The Planet Forums > small code

The Planet Forums > General > The Lounge

patriotcow

Feb 23 2005, 12:44 AM

Aprreciate your help if you can spot the error in this, the error is Parse error: parse error, unexpected T_STRING in /home/patriot/public_html/publish.php on line 14

CODE

<?php

require_once("./connect.php");

?>

<form action="<?php echo $_server['PHP_SELF']; ?> method="post">

<label>Insert news here:<br />

<textarea mame="newstext" rows="10" cols="40">

</textarea></label><br />

<input type="submit" value="SUBMIT" />

</form>

<?php

if (isset($_POST['newstext'])) {

$newstext = $_POST['newstest'];

$sql = "INSERT INTO news SET"

newstext = '$newstext';

if (@mysql_query($sql)) {

echo '<p>News has been submitted</p>';

} else {

echo '<p>Error adding news: ' .

mysql_error() . '</p>';

}

}

?>

Thanks alot!

eddy2099

Feb 23 2005, 12:51 AM

I have no knowledge of PHP but shouldn't each command line terminate with a ';' ?

Line 13 reads

CODE

$sql = "INSERT INTO news SET"

should it be

CODE

$sql = "INSERT INTO news SET";

Just a thought.

patriotcow

Feb 23 2005, 01:01 AM

Thanks for that I think that fixed somthing, new error now sadfully

Parse error: parse error, unexpected '=' in /home/patriot/public_html/publish.php on line 14

CODE

<?php

require_once("./connect.php");

?>

<form action="<?php echo $_server['PHP_SELF']; ?> method="post">

<label>Insert news here:<br />

<textarea mame="newstext" rows="10" cols="40">

</textarea></label><br />

<input type="submit" value="SUBMIT" />

</form>

<?php

if (isset($_POST['newstext'])) {

$newstext = $_POST['newstest'];

$sql = "INSERT INTO news SET";

newstext = '$newstext';

if (@mysql_query($sql)) {

echo '<p>News has been submitted</p>';

} else {

echo '<p>Error adding news: ' .

mysql_error() . '</p>';

}

}

?>

I am no expert this is my first site I am coding in php with an admin side to it.

patriotcow

Feb 23 2005, 01:03 AM

Ok I managed to get the form to display at http://www.patriotcow.com/publish.php
but when you submit I dont know why it does what it does.
Thanks for the help.

eddy2099

Feb 23 2005, 01:16 AM

Spotted another issue

CODE

<form action="<?php echo $_server['PHP_SELF']; ?> method="post">

gives you

CODE

Shouldn't it be

CODE

<form action="<?php echo $_server['PHP_SELF']; ?>" method="post">

talkster5

Feb 23 2005, 01:19 AM

Have you tried using www.phpbuilder.com ? You will get a lot more help there.

DeadEye686

Feb 23 2005, 01:40 AM

CODE

$sql = "INSERT INTO news SET";

newstext = '$newstext';

should be

CODE

$sql = "INSERT INTO news (newstext) VALUES ('$newstext')";

and for SQL injection protection, I would use:

CODE

$sql = sprintf("INSERT INTO news (newstext) VALUES ('%s')", mysql_real_escape_string($newstext));

(note the above is all one line if it breaks down into two on your display)

patriotcow

Feb 23 2005, 02:03 AM

Ok thanks for that both of you, it works good now

http://vbulletinstudio.com simple but can add features now I have the basics done

patriotcow

Feb 23 2005, 01:40 PM

Not happy now somone took advantage

Humper92

Feb 23 2005, 01:48 PM

why does vbulletinstudio.com go to putfile.com?

patriotcow

Feb 23 2005, 01:55 PM

Not sure somone inserted loads of weird codes :shock: And disgusting pics. should be ok now.

gordonrp

Feb 23 2005, 03:04 PM

QUOTE (Humper92)

why does vbulletinstudio.com go to putfile.com?

he he

DeadEye686

Feb 23 2005, 03:18 PM

QUOTE (gordonrp)

QUOTE (Humper92)

why does vbulletinstudio.com go to putfile.com?

he he

evil!

richyc

Feb 23 2005, 04:46 PM

Bit o'warning: going to vbulletinstudio.com at the moment spawns a lot of pop/new windows(!) I had to forcably kill Firefox for the first time ever

I did try my hand and "cleaning up" the database, but either patrioitcow has now secured it against further exploits or I'm not as good at MySQL injection as I thought I was....

Paul

Feb 23 2005, 04:59 PM

Small question; do you have permission from vbulletin to use their name, or is this going to be the whole paypal thing over again?

JustGags

Feb 23 2005, 05:03 PM

QUOTE (richyc)

Bit o'warning: going to vbulletinstudio.com at the moment spawns a lot of pop/new windows(!) I had to forcably kill Firefox for the first time ever

Yeah, same here. I was pissed.

patriotcow

Feb 23 2005, 05:38 PM

They dont mind but I mind who ever put that code in again, had to force all my firefox to close and I was in a middle of somthing. :shock:

atech

Feb 24 2005, 06:35 AM

Well I see that you have stopped HTML being entered now - so it should be ok for a bit.

You may want to log their IP address also using the $HTTP_SERVER_VARS["REMOTE_ADDR"]; variable....

adamuk

Feb 24 2005, 10:48 AM

QUOTE (DeadEye686)

CODE

$sql = "INSERT INTO news SET";

newstext = '$newstext';

also newstext needs to be $newstext

DeadEye686

Feb 24 2005, 11:39 AM

No, the code was wrong to begin with - the SQL statement had been split onto two lines accidentally

SilveR

Feb 24 2005, 08:29 PM

I see you've got all your dangerous characters escaped. Good job.

patriotcow

Feb 24 2005, 09:37 PM

thanks gordan for telling me what function I needed. now just need to change the query so it does the newest at the top and shows only 3

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.