php

chaosmuse

i'm working on a particular page (post.php), but i can't seem to get the php to parse. if you looked at the source code, you'd find that it reads like this:

<html>
<head>
<title>Post Comment</title>
</head>
<body>

<p><center><b>Add a Comment</b></center></p>

<?php
//create short variable names
$name=$HTTP_POST_VARS['name'];
$email=$HTTP_POST_VARS['email'];
$comment=$HTTP_POST_VARS['comment'];

if (!$name || !$email || !$comment)
{
	echo 'You have not filled in all the fields. Please go <a href="post.html">back</a> and try again.';
	exit;
}

@$db = mysql_connect('host', 'username', 'pword');

if(!$db)
{
 echo 'Error: Could not connect to database. Please try again later.';
 exit;
}

mysql_select_db ('database');
$query = "insert into phpguest_entries values
('".$name."', '".$email."', '".$comment."')";
$result = mysql_query($query);
if ($result)
{
	echo 'Your comment has been successfully added.';
}
else
{
	echo 'There has been an error in adding your comment. Please go <a href="post.html">back</a> and try again.';
	exit;
}

?>

</body>
</html>

which is not cool. i changed the actual passwords and db names, but if you knew the page, you could easily just find out.

can you all help me get this fixed up??? i don't know why it's not parsing the code... i have other pages that have absolutely no problem with the code. any clues???

😕 🙁

-- Cm

Velausanakha

$name=$HTTP_POST_VARS['name'];
$email=$HTTP_POST_VARS['email'];
$comment=$HTTP_POST_VARS['comment'];

I'm not sure but shouldn't these be the other way round?

and u do have global registers on?

chaosmuse

um... i don't think they should be the other way around. i have other pages that use this exact code and it works just fine.

i'm not sure about global registers. how do i go about checking?

Warboss_Alex

register_globals can be found in php.ini, if you have control over it, otherwise call phpinfo() on a page, to get the settings..

And the page seems to work fine for me .. I swapped $HTTP_POST_VARS for $POST, and then checked again using $HTTP_GET_VARS and $GET .. called the page with a querystring to check the conditional statement, and it seemed to work fine.

How d'you know it's not working? It's not even displaying the "You have not filled in .." etc?

Cheers,
Alex ...

tomhath

Did you put the @ sign in the right place here:

@$db = mysql_connect('host', 'username', 'pword');

Warboss_Alex

That wouldn't make any difference..

@@@@@@$var = "x";
echo $var;

.. prints 'x' as it should.

Which is interesting, actually. I only recently found that out ..

tomhath

You're right, the @ sign can be prepended to any expression. But note this warning in the manual:
http://us2.php.net/operators.errorcontrol

Currently the "@" error-control operator prefix will even disable error reporting for critical errors that will terminate script execution. Among other things, this means that if you use "@" to suppress errors from a certain function and either it isn't available or has been mistyped, the script will die right there with no indication as to why.