Building My Own CMS Scripts - Need Direction

SportinStyle

So I have the first two pages down for my new Content Management System, I intend to call personalCMS. Can anyone with vast knowledge look at my two scripts and let me know if they should theoretically work, or if anything should be changed.

Thanks in advance!

Here is my add_content.php script:

<?php
/ taking no steps to ensure the information provided is valid. this is assuming administrators will find this on their own, as they are the only ones able to post /
if (isset($SESSION['username'])) {
echo '<form action="add_content.php">
<h1>Title of Page</h1>
<input name="title" type="text" length="20" /><br />
<h1>Author</h1> (if applicable)
<input name="author" type="text" length="20" /><br />
<h1>Content/Article</h1>
<textarea name="content"></textarea>
<input type="hidden" name="submitted" />
<input type="submit" name="submit" title="Submit!" />
</form>';
} else {
// redirect to login
header( 'Location: http://www.experienceascension.com/personalCMS/login/login.php?redirectback=addcontent.php' );
}
?>
<?php
if (isset($POST['submitted'])) { // if the form was submitted, do this
$title = $POST['title'];
$author = $POST['author'];
$content = $_POST['content'];
include_once '/personalCMS/sql/mysql_connect.php';
$query = "INSERT $title, $author, $content AS title, author, content INTO content_db";
$result = mysql_query($query);
if (mysql_affected_rows == 1) { // if it inserted, do this
echo 'SUCCESS! Your Content WAS uploaded.';
} else {
echo 'FAILURE! Your Content did NOT upload.';
}
} else {
	// do nothing
}
?>

and here is my Login.php script:

<?php
if (isset($SESSION['username'])){ // already logged in, do this
echo 'You are already logged in, ' . $row['name'] . '.';
} else {
if (isset($POST['submitted'])) { // if the form was submitted
$errors = array();
if (empty($POST['email'])) {
$errors[] = 'You forgot to enter your email.';
} else {
$e = escape_data($POST['email']);
}
if (empty($POST['password'])) {
$errors[] = 'You forgot to enter your password.';
} else {
$p = escape_data($POST['password']);
}
if ($errors) {
foreach ($errors as $msg) {
echo "The following errors occured: <br /> -$msg<br />";
}
} else {
include_once '/personalCMS/sql/mysql_connect.php';
$query = "SELECT username FROM users WHERE password='$p' AND email='$e'";
$result = mysql_query($query);
session_start();
$SESSION['username'] = $row[username];
if ($result) { // if the query ran, do this
echo "You are now logged in, $SESSION['username']";
} else {
echo "You weren't able to be logged in. Error: mysql_error()";
}
}
} else {  // display the login form 
	echo '<form action="login.php" method="post">
	<h1>Enter your Email</h1>
	<input type="text" name="email" length="20" /><br />
	<h1>Password</h1>
	<input type="password" length="20" name="password" />
	<br />
	<input type="hidden" name="submitted" />
	<input type="submit" name="submit" title="Login!" /></form>';
	}
}
?>

So far, add_content.php works fine, but when it takes me to "login.php", I get an error: Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in .......l/personalCMS/login/login.php on line 28

All good, or not at all?

Krik

It would be much easier to read your code if it was in the phpbb PHP tag instead of the quote tag. And if the different lines had some tabbing to help brake it up a bit.

A few tips and one problems

First the problem. session_start() can never be anything but the absolute first line of all code. Nothing not HTML not php not javascrip, nothing can be proccessed before it.

<?php
session_start();

//all code HTML Everything below here

?>

And if login is an include on nother page it must be included in the very first line or the session_start() moved to that pages first line.

<?php
include('login.php');

// all code below here

?>

in your add_content.php page

else {
// do nothing
}

If that is empty just delete the whole else statement.

in your login script this

else {
if (isset($_POST['submitted']))

could be

elseif (isset($_POST['submitted']))

Also in 2 places you have errors[] set. Shouldn't it be $errors[].

I hope you are testing as you go because if you are and missed the above mistakes something is worng. And if you are not testing your code as you go your bound for lots of little errors plaguing you and you will be looking though monstorous amounts of code you have to find them. Verses if you test as you go you can find the mistakes based on what you just changed previous to the error.