Help
CONFIG.PHP (Protect function)
Ok so first off we do this in creating a function and a variable called string
<?php
function protection($string){
$string = mysql_real_escape_string($string);
$string = strip_tags($string);
return $string;
}
?>
Ok so basically this protects any data inserted in the database from mysql injection.
Next part we will work on is connecting to a database called forum part2 of this tutorial will be creating the database but for now lets write the function that will connect to it.
CONNECTION FUNCTION
ok so lets create a function called connect
[code]
<?php
function protection($string){
$string = mysql_real_escape_string($string);
$string = strip_tags($string);
return $string;
}
function connect(){
mysql_connect(localhost,username,'pass') or die ("Can not connect to database");
mysql_select_db(forum);
}
?>
Alright so far we have 2 functions one that connects to the database and the other that protects info inserted in the database so pretty simple so far huh well it'll prob get harder but imma try to explain it best i can for the purpose of this tutorial we wont deal with registrations and logins just a basic forum. And we also are not gonna do a really big layout on this since im just teaching u but just basic lol ok so lets move on to add_topic.php. Basically this file will as it says insert topic data into our database table named topics which will be in our database named forum.
ADD_TOPIC.PHP
alright so lets break it down nice and easy the first thing we will do is include our file config.php and call our connect function
<?php
include("config.php");
connect();
?>
So we included our file then called the connect function right below it as u can see next we will create the variables to hold the data for our 3 main fields the topic title,topic description, and topic body
<?php
include("config.php");
connect();
$title = protection($_POST['title']);
$description = protection($_POST['description']);
$body = protection($_POST['body']);
?>
Ok so now u can see we have our variables and one thing i forgot to mention is we wrap our variables in the protection function to keep them safe when inserted.
lets create a new array called errors this will hold any errors such as if someone leaves a field blank then it will display any errors before continuing.
<?php
include("config.php");
connect();
$title = protection($_POST['title']);
$description = protection($_POST['description']);
$body = protection($_POST['body']);
//error array
$errors = array();
?>
Alright we got the main variables out the way now we will do a little error checking for the form that we will create later on.
<?php
include("config.php");
connect();
$title = protection($_POST['title']);
$description = protection($_POST['description']);
$body = protection($_POST['body']);
//error array
$errors = array();
//Only do the stuff below if the submit button is pressed
if(isset($_POST['submit'])){
if(!$title){
$errors[] = "I am sorry you must provide your topic with a title!";
}
if(!$body){
$errors[] = "The main body of your topic can not be left blank!";
}
if($title){
$check = "SELECT * FROM topics WHERE title = '".$title."'";
$check2 = mysql_query($check) or die (mysql_error());
if(mysql_num_rows($check2) == 1){
$errors[] = "The title you have supplied has already been used for a topic";
}
}
if(count($errors) > 0){
foreach($errors AS $error){
echo "<p>$error <br /></p>";
}
}else{
$insert = "INSERT INTO `topics` (`id`,`title`,`description`,`body`,`datetime`)
VALUES('id','$title','$description','$body',now())
";
mysql_query($insert) or die(mysql_error());
echo "<p><center>Thank you the topic ".$title." has now been added</center></p>";
// Close database connection since we dont need it no more right now
mysql_close();
}
}
//Create our submit form
//only show the form below if the submit button has not been pressed
if(!isset($_POST['submit'])){
echo "
<form method=\"POST\" action=\"add_topic.php\">
";
echo "
<p><b>Title: </b><input type=\"text\" name=\"title\"></p>
<p><b>Description(optional): </b><input type=\"text\" name=\"description\"></p>
\"></p>
<p><textarea name=\"body\" rows=\"7\" cols=\"40\"></textarea></p>
<p><input type=\"submit\" name=\"submit\" value=\"Add new topic\"></p>
";
echo "</form>";
}
?>
Ok so that basicly concludes this part so far so feel free to try it out if i made any mistake in the code please let me know and i'll fix them right away cause i have not tested it yet before i posted thanks and cheers
