Until PHP 4 there was no error if you are using variable without defining it but as of PHP 5 onwards it throws errors for codes like mentioned in question.

If you are sending data to an API, simply use isset():
if(isset($_POST['param'])){
$param = $_POST['param'];
} else {
# Do something else
}
If it is an error is because of a session, make sure you have started the session properly.

Those notices are because you don't have the used variable defined and my_index key was not present into $my_array variable.
Those notices were triggered every time, because your code is not correct, but probably you didn't have the reporting of notices on.
Solve the bugs:
$my_variable_name = "Variable name"; // defining variable
echo "My variable value is: " . $my_variable_name;
if(isset($my_array["my_index"])){
echo "My index value is: " . $my_array["my_index"]; // check if my_index is set
}
Another way to get this out:
ini_set("error_reporting", false)

When dealing with files, a proper enctype and a POST method are required, which will trigger an undefined index notice if either are not included in the form.
The manual states the following basic syntax:
HTML
<!-- The data encoding type, enctype, MUST be specified as below -->
<form enctype="multipart/form-data" action="__URL__" method="POST">
<!-- MAX_FILE_SIZE must precede the file input field -->
<input type="hidden" name="MAX_FILE_SIZE" value="30000" />
<!-- Name of input element determines name in $_FILES array -->
Send this file: <input name="userfile" type="file" />
<input type="submit" value="Send File" />
</form>
PHP
<?php
// In PHP versions earlier than 4.1.0, $HTTP_POST_FILES should be used instead
// of $_FILES.
$uploaddir = '/var/www/uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
echo '<pre>';
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
echo "File is valid, and was successfully uploaded.\n";
} else {
echo "Possible file upload attack!\n";
}
echo 'Here is some more debugging info:';
print_r($_FILES);
print "</pre>";
?>
Reference:
POST method uploads

In PHP you need first to define the variable. After that you can use it.
We can check if a variable is defined or not in a very efficient way!
// If you only want to check variable has value and value has true and false value.
// But variable must be defined first.
if($my_variable_name){
}
// If you want to check if the variable is defined or undefined
// Isset() does not check that variable has a true or false value
// But it checks the null value of a variable
if(isset($my_variable_name)){
}
Simple Explanation
// It will work with: true, false, and NULL
$defineVariable = false;
if($defineVariable){
echo "true";
}else{
echo "false";
}
// It will check if the variable is defined or not and if the variable has a null value.
if(isset($unDefineVariable)){
echo "true";
}else{
echo "false";
}

How to make sure there is not any parameter in the url?

I know how to make sure if a specific parameter exists in the url.
I would like to make sure there is not any parameter in the url not just a specified one. How can I accomplish this? I have a long list of parameters and it looks like inefficient to have a list of conditions for all of them.
Sample URL is: www.domain.com/Product/UniqueId
As each product has many unique parameters, users might reach product pages through, unique code,unique supplier, unique sig, unique pod etc of the products.
For example:
www.domain.com/Product/UniqueId?code=uniqueCode
www.domain.com/Product/UniqueId?sig=uniqueSig
www.domain.com/Product/UniqueId?pod=uniquepod
www.domain.com/Product/UniqueId?circle=circleNumber&location=Location&color=Color
The questions that I found relevant but not useful in my case were 1,2,3,4
I need to do such testing in JSP not Java.

This works out a bit easier with the URI class:
import java.net.MalformedURLException;
import java.net.URI;
import java.net.URISyntaxException;
public class UrlTest2
{
public static void main( String[] args )
throws MalformedURLException, URISyntaxException
{
URI url = new URI( "www.domain.com/Product/UniqueId" );
System.out.println( url.getQuery() ); // prints "null"
URI url2 = new URI( "www.domain.com/Product/UniqueId?pod=uniquepod" );
System.out.println( url2.getQuery() ); // prints "pod=uniquepod"
}
}
So if getQuery() returns null there are no parameters. Otherwise, there are.
Regarding your edit: Well, I don't really recommend putting code inside a JSP. It's consider bad practice nowadays.
But if you must, it looks like you can ask for all of the parameters and if the result is 0, there weren't any.
<%
Map params = request.getParameterMap();
boolean noParams = (params.getSize() == 0);
%>
JSP code is untested, but should give you the idea. You can then use the boolean noParams later in the JSP code.

Followup
With the new requirement that it has to be done in JSP, even though the Spring handler code listed in the original answer below could add a Model attribute with the relevant information, here is how to do that.
Similar two ways as below:
<!-- Use the parameter Map -->
<c:if test="${empty param}">
<!-- no query parameters given -->
</c:if>
<!-- Use the request object -->
<c:if test="${pageContext.request.queryString == null}">
<!-- no query parameters given -->
</c:if>
Original Answer
You tagged spring-mvc, so that means you have something like this (would have been nice if you had posted it):
#Controller
public class ProductController {
#RequestMapping("/Product/UniqueId")
public String uniqueId(Model model,
#RequestParam(path="code" , required=false) String code,
#RequestParam(path="sig" , required=false) String sig,
#RequestParam(path="pod" , required=false) String pod,
#RequestParam(path="circle" , required=false) String circle,
#RequestParam(path="location", required=false) String location,
#RequestParam(path="color" , required=false) String color) {
// code here
}
}
Here are two ways of checking for "no query parameters":
// Get all parameters in a Map
public String uniqueId(Model model,
...,
#RequestParam Map<String, String> allParams) {
if (allParams.isEmpty()) {
// no query parameters given
}
// code here
}
// Use the request object
public String uniqueId(Model model,
...,
HttpServletRequest request) {
if (request.getQueryString() == null) {
// no query parameters given
}
// code here
}
You might want to check this link for all the various types of parameters that Spring can give you:
http://docs.spring.io/spring-framework/docs/current/spring-framework-reference/html/mvc.html#mvc-ann-arguments

try this http://docs.oracle.com/javase/7/docs/api/java/lang/String.html#contains(java.lang.CharSequence).
I gave you code just to find is there any parameters passed in url. It won't give the number of parameters like that..
String stringObj ="www.domain.com/Product/UniqueId";
(stringObj.contains("?"))?true: false;

Not sure what you mean by "to make sure there is not any parameter".. you just can't, clients can use whatever URL they want to hit your server. You can only choose to process based on the URL string your server code receives.
Otherwise, here is two pointers:
Are you trying to check or parse the URL ? If so you can do:
url.indexOf('?') < 0 , assuming url varialble has the entire url
string...
Also see Java URL api to get query string, etc.

JSP hold an implicit object a paramValue that maps the request parameters to an array. You can use this object, and JSTL length function to learn the number of parameters directly in jsp, something like
<c:if test="${fn:length(paramValues) gt 0}">...</c:if>
make sure to include the following taglibs at the beginning of your jsp page
<%# taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%# taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>

We can easily check for parameters using Regex. Lets say you have the following URLs:
www.domain.com/Product/UniqueId?foo=bar
www.domain.com/Product/UniqueId
Now, the actual URL can be anything. We can mark it as .*, which means anything. (Dot = any character, * = Zero or more times. There are more complex regexes to check for URLs but you said you are given URLs hence they aren't relevant).
After you matched your URL, you want to check for parameters.
Parameters are in the syntax of:
?key=value&key=value&key=value...
So we want to check for a question mark followed by a combination of keys and values. The regex would be:
\?((.*=.*)(&?))+
That matches a question mark, followed by: a key (.), an equals sign, a value(.) and a possible & (&?), 1 or more times (+)
So you can put it in a method like so:
public boolean hasParameters(String url){
return url.matches(".*\\?((.*=.*)(&?))+");
}
www.domain.com/Product/UniqueId?foo=bar would match the regex, and www.domain.com/Product/UniqueId wouldn't, because it isn't followed by the parameters.
P.S: The double slash before the question mark is in sake of java, not in sake of regex.
Link: Regex checker with the following regex & example
If you want to use it in JSP, simply put this method in a scriplet (started with <% and ended with %>), or anywhere else in your code actually.

Use the methods of java.net.URI to get all you need about the URL.

Unable to bind value from java bean to jsp using jstl

I have a String getter and setter that i am setting in my bean.
I am trying to get the value in my jsp using jstl like this :
<jsp:useBean class="com.test.MyBean" id="results" scope="request"/>
<script type="text/javascript">
function setMyFields(){
var flag="<c:out value='${results.sdateFlag}'/>";
alert(flag);
var text_box = document.getElementById('mySelectedDate');
if(flag=="true"){
text_box.setAttribute('disabled', 'disabled');
}
}
window.onload = setMyFields;
</script>
I have imported jstl core as well in my jsp.
But when i do this i get an error like this :
javax.servlet.ServletException: Unable to find a value for "sdateFlag" in object of class "com.test.MyBean" using operator "."
at org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:660)
at com.ibm._jsp._pageMyAmount._jspService(_pageMyAmount.java:306)
at com.ibm.ws.jsp.runtime.HttpJspBase.service(HttpJspBase.java:87)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:856)
at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:1101)
at com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(ServletWrapper.java:569)
at com.ibm.ws.wswebcontainer.servlet.ServletWrapper.handleRequest(ServletWrapper.java:478)
at com.ibm.wsspi.webcontainer.servlet.GenericServletWrapper.handleRequest(GenericServletWrapper.java:122)
at com.ibm.ws.jsp.webcontainerext.AbstractJSPExtensionServletWrapper.handleRequest(AbstractJSPExtensionServletWrapper.java:226)
at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcher.forward(WebAppRequestDispatcher.java:321)
But ihave been debugging the java class using the java debugger and it seems the value is getting set. Then why is it not getting the value ?
EDIT : These are the setter and getter of my bean :
public void setDateFlag(String b) { sDateFlag = b; }
public String isDateFlag() { return sDateFlag; }
What's wrong here ? Am i missing something ?

You're treating the dateFlag as a boolean property, but it is in fact a String. So you "getter" should be called getDateFlag, not isDateFlag. As mentioned, the isPropertyName syntax is only applicable to properties of type boolean.
Also, <c:out value='${results.dateFlag}'/> isn't really needed. You should be able to simply do ${results.dateFlag}.

So , i got the problem fixed and it was a bizarre solution. The problem it seems is, any variable declared must follow java standards. And my problem was , i had given the variable name as sDateFlag in my original proprietary code, which does not follow the java naming conventions. When i removed it and gave it as flag , it started working. I R&D ed the answer using this link here : JSTL . Though it's not fully correct, it led me to the root cause of my problem. And i will like to convey my thanks to all of you guys , who have replied to me, to make the process easy .

What does the #sign do?

I have seen the at (#) sign in Groovy files and I don't know if it's a Groovy or Java thing. I have tried to search on Google, Bing, and DuckDuckGo for the mystery at sign, but I haven't found anything. Can anyone please give me a resource to know more about what this operator does?

It's a Java annotation. Read more at that link.

As well as being a sign for an annotation, it's the Groovy Field operator
In Groovy, calling object.field calls the getField method (if one exists). If you actually want a direct reference to the field itself, you use #, ie:
class Test {
String name = 'tim'
String getName() {
"Name: $name"
}
}
def t = new Test()
println t.name // prints "Name: tim"
println t.#name // prints "tim"

'#' is an annotations in java/ Groovy look at the demo :Example with code
Java 5 and above supports the use of annotations to include metadata within programs. Groovy 1.1 and above also supports such annotations.
Annotations are used to provide information to tools and libraries.
They allow a declarative style of providing metadata information and allow it to be stored directly in the source code.
Such information would need to otherwise be provided using non-declarative means or using external files.

It can also be used to access attributes when parsing XML using Groovy's XmlSlurper:
def xml = '''<results><result index="1"/></results>'''
def results = new XmlSlurper().parseText(xml)
def index = results.result[0].#index.text() // prints "1"
http://groovy.codehaus.org/Reading+XML+using+Groovy's+XmlSlurper

We Keep Coding

Java is a programming language and computing platform first released by Sun Microsystems in 1995.