php help!!

[svazquez]

Allright,

well i'm devloping this small app that is like a blog/update type of thing, so far i've got it all figured out. However i'm stuck in one section, comments.

the comments are working, you can post a comment and it will go, however, it is not posted under any posts.

Yes i've created the sql database table, with an id field, set as INT and not null.

Now i've experimented with it, and if i add an id to the field, the comment is posted into the right post, but thats only if i do it through the databse. So i know it has do with some of the code ihave or the way i set it up, i just don't know what else to try.

So i need some help from people who know their way around php.

The code that proccess the form is posted below

<?php
require_once("config.php"); 

$id = intval($_REQUEST["id"]);

$sql = "SELECT title FROM updates WHERE id = $id";
$result = mysql_query($sql, $connection) or die(mysql_error());
if (mysql_num_rows($result) != 0) {
    header("Location: index.php");
    exit;
}

$name = mysql_escape_string(strip_tags($_REQUEST['name']));
$email = ($_REQUEST['email']);
$comment = mysql_escape_string(strip_tags($_REQUEST['comment']));
$comment = nl2br($comment);

$sql="INSERT INTO comments (name, email, comment, id)
VALUES
('$_POST[name]','$_POST[email]','$_POST[comment]','$_POST[id]')";

if (!mysql_query($sql,$connection))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

?>

The form itself is posted below

<form method="POST" action="comment.php">
<table width="500" border="0" cellspacing="0" cellpadding="0">
  <tr>
    <td colspan="2"><input type="hidden" name="id" value="'$id"></td>
    </tr>
  <tr>
    <td width="135">Name</td>
    <td width="365"><label>
      <input type="text" name="name" id="name">
    </label></td>
  </tr>
  <tr>
    <td>Email</td>
    <td><label>
      <input type="text" name="email" id="email">
    </label></td>
  </tr>
  <tr>
    <td>Comments</td>
    <td><label>
      <textarea name="comment" id="comment" cols="45" rows="5"></textarea>
    </label></td>
  </tr>
  <tr>
    <td colspan="2"><label>
      <input type="submit" name="submit" id="submit" value="Post Comment">
    </label></td>
    </tr>
</table>

</form>

So if any know can help me point what i've done wrong that i can't see i would gladly help!

Thank you!

[Kudose]

First, your form method should be lowercase

Second, there is an erroneous apostrophe in front of your $id, which should be value="<?php echo $id; ?>

Thrid, since you are POSTing data, you should get your values from $POST, instead of $REQUEST as $REQUEST also has the values of $GET and others in it.

Fourth, why are you checking that no id exists? Don't you need an id to post a comment to?

Fifth, you are doing your data sanitation and declaring them to variables, but your SQL is using the $_POST values, which you never use before then.

Hope that helps.

[Kudose]

Also (sixth I guess), you should enclose your array subscripts in quotes when you are not accessing a numeric index.

i.e.

$POST[email] should be $POST['email']

[svazquez]

Thanks, but...

I made the small fixes, that i hadn't notice, however i'm still getting nothing, i added an estra line on the code, thought that migh had been but nothing either. Anyway this is how it looks right now

<?php
require_once("config.php"); 


$name = mysql_escape_string(strip_tags($_POST['name']));
$email = ($_POST['email']);
$id = ($_POST['id']);
$comment = mysql_escape_string(strip_tags($_POST['comment']));
$comment = nl2br($comment);

$sql="INSERT INTO comments (name, email, comment, id)
VALUES
($_POST['name'],$_POST['email'],$_POST['comment'],$_POST['id'])";

if (!mysql_query($sql,$connection))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

?>

and below is what the body of my post display page looks like, i'm not sure if its something there or not but hey take a look at it and tell me if you something that shoulnd't be there. (The posts display just fine, i have no issues with it, my issue is with the comments process, that doesn't display the comments in the posts)

<?php
if(is_numeric ($_GET['id'])) {
	$sql = "SELECT * FROM updates  WHERE id={$_GET['id']} "; 
	$result = @mysql_query($sql, $connection) or die (mysql_error());
	while ($row = mysql_fetch_array($result)) {
	if (mysql_num_rows($result) == 0) {
		die('No entries in this blog.'); 
	} else{
		echo "
      	<table width='500' border='0' align='center' cellpadding='0' cellspacing='0' id='updates'>
	  <tr>
            	<td>
                	<div class='heading'>
                    	<h1>{$row['title']}</h1>
                    </div>
                </td>
          </tr>
			<tr>
  				<td >
  					<h3>{$row['date']}</h3>
           	  </td>
		  </tr>
            <tr>
                <td >
                     	<p>{$row['post']}</p>
                </td>
          </tr>
        </table>";
}
}
}

$sql = "SELECT comment, name FROM comments  WHERE id={$_GET['id']} ORDER BY comment_id";
$result = @mysql_query($sql, $connection) or die (mysql_error());
while ($row = mysql_fetch_array($result)) {
if (mysql_num_rows($result) == 0) {
	die('No entries in this blog.'); 
} else{
		echo "
			<table width='200' border='0'>
				<tr>
					<td>{$row['name']}</td>
				</tr>
				<tr>
					<td>{$row['comment']}</td>
				</tr>
				</table>";
			}
		}
?>

<form method="POST" action="comment.php">
<table width="500" border="0" cellspacing="0" cellpadding="0">
  <tr>
    <td colspan="2"><input type="hidden" name="id" value="<?php echo $id; ?>"></td>
    </tr>
  <tr>
    <td width="135">Name</td>
    <td width="365"><label>
      <input type="text" name="name" id="name">
    </label></td>
  </tr>
  <tr>
    <td>Email</td>
    <td><label>
      <input type="text" name="email" id="email">
    </label></td>
  </tr>
  <tr>
    <td>Comments</td>
    <td><label>
      <textarea name="comment" id="comment" cols="45" rows="5"></textarea>
    </label></td>
  </tr>
  <tr>
    <td colspan="2"><label>
      <input type="submit" name="submit" id="submit" value="Post Comment">
    </label></td>
    </tr>
</table>

</form>

[svazquez]

i forgot to say that after i made the changes i get this error when i process it

"Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home2/socalcom/public_html/testBlog/comment.php on line 13"

I noticed this has to do with the insert to sql section, if i add the single quotations to the outside as '$POST[email]' the error message doesn't appear, but if add them inside $POST['email'] i get this error

[djjjozsi]

just a few suggestions:

how to send a number into a query in a better way:

$sql = sprintf("SELECT * FROM updates  WHERE id=%d", $_GET['id'] );

If you paste string into a mysql table, the inserted string should be placed with apostrofes.

$sql=sprintf("INSERT INTO comments 
(name, email, comment, id)
VALUES
('%s','%s','%s','%d')",
$name, $email, $comment, $id  );