I'm currently building a website for my friends and me, and I've decided to have the homepage use a news system. I have the page working with PHP to load articles from my MySQL Database, and that's working fine. My real issue is with the page that adds items to the MySQL database. I am using the normal query system ("INSERT INTO table VALUES ('', '', '', '', '')") but I'm using variables inside the query. The variables pull their values from a POST method on the same page, and it seems to run fine; except for the <textblock> part of the POST form. (I'll quote the code in a second, because I'm quite aware that what I say has a way of confusing even experts...) Whenever someone (me) writes anything in the textblock that requires a single or double quote, the SQL submission fails.
I figure that it has something to do with the fact that I've been testing it using single quotes (So the pattern goes " ' '), so I tried reversing the pattern of the query itself (' " ') and that worked. Issue there is that people won't be able to use double quotes then; or for example, both quotes at the same time.
What I reeeaally want is for the people to not need to escape the quotes (\' \"), but still be able to use both kinds.
The code for the submission form is currently:
<?php
if($_POST['submit']){
$title = $_POST['title'];
$content = $_POST['content'];
$creator = $_POST['creator'];
date_default_timezone_set('America/Vancouver');
$date = date('F d, Y h:i:s a');
if(strlen($content)>6000){
echo "Article is too long.";
} else {
if(strlen($title)>60){
echo "Title is too long.";
} else {
require "dbc.php"; //Connects to the user database
$query = mysql_query("SELECT * FROM loginData WHERE username='$creator'");
while($rows = mysql_fetch_assoc($query)){
$dbusername = $rows['username'];
}
if($creator == $dbusername){
require "ndbc.php"; //Connects to separate database for the news.*
$query = mysql_query("INSERT INTO list VALUES ('', '$title', '$content', '$creator', '$date')") or die (mysql_error());
die("Article Submission Complete! <a href='index.php'>Click here to return.</a>");
} else echo "Username does not exist.";
}
}
}
// * In case anyone asks, I'm using a separate database for the news articles because I
// plan on building a commenting system for each news item. Shouldn't prove too difficult.
?>
<html>
<form action="newNews.php" method="POST" />
Title: <input type="text" name="title" value="<?php echo "$title"; ?>" /><br />
Content: <textarea name="content" cols="40" rows="5"><?php echo "$content" ?></textarea><br />
Creator: <input type="text" name="creator" value="<?php echo "$username"; ?>" /><br />
<input type="submit" name="submit" value="Submit" />
</form>
</html>
Also; if anyone wants to see the issue firsthand on the site, the address is http://chatline.ennilla.com/ and the page for submitting articles is http://chatline.ennilla.com/newNews.php . Because the system currently only requires you to have a valid ID for creating posts, just use 'wildpin' (no quotes) because the sign-up page is currently damaged as well. As a warning though, there is currently a demo of the Java Live chat system I'll be implementing later on the main page. It'll give a pop up, but you can just ignore it. Nobody'll be using it.
