i want to use neoinvoice to generate invoice for my clients far away from where i am. am using a windows machine running wamp. i've set the database and put the files in necessary location...but when i click either login or create new account i get a blank page with "index.php" only written in it......

is there anything am doing wrong??

i placed a screen shot of the process....

Column sorting variables should use a switch statement to make sure they're valid.

Just skimming, and e.g.
in: controllers/invoice.php
$data['invoices'] = $this->invoice_model->select_multiple($this->session->userdata('company_id'), $page, $this->pref_user['per_page'], TRUE, $sort_col);
$sort_col appears to be just uri_segment 2 of list_items.
select_multiple() then calls:
$sql = "SELECT id, name, DATEDIFF(NOW(), duedate) AS past_due FROM invoice WHERE company_id = " . $this->db->escape($company_id) . " ORDER BY $sort_col";
$sort_col is left as-is. It is certainly more difficult, since '()' aren't permitted in the uri, and we're already in the ORDER BY clause, but I think it may still be doable to get some blindsql into there.

--mmmooo

@tlhunter it's sad to hear the history of how this project started, my condolences. Truly noble, your heart in the right place or blame lies with fate not realizing a quick reward which now sees this project open and free as in beer.

Yet what pains me more is that although you have taken the first steps, slapped on some comfortable license outfits and send your baby off laid bare and exposed for the world to see but this is just the first step. What is sad is that it is living up to it's full potential being "opensource" its not purely a convenient license and the price tag that draws interest there are the other factors

• community of support;
• exposure and testing by larger community;
• which doesn't help if they don't report the problems;
• fix the problems;
• request new features;
• have the confidence to submit your additions for the greater good
• al geared to facilitate growth and progress.

You see why I am concerned? This is something you see with many projects and you are not alone, obviously not since at the time of this writing neoinvoice already has 49 forks and this is remarkable in such a short timespan yet it only produced 2 notable contributions so far.

Is this something you are concerned about? The problem is that software very quickly gets dated and as you rightfully realized needs dedicated commitment to stay viable which requires the support of a community especially because we only do this part time, would you agree? What makes an opensource project a success is an active community so the question is what makes an active community. Since I am also new at this I can only speculate but the factors that contribute IMO :

• will this project be around for the conceivable future;
• are there enough contributors;
• is there a roadmap and a clear growth plan;
• is there encouragement and a clear understanding of how to contribute;
• do we have documentation, examples, tests;
• does it employ open standards , best practices and will it play with others;
• are there facilities and tools in place to
  • easily get to the source
  • easily update the source and contribute
  • is there documentation
  • easily update documentation and contribute
  • report bugs and defects
  • answers to questions
  • communication
• are there frequent releases;
• do issues receive attention timeously;
• is there commit activity or does the codebase evolve

Since I don't have the experience of running a successful project I can only comment from what I notice as an opensource user and from the experience I've gained contributing to existing projects. I can imagine that when contributing to a project there has to be a belief that it is not in vain, that the project will still be around and not just fall off the grid or get abandoned or worse. Whatever the cause I feel strongly about finding a resolve, promoting active participation and ensuring the continued evolution and survival of any project we love and care about.

What spurred the subject to this post stems from first impressions seeing a "post mortem" one cannot help but think this is dead already and what remains is the zombie that rose up wanting to eat your brains. Now that I realize it's not dead on arrival so there is still hope what can we do about that? Do we shoot it in the back of the head or look for a cure?

What are your thoughts, do I have a point or am I missing the plot? What would you like to see happen with neoinvoice? If you agree that this is something we should look at let me know and I will dig deeper and see if we can find a rationale that makes sense. It pains me to see so many dying or walking dead projects around and if there is a need to find a cure then I am keen to do just that. We are the new generation and it is obvious that the seeds planted have grown in a keen interest to continue what's been laid out before us but it is our responsibility to make it grow. If that means we have to knock on every door and turn every stone to find out what happens next then I say lets do that. What do you think?

Thank you for neoinvoice, it is obvious that you put lots of hard work into it. You chose to keep it alive instead of letting it go to dust and from what I can see its got great potential. Now lets see how we can make that happen, what do you say? =)

Hello Thomas,

There is a blind SQL injection flaw in the signup_check.php file, specifically with the "value" parameter. Here is a URL that will demonstrate the issue:

http://localhost/signup_check.php?field=username&value='+OR+SLEEP(5)+OR+'

See line #29 for the issue.

--Adam Caudill
http://adamcaudill.com