Form input to MySQL via PHP

Islefyord

I'm setting up a basic news site in PHP and seem to have everything working. That was until I tried to stick in some press releases.

The main body of the text is 708 chars (inc spaces) and I initially assumed that it was either a field type limitation ( I am using longtext) but I have managed to input a 711 char entry consisting of 'test test test...'

I have absolutly no idea why the press release will not go in but the test thing will. Any ideas would be appreciated.

Code is as follows...And yes, it is messy. I have included the UPDATE code, but am having the same problem with ADD

if ($id) {

 if ($submit) {

   $sql = "UPDATE success SET Title='$title',Story='$story'WHERE ID=$id";

   $result = mysql_query($sql);

   echo "<p>Thank you! Information updated.\n";

 } else {

   // query the DB

   $sql = "SELECT * FROM success WHERE ID='$id'";

   $result = mysql_query($sql); 

   $myrow = mysql_fetch_array($result);

   ?>



   <form method="post" action="<?php echo $PHP_SELF?>">

   <input type=hidden name="id" value="<?php echo $myrow["ID"] ?>">

   <p>Title:<input type="Text" name="title" value="<?php echo $myrow["Title"] ?>"></p>
   <p>Story:<textarea name="story" rows=10 cols=100><?php echo $myrow["Story"] ?></textarea></P>

   <input type="Submit" name="submit" value="Update information">

   </form>

<?php

}

} else {



 // display products
 $result = mysql_query("SELECT * FROM success",$db);

 while ($myrow = mysql_fetch_array($result)) {

   printf("<a href=\"%s?id=%s\">%s</a><br>\n", $PHP_SELF, $myrow["ID"], $myrow["Title"], $myrow["Story"]);


 }

}



?>

LarsLai

perhaps there are quotes (", ', ...) in your text and if you say

$sql = "UPDATE success 
SET Title='$title',
Story='I am the story with "quotes" and so on'
WHERE ID=$id";

it cannot work.

tsinka

Hi,

what happens with the following modification:

if (isset($_POST['submit'])) { 

  $strTitle = mysql_escape_string($_POST['title']);
  $strStory = mysql_escape_string($_POST['story']);

  $sql = "UPDATE success SET Title='$strTitle',Story='$strStory' WHERE ID='{$_POST['id']}'"; 

  $result = mysql_query($sql); 

  echo "<p>Thank you! Information updated.\n"; 

}

Additionally, you might want to add some checks if title and story are set at all. mysql_escape_string takes care of all characters that have to be escaped.

Thomas

Islefyord

Nice one, that works a treat.

Thank you very much