I am a newbie, and everyone who helps gets a free cookie

spgkrmakecookie

Ok, so...

I have been learning php and mysql on and off for years, but only tonight have I managed to make some real decent progress :-P So, I decided to make a simple blog, but I have a query about storing the entries in databases.

Firstly, I need to know what i'd need to convert text into HTML, or if it would make most sense just to input the entries as HTML? Then, I assume I can use the mysql_real_escape_string function and everything will be safe in the database? Oh, that's my other question, is it ok to have quotes in the database? I'm assuming it is, but i'm doing alot of assuming this evening and crave confirmation. Yaaa

So yes, is there anything i'll need to be particularly aware of when making this blog? Feel free to supply tutorials you feel are releventae (pronounced rel-ev-ENTAE, I should think).

Thankyou!

Jamie

NogDog

Always filter external data before using it in SQL. If using the mysql_*() functions, then mysql_real_escape_string() would be the correct method for this.

If this is a personal use sort of thing where you're the only person who will be entering data, and if you think you can trust yourself to not enter problematic HTML ( 😉 ), then it's probably OK to just go ahead and enter the HTML tags directly to the data, but then it's on your shoulders if you enter invalid mark-up and the resulting page displays incorrectly (or not at all).

For something more robust, you might look into some sort of BBCode implementation (similar to what this forum uses).

spgkrmakecookie

cookie!

Thanks a lot for that sir, and I will most definately look into using BBcode 🙂

Byeeeee

Edit: p.s. When allowing visitors to post comments, would it be ok to store the BBcode in databases too? Cheers!

NogDog

I probably would not allow visitors to enter any HTML. I would filter their inputs through [man]striptags/man, store the result in the DB (filtering it through mysql_real_escape_string() again), and then use [man]nl2br/man when outputting the comment text from the DB to the browser.

spgkrmakecookie

Thankyou so much! This language is so cool man, functions for all sorts of cool stuff.

spgkrmakecookie

My next question would be about nesting if statements in loops - is this considered bad practice?

I have a for loop which repeats 10 times, each time using mysql_fetch_assoc to get the details of each of my entries and format them into an HTML table. But, it still prints out 10 tables even if I haven't made 10 entries. So, I put an if statement inside the for loop, which states

if ($entry['id']!=' ')
{
print table
}

So basically, if the ID doesn't=' ', then make a table and insert the data in the appropriate places. Because if the entry doesn't exist, it won't have an id. Any good?

laserlight

My next question would be about nesting if statements in loops - is this considered bad practice?

In general, no, it is not considered bad practice since it is often the most obvious and correct solution.

I have a for loop which repeats 10 times, each time using mysql_fetch_assoc to get the details of each of my entries and format them into an HTML table. But, it still prints out 10 tables even if I haven't made 10 entries. So, I put an if statement inside the for loop, which states

It sounds like you want to print the table HTML tags before (and after) the loop, and print the individual rows/fields within the loop.

spgkrmakecookie

laserlight wrote:
It sounds like you want to print the table HTML tags before (and after) the loop, and print the individual rows/fields within the loop.

That's a good suggestion actually. So how could I do this so that it makes a new <td> for the 10 latest entries?

Jamie

laserlight

Well, what is your current code?

spgkrmakecookie

Oh, it's ok, I found the LIMIT argument (is it an argument???) which you can place in the select query, which works perfectly!

But thanks alot for your help, I appreciate it, so here you are laserlightcookie!

Spgkr out