API tools faq
paste
Advertisement
Guest User

A simple guest book with escaping sql and html

a guest
Dec 1st, 2013
591
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 4.77 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2.     /*
  3.      * a simple guest book with escaping sql and html
  4.      * using mysqli and htmlentities
  5.      *
  6.      * by Inndy @ 2013/12/01
  7.      */
  8.     error_reporting(0);
  9.    
  10.     define("DB_HOST", "127.0.0.1");
  11.     define("DB_USER", "guestbook");
  12.     define("DB_PASS", "nr168crD2Uv8r62m");
  13.     define("DB_NAME", "mysqli_sample_guestbook");
  14.    
  15.     $db = new mysqli(DB_HOST, DB_USER, DB_PASS);
  16.     if ($db->errno)
  17.         exit("Can't connect to DB.");
  18.     if (!$db->select_db(DB_NAME))
  19.         exit("Can't select DB.");
  20.     $db->query("CREATE TABLE IF NOT EXISTS `messages` ( `mid` int(11) NOT NULL AUTO_INCREMENT, `name` varchar(128) NOT NULL, `age` int(11) NOT NULL, `msg` varchar(4096) NOT NULL, PRIMARY KEY (`mid`)) AUTO_INCREMENT=1 DEFAULT CHARSET=utf8;");
  21. ?><!DOCTYPE HTML>
  22. <html>
  23. <head>
  24.     <meta charset="UTF-8">
  25.     <title>mysqli sample guestbook</title>
  26.     <style type="text/css">
  27.         html, body, div { margin: 0; padding: 0; line-height: 1; }
  28.         body { font-family: sans-serif; background-color: #333; color: #EEE; text-shadow: 0 0 1px black; }
  29.         input[type=text], textarea { width: 100%; outline: 0; }
  30.         label { cursor: pointer; display: block; }
  31.         button {
  32.             background-color: #63C;
  33.             border: 0;
  34.             border-radius: 4px;
  35.             color: #DDD;
  36.             padding: 6px 16px;
  37.         }
  38.         button:hover {
  39.             background-color: #84F;
  40.             color: #FFF;
  41.         }
  42.         button:active {
  43.             background-color: #429;
  44.             color: #CCC;
  45.         }
  46.        
  47.         pre { word-wrap: break-word; }
  48.        
  49.         #content { max-width: 1000px; margin: 0 auto; }
  50.        
  51.         table { border-collapse: collapse; width: 100%; max-width: 100%; }
  52.         th, td { padding: 6px 8px; }
  53.         #table_form td { text-align: right; }
  54.         #msgs td { border: 1px solid white; }
  55.     </style>
  56. </head>
  57. <body>
  58.     <div id="content">
  59.         <h1>MySQLi Sample Guest Book</h1>
  60.         <hr />
  61.         <h2>Leave a message!</h2>
  62.         <form action="index.php" method="post">
  63.             <input type="hidden" name="act" value="new_msg" />
  64.             <table id="table_form">
  65.                 <tr>
  66.                     <th><label for="name">Name</label></th>
  67.                     <td><input type="text" name="name" id="name" /></td>
  68.                 </tr>
  69.                 <tr>
  70.                     <th><label for="age">Age</label></th>
  71.                     <td><input type="text" name="age" id="age" /></td>
  72.                 </tr>
  73.                 <tr>
  74.                     <th><label for="msg">Message</label></th>
  75.                     <td><textarea name="msg" id="msg" cols="30" rows="10"></textarea></td>
  76.                 </tr>
  77.                 <tr><td colspan="2"><button type="submit">Submit</button></td></tr>
  78.             </table>
  79.             <?php
  80.                 if (isset($_POST['act']) && $_POST['act'] == "new_msg") {
  81.                     $st = $db->prepare("INSERT INTO `messages` VALUES(NULL, ?, ?, ?)");
  82.                     // magic quotes has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.
  83.                     // if (get_magic_quotes_gpc())
  84.                     //     array_map(stripslashes, $_POST);
  85.                    
  86.                     // to escape HTML
  87.                     $_POST = array_map(htmlentities, $_POST);
  88.                     $st->bind_param("sis", $_POST['name'], $_POST['age'], $_POST['msg']);
  89.                     /*
  90.                         http://us2.php.net/mysqli.prepare
  91.                         s for string
  92.                         i for integer
  93.                         d for double
  94.                         b for blob
  95.                     */
  96.                     $msg = $st->execute() ?
  97.                         '<p style="color: #3F3;">Your message have been recorded successfully.</p>' :
  98.                         '<p style="color: #F33; font-weight: bold;">Your message recorded failed.</p>';
  99.                     echo $msg;
  100.                 }
  101.             ?>
  102.         </form>
  103.         <hr />
  104.         <h2>Messages</h2>
  105.         <table id="msgs">
  106.             <?php
  107.                 $msgs = $db->query("SELECT * FROM `messages`");
  108.                 foreach ($msgs as $data):
  109.             ?>
  110.             <tr>
  111.                 <td style="width: 30px;">#<?php echo $data['mid']; ?></td>
  112.                 <td style="width: 70px;">Age: <?php echo $data['age']; ?></td>
  113.                 <td><?php echo $data['name']; ?></td>
  114.             </tr>
  115.             <tr>
  116.                 <td colspan="3"><?php echo $data['msg']; ?></td>
  117.             </tr>
  118.             <?php endforeach; ?>
  119.         </table>
  120.         <br />
  121.         <p style="text-align: center; font-size: 75%;">By <a style="color: #39F;" href="http://inndyxd.blogspot.tw">Inndy</a></p>
  122.     </div>
  123. </body>
  124. </html>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!