Answers.Body: <p>I would highly recommend you use the CiviCRM API to access this information.</p>
  
  <p>A php version would look something like this:</p>
  
  <pre><code>$result = civicrm_api3('Activity', 'get', array(
    'sequential' =&gt; 1,
    'activity_type_id' =&gt; "Petition",
    'options' =&gt; array('limit' =&gt; 1000),
  ));
  </code></pre>
  
  <p>(Setting limit to be something larger than you would expect to get.)</p>
  
  <p>Which would return the count (in addition to the activities which you can ignore). </p>
  
  <pre><code>{
  "is_error":0,
  "version":3,
  "count":1,
  "id":1,
  "values":[{
      "id":"1",
      "activity_type_id":"9",
  .....
  </code></pre>
  
  <p>If you are using version 4.6, in place of the get action, use getcount, which will only return the count... without detail and not requiring the limit. </p>
  
  <p>You can play with the call by going to /civicrm/api/explorer.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-17T06:45:47.283Z
Answers.Text: get is capped at 25 by default, and the proper action there would be getcount, but don't think it's optimised for activities yet
Answers.UserDisplayName: Xavier
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-17T13:21:38.197Z
Answers.Text: Good point Xavier, so the limit on the api call needs to be set sufficiently high.   And, the demo 4.6 site does have the getcount action working on activities. (I will add the limit to my answer; but on the assumption of use of earlier versions I will leave getcount here as a comment.)
Answers.UserDisplayName: DaveD
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-17T20:02:51.120Z
Answers.Text: It's not a good idea to use getcount in that case, as it's just a get, and as soon as you have a few signatures, it will take too long. Writing a dedicated get_count is the better option, but probably too complicated for the task, the select is the easiest option IMO
Answers.UserDisplayName: Xavier
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-16T22:18:53.243Z
Answers.LastActivityDate: 2015-09-17T13:24:10.953Z
Answers.LastEditDate: 2015-09-17T13:24:10.953Z
Answers.UserDisplayName: DaveD
Answers.Body: <p>you don't have any parameter to the sql command you run, it should be safe.</p>
  
  <p>what you haven't shown that might be a potential problem is how you open the connection to mysql, if you don't do it and let your cms do it, you should be fine, otherwise, be sure you don't risk sharing the connection credentials by accident.</p>
  
  <p>beware that your select counts all the signatures for all the petitions and for all statuses, it might or might not be what you want</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-16T08:25:17.880Z
Answers.Text: I have just put the data into a drupal block and put input type as php. Originally I put the connection in a separate file and called it from the block but when I deleted the include it still worked....... So I think I am therefore letting the cms open the connection? Do you agree (and if yes how does it do that I am curious!?)
Answers.UserDisplayName: Caroline B
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-16T09:28:37.343Z
Answers.Text: it's using the last opened connection. if you have both civi and drupal in the same database, you should be fine, if not, you might end up with running the query on the wrong database, or in general get your counter broken if you add a new drupal module.
Answers.UserDisplayName: Xavier
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-16T11:27:14.327Z
Answers.Text: ah so if I go down this route I would be better opening the connection by using the include (I put the connection details in another file call it)? Would this still count as letting my CMS do it? Thank you for your response
Answers.UserDisplayName: Caroline B
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-16T16:59:38.793Z
Answers.Text: If you have Civi and Drupal tables in the same db, instead of using PHP's mysql_query, use the Drupal API's db_query.  It's a wrapper around mysql_query that ensures Drupal handles the connection: https://api.drupal.org/api/drupal/includes!database!database.inc/function/db_query/7
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-16T17:01:38.267Z
Answers.Text: If Drupal and Civi tables are in different databases, you can use the Drupal db_set_active function to have Drupal manage the CiviCRM connection: https://api.drupal.org/api/drupal/includes!database!database.inc/function/db_set_active/7
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-16T07:03:06.137Z
Answers.LastActivityDate: 2015-09-16T07:03:06.137Z
Answers.UserDisplayName: Xavier
Answers.Body: <p>As Zach points out, you should be able to do this via Views and use the Aggregation option (in the advanced section) to pull up a count of the number of Activities of type X in time period Y etc.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-16T20:40:47.583Z
Answers.LastActivityDate: 2015-09-16T20:40:47.583Z
Answers.UserDisplayName: petednz - fuzion
Answers.Body: <p>Not sure about the security risks, not my expertise. But I would expect it to be a liability.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-16T06:29:17.907Z
Answers.LastActivityDate: 2015-09-16T06:29:17.907Z
Answers.UserDisplayName: ErikH - CiviCooP
Body: <p>I would like to count and display on my front page how many people have signed a civi petition. This I have been able to do using php as below. What I am wondering is if I am causing any kind of insecurity in my system - if I can get the data out what  is to stop someone else inserting data in?</p>
  
  <p>Sorry this may be a 101 question but I haven't been able to find this out by searching.
  Thanks! Caroline</p>
  
  <pre><code>open php
  $sql=("SELECT COUNT(*) FROM civicrm_activity WHERE activity_type_id=32");
  $rs = mysql_query($sql);
  $result = mysql_fetch_array($rs);
  echo "&lt;h1&gt; &lt;b&gt;&lt;center&gt;SIGNATURES SO FAR:     $result[0]&lt;/center&gt;&lt;/b&gt; &lt;/h1&gt; ";
  close php
  </code></pre>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-09-16T00:22:27.923Z
Comments.Text: I wonder if you are using Drupal? You could possibly use the Views module to produce this kind of count.
Comments.UserDisplayName: Zachary
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-09-16T08:21:11.777Z
Comments.Text: Yes I am using drupal - and I have just had a go at creating a view but it looks like it is a bit more complicated than that. For others who end up here I am now following the instructions http://civicrm.stackexchange.com/questions/2180/how-do-i-use-views-with-civicrm   If I get it working I will come back and accept the answer :))
Comments.UserDisplayName: Caroline B
Tags: <php><civicampaign>
Title: If I use php to display a count from my database am I causing a security problem?
ThreadText: # If I use php to display a count from my database am I causing a security problem?
  
  (Asked by: username_0 on 2015-09-15)
  
  I would like to count and display on my front page how many people have signed a civi petition. This I have been able to do using php as below. What I am wondering is if I am causing any kind of insecurity in my system - if I can get the data out what is to stop someone else inserting data in?
  
  Sorry this may be a 101 question but I haven't been able to find this out by searching.
  Thanks! username_0
  
  ```
  open php
  $sql=("SELECT COUNT(*) FROM civicrm_activity WHERE activity_type_id=32");
  $rs = mysql_query($sql);
  $result = mysql_fetch_array($rs);
  echo "<h1> <b><center>SIGNATURES SO FAR:     $result[0]</center></b> </h1> ";
  close php
  
  ```
  
  **Tags:** php, civicampaign
  
  > **Comments:**
  > **username_1**: I wonder if you are using Drupal? You could possibly use the Views module to produce this kind of count.  
  > **username_0**: Yes I am using drupal - and I have just had a go at creating a view but it looks like it is a bit more complicated than that. For others who end up here I am now following the instructions http://civicrm.stackexchange.com/questions/2180/how-do-i-use-views-with-civicrm   If I get it working I will come back and accept the answer :))  
  
  ---
  
  ## 4 answers
  
  ### Answer by username_2 on 2015-09-16. Score: 2
  
  I would highly recommend you use the CiviCRM API to access this information.
  
  A php version would look something like this:
  
  ```
  $result = civicrm_api3('Activity', 'get', array(
    'sequential' => 1,
    'activity_type_id' => "Petition",
    'options' => array('limit' => 1000),
  ));
  
  ```
  
  (Setting limit to be something larger than you would expect to get.)
  
  Which would return the count (in addition to the activities which you can ignore).
  
  ```
  {
  "is_error":0,
  "version":3,
  "count":1,
  "id":1,
  "values":[{
      "id":"1",
      "activity_type_id":"9",
  .....
  
  ```
  
  If you are using version 4.6, in place of the get action, use getcount, which will only return the count... without detail and not requiring the limit.
  
  You can play with the call by going to /civicrm/api/explorer.
  
  > **Comments:**
  > **username_3**: get is capped at 25 by default, and the proper action there would be getcount, but don't think it's optimised for activities yet  
  > **username_2**: Good point username_3, so the limit on the api call needs to be set sufficiently high.   And, the demo 4.6 site does have the getcount action working on activities. (I will add the limit to my answer; but on the assumption of use of earlier versions I will leave getcount here as a comment.)  
  > **username_3**: It's not a good idea to use getcount in that case, as it's just a get, and as soon as you have a few signatures, it will take too long. Writing a dedicated get_count is the better option, but probably too complicated for the task, the select is the easiest option IMO  
  
  ---
  
  ### Answer by username_3 on 2015-09-16. Score: 1
  
  you don't have any parameter to the sql command you run, it should be safe.
  
  what you haven't shown that might be a potential problem is how you open the connection to mysql, if you don't do it and let your cms do it, you should be fine, otherwise, be sure you don't risk sharing the connection credentials by accident.
  
  beware that your select counts all the signatures for all the petitions and for all statuses, it might or might not be what you want
  
  > **Comments:**
  > **username_0**: I have just put the data into a drupal block and put input type as php. Originally I put the connection in a separate file and called it from the block but when I deleted the include it still worked....... So I think I am therefore letting the cms open the connection? Do you agree (and if yes how does it do that I am curious!?)  
  > **username_3**: it's using the last opened connection. if you have both civi and drupal in the same database, you should be fine, if not, you might end up with running the query on the wrong database, or in general get your counter broken if you add a new drupal module.  
  > **username_0**: ah so if I go down this route I would be better opening the connection by using the include (I put the connection details in another file call it)? Would this still count as letting my CMS do it? Thank you for your response  
  > **username_4**: If you have Civi and Drupal tables in the same db, instead of using PHP's mysql_query, use the Drupal API's db_query.  It's a wrapper around mysql_query that ensures Drupal handles the connection: https://api.drupal.org/api/drupal/includes!database!database.inc/function/db_query/7  
  > **username_4**: If Drupal and Civi tables are in different databases, you can use the Drupal db_set_active function to have Drupal manage the CiviCRM connection: https://api.drupal.org/api/drupal/includes!database!database.inc/function/db_set_active/7  
  
  ---
  
  ### Answer by username_5 on 2015-09-16. Score: 0
  
  As Zach points out, you should be able to do this via Views and use the Aggregation option (in the advanced section) to pull up a count of the number of Activities of type X in time period Y etc.
  
  
  ---
  
  ### Answer by username_6 on 2015-09-16. Score: -1
  
  Not sure about the security risks, not my expertise. But I would expect it to be a liability.
  
  
  ---
  
  