d2jsp
Log InRegister
d2jsp Forums > Off-Topic > Computers & IT > Programming & Development > I Have A Noob Php Question
Add Reply New Topic New Poll
Member
Posts: 16,004
Joined: Jul 2 2009
Gold: Locked
Nov 24 2016 04:25pm
Hi guys,

I just started learning html, php and sql and I am making a homepage where people can register/login/logout.

I am making a forum where people can leave a reply. This is the code for it:
Quote

<?php
if($_SESSION["berechtigter_User"] != 1)
{
echo "Bitte logge dich ein um einen Eintrag zu verfassen!";

}
else
{
echo "Du bist eingeloggt";
}
?>



<form action = "kontaktundgaestebuch.php" method ="post">
Name:
<input type="text" size = "17" name = "name">
<br clear="all"/>
Kommentar:
<input type = "textfield" style="height: 150px; width: 300px" name = "kommentar">
<br clear="all"/>
<?php echo "Datum: ";?>
<?php
$datum = date("d.m.Y",$timestamp);
echo $datum;
?>
<br clear="all"/>
<input type = "Submit" value = "Abschicken">
</form>

<?php
if (!empty($_POST))
{
$name = $_POST['name'];
$comment = $_POST['kommentar'];

$eintrag = "INSERT INTO gaestebuch (name, kommentar) VALUES ('$name', '$comment')";

$eintragen = mysqli_query($db, $eintrag);
}
?>

<?php
$ergebnis = mysqli_query($db, "SELECT * FROM gaestebuch");
while($row = mysqli_fetch_object($ergebnis))
{
echo $row->name;
echo " schrieb am ";
echo $datum;
echo ": ";
echo $row->kommentar;
echo "<br />";
}
?>


I want however for only people who are logged in to be able to post, however everybody can see the comments.

I tried putting the form in the else {} instead of the "DU bist eingeloggt), but then echo's dont work because if you are not logged in the variables don't exist.

Can anybody help me with this?
Member
Posts: 10,803
Joined: Apr 5 2010
Gold: 20.00
Nov 24 2016 07:15pm
hey if you repost your code in english ill help

my project 4 allows all users to poat opinions on a certain book only if there logged in and all non logged in guests can click and view all opinions on that certain book,

ya i spent like 7 hours yesterday banges it out. still gotta add custon background and use css to make my maaterpeace look organized

This post was edited by jsbb on Nov 24 2016 07:19pm
Member
Posts: 16,004
Joined: Jul 2 2009
Gold: Locked
Nov 27 2016 08:41am
Quote (jsbb @ Nov 25 2016 01:15am)
hey if you repost your code in english ill help

my project 4 allows all users to poat opinions on a certain book only if there logged in and all non logged in guests can click and view all opinions on that certain book,

ya i spent like 7 hours yesterday banges it out. still gotta add custon background and use css to make my maaterpeace look organized


actually i already fixed it, I had to redefine the variables in the first if clause, and the i could use the code for the formular in the else clause and it works alright :)

do you write css yourself?
Member
Posts: 13,425
Joined: Sep 29 2007
Gold: 0.00
Warn: 20%
Nov 27 2016 11:56am
Sanitize your inputs or use parameterized queries.

This isn't 1990 any more.
Member
Posts: 16,004
Joined: Jul 2 2009
Gold: Locked
Nov 27 2016 12:48pm
Quote (AbDuCt @ Nov 27 2016 05:56pm)
Sanitize your inputs or use parameterized queries.

This isn't 1990 any more.


What does it mean to sanatize your inputs and what are parameterized queries?
As I said I am new to this shit I started not even 1 week ago..
Member
Posts: 10,803
Joined: Apr 5 2010
Gold: 20.00
Nov 27 2016 12:53pm
Quote (bochakaboy @ Nov 27 2016 09:41am)
actually i already fixed it, I had to redefine the variables in the first if clause, and the i could use the code for the formular in the else clause and it works alright :)

do you write css yourself?


yeah we had a choice between bootstrap or do it yourself. its not hard just use classes on the object body so the form or table tags then put ids or classes on the inputs labels etc. i will say dont use chrome when adding css its horrible or maybe its clous 9 idk

googled a few good backgrounds i actually kind of made it like pauls site not quite as much shit though im still i guess a noob aswell.
Member
Posts: 13,425
Joined: Sep 29 2007
Gold: 0.00
Warn: 20%
Nov 27 2016 01:16pm
Quote (bochakaboy @ Nov 27 2016 02:48pm)
What does it mean to sanatize your inputs and what are parameterized queries?
As I said I am new to this shit I started not even 1 week ago..


Sanitizing your inputs prevents clients from injecting malicious SQL queries into your original query allowing them to extract data. This is the most common way websites are usually breached.

Parameterized queries such as provided by PDO prevents SQL injection and provides a cleaner SQL API in general. If I recall it pre-fetches all results that match your query, and then applies your constraints to return the data you were querying for.

If you ran the PDO query PDO_query("Select name from names where name = ?", $name); PDO will send the query to the database and the database will know what kind of data you will be expecting and then PDO will pass the constraints as values to return only the row you wanted, or nothing. I can't explain it very well.

https://stackoverflow.com/questions/6786034/can-parameterized-statement-stop-all-sql-injection/33033576#33033576

This link does a better job.

This post was edited by AbDuCt on Nov 27 2016 01:17pm
Go Back To Programming & Development Topic List
Add Reply New Topic New Poll