You can find out your php version by using [man]phpversion[/man]. The version probably doesn't really matter though.
So your form has an action attribute which specifies the name of the page to handle your form submission...maybe something like this:
<form action="my_form_handler.php" method="post">
<input type="text" name="my_input">
</form>
You can then handle the submitted information in the file my_form_handler.php like this:
echo "you submitted. my_input=" . $_POST['my_input'];
Generally speaking, when someone changes the form and submits it, you'll need to remove magic quotes on any text inputs and then properly escape the string before running an insert query.
'magic quotes' are a feature of php 4 and 5 that puts a backslash before certain characters submitted through GET, COOKIE, or POST. Why? I'm not really sure but I suspect the motivation was to offer a convenience to make it easy to insert the data directly into a query. Try submitting that form with a value of "George O'Malley". If magic quotes are on, you'll see \"George O\'Malley\". Unfortunately, magic quotes are not secure and can't really be trusted. Remove them first. I use this function:
// this fn recursively strips backslashes from an array
function strip_backslashes_recursive($arg) {
if (is_array($arg)) {
$result = Array();
foreach($arg as $key => $value) {
$result[$key] = strip_backslashes_recursive($value);
}
return $result;
} else {
return stripslashes($arg);
}
}
You can easily use it on GET, COOKIE, and POST like this:
if (get_magic_quotes_gpc()==1) {
$_GET = strip_backslashes_recursive($_GET);
$_POST = strip_backslashes_recursive($_POST);
$_COOKIE = strip_backslashes_recursive($_COOKIE);
}
After removing magic quotes, you need to properly escape any strings before putting them in an INSERT query. If you're using MySQL, then use the function [man]mysql_real_escape_string[/man]. It might seem ridiculous to have the server automatically add quote marks and then remove them and then add them again but I've been told this function is a much more reliable way to add backslashes before quote marks and stuff because it takes into account the language settings in mysql and provides more safety against hacks.
$escaped_input = mysql_real_escape_string($_POST['my_input']);
$sql = "INSERT INTO my_table (my_field) VALUES ('" . $escaped_input . "')
