Forum Moderators: coopster
here is line 7 and out on mye guestbook. Some of the spelling is in norwegian so don't mind
$query = "INSERT INTO Gjestebok ( 'Name', 'E-mail', 'Homepage', 'Comments')
VALUES ("'" . $_POST["Name"] . "'", "'" . $_POST["E-mail"] . "'", "'" . $_POST["Homepage"] . "'", "'" . $_POST["Comments"] . "'")";
if(!@mysql_query($query))
{echo("f00! feilmelding: fra mysql er: " . mysql_error());}
else
{echo("Thank You.<br><br>");}
mysql_close($connection);
<?php
$hostname = "localhost";
$user = "#*$!#*$!x";
$password = "#*$!#*$!x";
$db = "#*$!#*$!x";
$connection = @mysql_connect($hostname, $user, $password) or die("Umulig å få kontakt med database");
@mysql_select_db($db)
$query = ("INSERT INTO Gjestebok ( 'Name', 'E-mail', 'Homepage', 'Comments');
VALUES ('" . $_POST["Name"] . "', '" . $_POST["E-mail"] . "', '" . $_POST["Homepage"] . "', '" . $_POST["Comments"] . "'));
if(!@mysql_query($query))
{echo("f00! feilmelding: fra mysql er: " . mysql_error());}
else
{echo("Thank You.<br><br>");}
mysql_close($connection);
?>
<?php
$hostname = "localhost";
$user = "#*$!#*$!x";
$password = "#*$!#*$!x";
$db = "#*$!#*$!x";
$connection = @mysql_connect($hostname, $user, $password) or die("Umulig å få kontakt med database");
@mysql_select_db($db);
$query = ("INSERT INTO Gjestebok ( 'Name', 'E-mail', 'Homepage', 'Comments');
VALUES ('" . $_POST["Name"] . "', '" . $_POST["E-mail"] . "', '" . $_POST["Homepage"] . "', '" . $_POST["Comments"] . "'));
if(!@mysql_query($query))
{echo("f00! feilmelding: fra mysql er: " . mysql_error());}
else
{echo("Thank You.<br><br>");}
mysql_close($connection);
moreover I spotted few security breaches in your code:
always use mysql_real_escape_string [php] when inputting external data to db (regardless if it's insert or select):
$query = ("INSERT INTO Gjestebok ( 'Name', 'E-mail', 'Homepage', 'Comments');
VALUES ('" . mysql_real_escape_string($_POST["Name"]) . "', '" . mysql_real_escape_string($_POST["E-mail"]) . "', '" . mysql_real_escape_string($_POST["Homepage"]) . "', '" . mysql_real_escape_string($_POST["Comments"]) . "'));
also you could validate email before sending it to db, and filter comments, so they don't contain bad word nor spam.
Moreover as this is form I would use some CAPTCHA to disable bots.
Hope this helps you
Regards
Michal