[RESOLVED] I know nothing...NOTHING!

ProfessorDan

Ok, I just started learning PHP literally a few hours ago. I really know pretty much nothing, but I did make a little 6 field form and successfully posts the desired outcome, which I am happy about.
The problem is that once the page is reloaded, all the information is lost again. It doesn't send it to my email, or leave it posted on the page like a forum or guestbook,and it also doesn't post it to the database.
All I want is for it to do one of the three, so if someone could help me figure out how to do whichever is the easiest of those options, that would be great.

I apologize for my extreme ignorance on this, since I am only a few hours old in my "knowledge" of PHP. I am still reading up on it and stuff and I don't mean to be spoon fed, but since I'm so new I'm not even sure what to read up on next.

Thank you for any help you can give me. I appreciate it.

dagon

post your code

bogu

After submiting your form you can check your submited values like this:

If your form is <form method="POST" ...

print_r($_POST);

If your form is <form method="GET" ...

print_r($_GET);

About [man]print_r[/man]

To send email you can use [man]mail[/man] function ...
To insert data in your mysql db table try [man]mysql_query[/man] function, before executing you query you should do the [man]mysql_connect[/man] to connect to you mysql server and [man]mysql_select_db[/man] to select your database ...

ProfessorDan

Ok I was reading up on how to post form data to the db, and I put the code in, and I am not getting any errors, but still, the data is not being posted to the db.

Here is what I put in for it to post to the db:

<?php
$con = mysql_connect("dbxxxx.perfora.net","dbo233780457","********");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}

$db_con = mysql_select_db("db233780457");
If($_GET[act]=="")

mysql_query("INSERT INTO Review_Form (Name, Email, Location, Product, Review, Rating)
VALUES('$POST[name]','$POST[email_address]','$POST[location]','$POST[product]','$POST[review]','$POST[rating]')")

Now like I said, I don't get any errors, so I assume that what I do have is fine, but there has to be something missing, since the data still won't post to the db.
I also have an echo code later on, which does work.

So what am I missing for it to post to the db?

Do I have to add something to the php.ini?

ProfessorDan

Nevermind, I got it now. Man I am so happy 🙂

btw, the page I was working on is here.

http://vtwopoint0.com/reviewform2.php

dagon

extremely unsafe to put users input directly in to a database with out sanitising it first.

http://xkcd.com/327/

ProfessorDan

Ok, so how do I do that?

Do I use a RegEx to do that? I found some RegExes for email-, varchars-, and website validation, but do those go into the "send" page? or the "receive" page? ie, the form page? or the post page?

Thanks

leatherback

Hi Dan,

You would typically put the processing on the receiving end. You have no control over what a user does: <s>he might make a fake form to send you junk. Unfortunately it is the way things are. Even on the web there are a load of people making other peoples life miserable.

Anything that comes from the outside world needs to be cleaned up first. Also if you 'know' that the form can only be coming from your own site or through hidden variables in a form. Just do not trust it, and you will be thanking yourself when you see another poor bugger whose site was hijacked..

You could do reexps, but generally that is not required.

I have two functions; one for numeric data, where I just check that a number is a number, and one for text, where I run them through [man]html_special_chars[/man] (Will replace a lot of special characters into their 'html code', and through stripslashe, when required. Have a search. there are few ways in which people sanatize their incoming variables.

laserlight

I have two functions; one for numeric data, where I just check that a number is a number, and one for text, where I run them through html_special_chars (Will replace a lot of special characters into their 'html code', and through stripslashe, when required.

There is a typographical error as the function is [man]htmlspecialchars/man. However, htmlspecialchars() is not the correct function to use for sanitising database string input for storage. The correct method depends on the database API (e.g., [man]mysql_real_escape_string/man for the MySQL extension), and includes using prepared statements.

htmlspecialchars() is the correct function to use to print text to a webpage, where the text could contain unescaped special characters, e.g., the text is supplied by user and stored in the database.

leatherback

laserlight wrote:
The correct method depends on the database API (e.g., [man]mysql_real_escape_string/man for the MySQL extension), and includes using prepared statements.

htmlspecialchars() is the correct function to use to print text to a webpage, where the text could contain unescaped special characters, e.g., the text is supplied by user and stored in the database.

My bad / My apologies.

Laser: If you could, would you mind at some point help me put together a short tutorial on sanitizing input data, so I can just put it on my coding section on the web?

I will write the thing, and ask you to go over it? I know I am rubbish at some of these things, as you may have understood from my response to your PM.

ProfessorDan

That's what I used, the mysql_real_escape_string. So is that good enough then?
I think my MySQL uses IMAPI.

laserlight

ProfessorDan wrote:
That's what I used, the mysql_real_escape_string. So is that good enough then?

Probably. It is your best bet for string input with the MySQL extension.

leatherback wrote:
Laser: If you could, would you mind at some point help me put together a short tutorial on sanitizing input data, so I can just put it on my coding section on the web?

When I get the motivation to go back to tutorial writing, yes :p