Comment Form (sort of web app) code help

Author1ty

Hi!

This is my first post to the forum and as such I have no real idea of how things work around here. But to the point...

I have just started learning PHP (yes another newbie) and I have done the lynda.com basic course and have subsequently written my own comment form(make comment, view comments, approve comments) web app. If I could call it that. I would very much appreciate it if someone could look over my code and tell me where I am going wrong and what I can do better. There is nothing that is not working the the code I would just like to know what can be done better. I have tried to make variables easy to read and obvious so it should be an easy 5 min job If anyone should feel inclined to help me out please let me know and I will upload my code. Somehow.

Thanks a lot PHP people!

Hoping for help,

Author1ty

bradgrafelman

@: First off, welcome to PHPBuilder!

Second, I've moved your thread to the Code Critique forum; here, you can feel free to post up as much code as you deem relevant/necessary and ask for critiques as to how it could be improved (including topics such as security).

You can try posting your code in the body of your next post (don't forget to surround it with [noparse]

..

[/noparse] bbcode tags, though!), but if it won't fit due to the character limit, you can instead try attaching the files to your next post. Below the "Reply to Thread" main table, you should see an "Additional Options" table that includes a "Manage Attachments" button. If you don't, let me know - it's possible that this feature isn't enabled for new users and we'll have to figure something else out.

Author1ty

@: Thanks for your effort! I appreciate it!

It has quite a few pages (well too many to post in the text here and still make sense!). So I have uploaded a zip this should work well I hope. I am not sure how to save a database but I have tried to save the one for this program.

But thanks once again for your help! It is really appreciated!

So yeah if anyone could have a look at the code and let me know what they think that would be awesome!

Cheers and Merry Christmas! 🙂

Author1ty

bradgrafelman

Some general comments I can make already without delving into the code too deeply:

User-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data using a function such as [man]mysql_real_escape_string/man (for string data).
Note that the 'mysql' library itself is outdated; newer applications should attempt to use a more up-to-date library such as [man]mysqli[/man] or [man]PDO[/man].
Your scripts will only work if output_buffering is enabled, since many of them include line breaks at the beginning of them. For example, the beginning of approve_comment.php is:
```
<?php require_once("includes/functions.php"); ?>
<?php require_once("includes/connection.php"); ?>
<?php 
```
which includes two line breaks that are being sent as output. Since I personally never use output_buffering, your scripts would thus not work on my server. You might want to consider removing all output before any possible redirects can occur.
Displaying [man]mysql_error/man on development servers is fine, but note that it should never be done in production. Instead, you should be logging such error/debug information and instead display a "friendly" (and non-revealing) error message to the user.
You might want to obfuscate your MySQL credentials. 😉
You've got a few copy-and-paste errors in a couple files. For example, in connection.php, you run confirm_query() on the same $connection twice. In the comment_form.php file, you have two form elements with the same "email" id value.

Some general comments about your DB schema:

Note that valid e-mail addresses can certainly be longer than 40 characters.
Speaking of valid e-mail addresses, you don't appear to do any sort of validation on the supplied e-mail address to confirm that it at least looks valid. For this, consider using [man]filter_var/man with the FILTER_VALIDATE_EMAIL flag/option.
Speaking also of length requirements, you don't appear to do any checking to see if the length of the data will fit in the DB. Depending upon the SQL mode that MySQL is running in, data that won't fit in the table will either be truncated or cause the entire query to fail, so you should at least mention these maximum length values in the form and do some length-checking or check to see if the query failed because of data exceeding a column's maximum size.
I note that you're using the latin1 charset; this is fine for languages such as English, Spanish (I think?), but note if you gain any international friends from overseas they'll likely run into problems typing in their native tongue.

To avoid that problem, I personally try to design new applications using a Unicode charset (namely UTF-8) throughout (e.g. all HTML pages declare the UTF-8 charset, all database/tables/columns use UTF-8, etc.). The choice, however, is yours to make.

Author1ty

Thanks a lot for the comments!

Sorry for taking so long to reply but I just managed to pick myself up off the floor after that review of my efforts. For some reason I was under the impression I had done something pretty good for a beginner ha ha ;-)

Just kidding thanks a lot for the long message I really appreciate and you have given me a lot to work on and that's always a good thing!

Hope you had a good Christmas and new year!