Paragraphs messed up

[roxics]

Hey everyone I'm new here. Just starting to learn PHP. Taking snippets of code I find and putting them together as a way of learning.

Right now I have this code (below). It's pretty much a guestbook that also emails me the results of the form whenever someone submits a post.

I'm having a couple issues with it though.

1.First whenever someone submits multiple paragraphs each one gets added to a new box. if you look at the last entry in this page you'll see what I mean. http://www.roxics.com/php/display.php

2. Second I can't figure out how to reverse the display so that new posts show up on top.

Here is the code for the submit page:

  

<?php
if ($_POST['submit']) {
   print "Thank you for your submission. <br><A HREF='display.php'>Click here to view your message.</A>";
}
?> 



<?php

$data = fopen( "email.txt" , "a+" );
$fillin = $_POST['name']."|".$_POST['email']."|".$_POST['message'];

if ($_POST['submit']) {
   $required_fields = explode(",", $_POST['required']);

$error = 0;

  foreach($required_fields as $fieldname) {
     if ($_POST[$fieldname] == "") {
        $error++;
     }
  }

if ($error == 0) {
      if (strstr($_POST['email'], "@") and strstr($_POST['email'], ".")) {

  } else { 
     $errormessage = "<b>The email address you entered does not appear to be valid<br></b>";
  }

if(!$data)
{
    echo "Couldn't open the data file. Perhaps some other time.";
    exit;
}

fwrite( $data, $fillin."\r\n" );

fclose( $data );


mail("[e-mail]" , "Message from Web Form", $_POST['message'], "From: $_POST[name] <$_POST[email]>");    

         exit;


} else {
      $errormessage = "<b>You have left some required fields in the form blank! Please fill in the form completely.";
   }
}



?>





<br><br>
<?=$errormessage?>


<p>
<center>
<form action="<?=$_SERVER['PHP_SELF']?>" method="post">
<table width="500" border="0" cellpadding="5" cellspacing="0">
<tr><td>Your name:</td><td><input type="text" name="name" value="<?=$_POST['name']?>"></td></tr>
<tr><td>Your email:</td><td><input type="text" name="email" value="<?=$_POST['email']?>"><td><tr>
<tr><td>Your message:</td><td><textarea name="message" ROWS=15 COLS=40><?=$_POST['message']?></textarea></td></tr></table>
<input type="hidden" name="required" value="name,email,message">
<input type="submit" name="submit" value="submit"> 
</center>

This page can be found here: http://www.roxics.com/php/contact2.php

Now here is the code for the display page:

<div align="center">
	<center>
	<table border="0" cellpadding="5" cellspacing="0" width="60%">
		<tr>
			<td width="100%">



<?php
$fp = file("email.txt");
for($i=0;$i<count($fp);$i++)
{

  $array=explode("|",$fp[$i]);
	echo "<div class='message'>".$array[0].""; 
echo " (".$array[1].")<br><hr><p>"; 
echo "".$array[2]."</div><p>"; 
}

?>


</td>
		</tr>
	</table>
	</center>
</div>

3. Also what would be a good way to make the email address a link?

Thank you

[Norman_Graham]

Hi Roxics

The function file() reads the contents of the message into an array, with a new element for each line of the file. You then explode the array and add <br><hr><p> after each element - so each time the visitor hits return, your code starts a new message field.

I have a few recommendations:

1. I personally believe that a flat file (email.txt) is not a very good way to go about capturing visitors' comments. I recommend using a database with fields for name/email/message etc. That txt file could get out of control. Furthermore, if you ever want to do anything else with the contributions, you're going to have to work with a file which is, basically, a horrible mess.

2. Protect yourself: you are allowing anyone and everyone to write whatever they like onto your website and their comments are published instantly. What if I wanted to put some nasty javascript in or perhaps a link to a website in which virile young men do bizarre things with domestic animals, or even worse a link to a website in which very sad people do despicable things to little children, thus making you liable to some very frightening prosecution? Your website would publish this stuff without objection.
   At the very least, you should be checking for code nasties (try htmlspecialchars). I could also do something harmless but annoying, like holding down the return key for 20 minutes. Your comments page would extend into infinity. You need to at least use trim() to avoid this. I also limit comments in terms of memory space.
   I recommend building in some sort of publishing delay. One way of doing this, which can be quite challenging, is to use sessions so that only the submitter can see his/her comments on the display page. You have to approve each comment manually before the comment becomes available for everyone. Another way of doing this is to enter all the comments into a database and use a field such as "publish CHAR(1) NOT NULL DEFAULT 'N'" which sets the publish condition to 'NO' until you manually change it to 'YES'.

3. If you want to have the e-mail addresses as links, you should warn users that that is what is going to happen. I wouldn't publish my e-mail as a link on the main page of some visitors' forum - it attracts spam. However, the code for making an e-mail link would be, in your case something like: <a href="mailto:<?php echo $POST['email']; ?>"><?php echo $POST['email']; ?></a>

Protect and survive and best of luck

Norm

[Norman_Graham]

Hi Roxics

Me again: I just wanted to warn you that I typed in the following:

http://www.roxics.com/php/email.txt

And guess what: I opened the email.txt file. It so happens the file contains nothing of import, but if it did and if I were a bad, nasty person, I could be in a position to do bad, nasty things.

One way of stopping people from accessing your non-public files is to put them somewhere out of your document root. The other way is to do that and also to make them PHP files, which means they can't just be opened as source through a web browser.

HTH

Norm

[roxics]

Thanks Norman. It's been a while since I first posted this.

I'll admit I don't understand alot of what you're talking about. That's not you're fault in explaining. Just my lack of understanding. I'm still very new to PHP.

When I wrote this script I was really looking to just practice. I didn't take into consideration everything you suggested. I think many are good ideas though.

However I think making the script too complex would defeat the purpose of it being just a simple and quick guestbook.

I guess I'm just taking it one step at a time. 🙂

I decided to use text files because I haven't even begun to explore MySQl. Like I said I wanted to start simple. But ultimately yes I totally agree a database is the way to go.

[Norman_Graham]

Hi Roxics

Your site - like most of my webpages - is a learning exercise. However, I was serious about the security measures because as soon as you make your website interactive, i.e. allowing user input, the gate is wide open, even with a site which is just for fun. I mean, you did publish your URL on this forum, which is visited by how many thousands of people, most of them web-programming aces?

You look after yourself - and your website.

All the best

Norm