Member Avatar for Mr.M

Hi DW.

I have built a website using Mobirise and now what I want to do is to enable the site to accept comments from people and also display them on the page on the section COMMENTS, now the problem is that I want the comments to use the themes format but the problem with that is that the javascript produce and error if I take the entire DIV section that produce this comment style so that it will be applied to each and every comment. Please check the site and click on the Piracy Impact and check the comment section to see how I want all of my comments to show like. I have 2 php files which one is for retrieving the comment and the other for retrieving the name, this helps me to keep the style but this only works for the first comment, then the rest just displays bellow the first comment and without separating the retrieving process the name is not displayed in a correct stye.

Bellow are the codes that I use to retrieve data:

1) Display Comments

<?php

$con = mysql_connect("xxxxx","xxxxx","xxxxx");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}

mysql_select_db("ndlelabyte",$con);

$article_id = $_GET['id'];

$query = "SELECT * FROM `ndlelabyte`.`messages` WHERE `articleid` =$article_id LIMIT 0 , 30";
$condolencey = mysql_query($query);

while($row = mysql_fetch_array($condolencey, MYSQL_ASSOC))
{

$cond = $row['comments'];

echo "<p>$cond</p>
";
}

mysql_close($con);

?>

2) Displaying the name is the similar code as above but this time I point/retrieve the name.

On my page I have this under the comment section.

<div class="mbr-testimonial card">
                        <div class="card-block"><p>
                    <?php include("display_comments.php"); ?></p></div>
                        <div class="mbr-author card-footer">

                            <div class="mbr-author-name">
<?php include("display_name.php"); ?>
</div>
</div>
</div>

Now as you can see doing this will only show the last comment but if I had placed the DIV inside the php files which retrieves data from a MySQL database I would'nt have a problem because each message was going to be displayed as it should be with the style I want to keep.

How can I solve this problem?

  • 2 Contributors
  • 3 Replies
  • 335 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by Mr.M

Dani AI

Generated

Short summary and the root cause
Moving the theme/container markup into the database-retrieval loop is the right fix: the original includes printed comment text into a single theme DIV, so only one styled block existed while the rest were appended as plain text. As discovered, each comment needs its own theme wrapper (or the client-side renderer must build one) so the CSS/JS that styles a "card" applies per comment.

Security and structural best practices
Replace deprecated mysql_* calls with PDO or mysqli, validate the incoming id as an integer, and use parameterized queries to avoid SQL injection (good point from ). Always escape user content on output (for example with htmlspecialchars) to prevent XSS, and use nl2br when you want to preserve line breaks. Fetch author and comment together in one query rather than running separate queries per field, and order/paginate results (ORDER BY created_at DESC LIMIT ...) so large threads don’t slow the page.

Safe rendering pattern (example)
Use a prepared PDO query and render a small partial/template per row so markup stays clean and theme classes remain intact:

// PDO prepared fetch (minimal example)
$pdo = new PDO($dsn, $user, $pass, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$articleId = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if ($articleId) {
    $stmt = $pdo->prepare('SELECT comment_text, author_name, created_at FROM messages WHERE articleid = :id ORDER BY created_at DESC LIMIT 30');
    $stmt->execute(['id' => $articleId]);
    while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
        $text   = nl2br(htmlspecialchars($row['comment_text'], ENT_QUOTES, 'UTF-8'));
        $author = htmlspecialchars($row['author_name'], ENT_QUOTES, 'UTF-8');
        $time   = $row['created_at'];
        include 'comment-partial.php'; // partial outputs the theme markup using $text/$author/$time
    }
}

Extra tips
Keep logic and presentation separate (partials/templates), add server-side rate limits and CSRF protection for posting, and consider AJAX for loading/adding comments for a better UX. If you want strict theme fidelity, put the theme classes inside the partial so every comment prints with identical structure.

Member Avatar for Mr.M

I managed to get the solution to this problem and the solution is:

<?php
$mysqli = new mysqli($host, $user, $password, $database);
// DO ERROR CHECKING HERE

$article_id = isset($_GET['id']) ? $_GET['id'] : false;

if ($article_id) {
  $query = <<< QUERY
SELECT * 
FROM 
  `ndlelabyte`.`messages` 
WHERE 
  `articleid` ={$article_id} 
LIMIT 0 , 30
QUERY;

  $result = $mysqli->query($query);
  if ($result) {
    while ($row = $result->fetch_object()) {
      echo <<< COMMENT
  <div class="col-xs-12">
    <div class="mbr-testimonial card">
      <div class="card-block"><p>{$row['comments']}</p></div>
      <div class="mbr-author card-footer">
      <div class="mbr-author-name">{$row['author']}</div>
    </div>
    </div>
  </div>
COMMENT;
    }
  }
}
Member Avatar for Member #120589

Thanks for including the solution you found. However, you are in danger of SQL Injection as your input variables are not sanitized. Here's an example of what you could do:

<?php
$mysqli = new mysqli($host, $user, $password, $database);
// DO ERROR CHECKING HERE
if(isset($_GET['id'])){
    $article_id = filter_input(INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT);
    $stmt = $mysqli->prepare( "SELECT `comments`, `author` FROM `ndlelabyte`.`messages` WHERE `articleid`= ? LIMIT 0, 30" );
    $stmt->bind_param('i', $article_id);
    $stmt->bind_result($comments, $author);
    $stmt->execute();
    while ($stmt->fetch()) {
            echo <<< COMMENT
  <div class="col-xs-12">
    <div class="mbr-testimonial card">
      <div class="card-block"><p>$comments</p></div>
      <div class="mbr-author card-footer">
      <div class="mbr-author-name">$author</div>
    </div>
    </div>
  </div>
COMMENT;
    }
    $stmt->close();
}
$mysqli->close();
Edited by Member #120589
Member Avatar for Mr.M

Thanks.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.