doesn't work for me I did this...
// get data that sent from form
$topic=$_POST['topic'];
$detail=$_POST['detail'];
$name=$_POST['name'];
$email=$_POST['email'];
$datetime=date("d/m/y h:i:s"); //create date time
// Sanitize strings
$s_topic=mysql_real_escape_string($topic);
$s_detail=mysql_real_escape_string($detail);
$s_name=mysql_real_escape_string($name);
$s_email=mysql_real_escape_string($email);
// variables of malicious html
$s_protect='<meta http="refresh" content="1">';
// Insert topic
if($s_topic != $s_protect){
$sql="INSERT INTO $tbl_name(topic, detail, name, email, datetime)VALUES('$s_topic', '$s_detail', '$s_name', '$s_email', '$datetime')";
$result=mysql_query($sql, $dbLink);
}
The only reason you get the same result I think is because they are both == to nothing.
