Do not know what is wrong with this code.

brendan2b

I have been trying for about an hour or so, and I still cannot find the problem. This script executes properly, except that nothing gets entered into the comment field of my table when I have indeed entered data into the field.

Thanks.

	if(isset($_POST['postComment']))
		{
			$errors=0;

		$commentPosted = $_POST['comment'];
		$username = $_SESSION['user'];
		$id = $_POST['imageID'];


		if($commentPosted = "")
			{
				$errors = 1;
				$error .= "You have not entered a comment.<br>";
			}
		if(strlen($commentPosted) > 250)
			{
				$extra = strlen($commentPosted) - 250;
				$errors = 1;
				$error .= "Your comment is ".$extra." characters too long.<br>";
			}
		if($errors == 0)
			{

				$commentPosted = addslashes(htmlentities($commentPosted));

				$id = mysql_real_escape_string($id);  
				$search_username = "SELECT * FROM `photos` WHERE `imageID` = '$id'";
				$search_query = mysql_query($search_username)
				or die(mysql_error());

				$userImage = mysql_fetch_array($search_query);

				$userpicture = $userImage['username'];

                                    $userpicture = mysql_real_escape_string($userpicture);
                                    $id = mysql_real_escape_string($id);
                                    $username = mysql_real_escape_string($username);

				$insert_query = "INSERT INTO `comments` (`commentRecipient`, `imageID`, `postedBy`, `comment`)
				VALUES ('$userpicture', '$id', '$username', '$commentPosted')";
				$insertData = mysql_query($insert_query)
				or die(mysql_error());
				header('location:viewComments.php?imageID='.$id.'&username='.$username);

			}
			}

  <?if ($errors == 1)
	  	{
		print "<span class='style12'>$error</span>";
		}
		?>
      <table width="600" class="tblBorder"><form method="post" action="<? echo $_SERVER['PHP_SELF'];?>">
        <tr>
          <td align='right' class="style31">Posted By:</td>
          <td><input type="text" name="username" size=30 value="<? print $displayName23; ?>" readonly="readonly"></td>
        </tr>
        <tr>
          <td align="right" class="style31">Comment:</td>
          <td><textarea name="comment" cols=50 rows=5 wrap="hard" scrolling="no"></textarea></td>
        </tr>
		<tr>
		<td colspan=2 align="center">
		<input type="hidden" name="imageID" value="<? print $id; ?>">
		<input type="submit" value="Post Comment" name="postComment" onclick="return confirm('Are you sure you want to post this comment?');">		</td>
		</form>

I probably made a stupid mistake.
Thanks.

ahundiak

There are no stipid mistakes. Only stupid ... well never mind.

This:
$commentPosted = addslashes(htmlentities($commentPosted));
should just be
$commentPosted = mysql_real_escape_string($commentPosted);

I'm assuming you are not getting any mysql errors?
Put in a die($insert_query); right after you build the insert string. Make sure your code is getting there and make sure the sql is as expected.

brendan2b

Ok i fixed the problem, in my second if statement $commentPosted = "" was setting it equal to nothing, I just forgot the other equals sign. Also why do I just do mysql_real_escape_string?

ahundiak

htmlentities is used for sending data to your web page. So when you echo your comments back out for viewing, wrap them in htmlentities(); otherwise, certain characters like < and > will mess up your html.
http://us3.php.net/manual/en/function.htmlentities.php

addslashes is basically an older version of mysql_real_escape_string. Harkens back to the ancient days when magic quotes was being used. You will still see it in many tutorials and such but you basically should not be using it any more. mysql_real_escape_string will make sure your data can be written into mysql. And do make sure that magic quotes are turned off otherwise double escaping will occur. test you program by adding some single and double quotes into your comments as well as <,&, and >.