css in db

roshanjameer

hi,

i want to store css template which has header,left navbar,center,right navbar,footer in mysql db.iam using like this

1..i will store a css template in db

2..retrieve it from db and assigned its value to some textarea for updations

3..update content

$header='<style type ="text/css">
#header{
background-color:white;
color:#009900;
border-style:solid;
border-width:3px;
height:200px;
width:300px;
padding:5px;}</style><div id="header">WELCOME</div>';
if i use this type everything is displayed correctly but when updating it iam getting error
is it the correct way to store in db or i have to use

$header='<link rel="stylesheet" type="text/css" href="abc.css"> <div id="header">WELCOME</div>';

bradgrafelman

roshanjameer wrote:
but when updating it iam getting error

What error? What's your code look like that you're using to update the database?

roshanjameer

<?php

$conn=mysql_connect('localhost','','');
mysql_select_db("pp",$conn);

$sql="UPDATE home SET body='$POST[te1]', menu='$POST[te2]', header='$POST[te3]', right='$POST[te4]', left1='$POST[te5]', left2='$POST[te6]', left3='$POST[te7]', left4='$POST[te8]', blankfooter='$POST[te9]', footer='$POST[te10]'";
$result=mysql_query($sql,$conn) or die (mysql_error());
echo "updated";
?>

it is showing this error

You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'right='#right {position : relative; height : 779px; width : 267

roshanjameer

bradgrafelman

Few things here:

Array indeces in your case should be strings. $row[name] does not have a string as an index, but a constant. PHP will detect this (assuming there actually isn't a constant named 'name') and throw an E_WARNING and then assume it is a string. So, use quotes: $row['name'].
Arrays, more specifically items in arrays referenced by indeces, should not simply appear inside a double-quoted string. If they do, they should be wrapped in braces ( {} ). Instead, I usually escape out of the string and concatenate the array in the middle, like so:
```
echo 'Your name is: ' . $row['name'] . '! Hello there.';
```
You're not validating any of the data. At least, if you are, you're relying on magic_quotes_gpc to be enabled. Obviously, however, it is not. In this case, I would say do something like this:

function clean_data($data) {

if(!get_magic_quotes_gpc()) {
    return mysql_real_escape_string($data);
} else {
    return mysql_real_escape_string( stripslashes($data) );
}

}
$te1 = (isset($_POST['te1']) ? $_POST['te1'] : '');
// etc. for all 'te' variables.
// then you'd use these variables in your SQL query