CODEWITHSUNDEEP
php
Jason
Jason

Reputation: 1613

Sending messages fail when bulding a simle chat room

I try the tutorial on net to build chat room.

First I create a database in MYSQL called chatroom and buld a datasheet called chat with three columns:chtime, nick, words.

Then I write four PHP files, login.php, main.php, display.php, speak.php but encounting problem about display and speak. My speak doesn't work and I just pop up a new window without any words.

I don't know where is the problem?

I have tried to fix it several days but in vain. Where is my error?

The following is my code:

Login.php http://codepad.org/WIfr3quz

Main.php http://codepad.org/b9pXuNl0

Display.php http://codepad.org/o7pf5G57

Speak.php http://codepad.org/wFDEMrNk

Upvotes: 0

Views: 95

Answers (2)

bretterer
bretterer

Reputation: 5781

MAKE SURE YOU READ UP ON SQL INJECTION

Where is $words defined? 

    if ($words){
    $link = mysqli_connect('localhost', 'xxx', 'xxx', 'ChatRoom');
        $time = date('Y-m-d-a:i:s');
        $str = "INSERT INTO chat(chtime,nick,words) values('$time','$nick','$words')" ;
        mysqli_query($str,$link);
        mysqli_close($link);
}

You should so something to define these. Not sure what else to tell you without seeing what kind of errors show up.. This is where i would start though.. make the block look something like 

if(isset($_POST['words']))
    $link = mysqli_connect('localhost', 'xxx', 'xxx', 'ChatRoom');
        $time = date('Y-m-d-a:i:s');
            $nick = 'NickName';//However you would get the nick for the user
            $words = $link->real_escape_string($_POST['words']);
        $str = "INSERT INTO chat(chtime,nick,words) values('$time','$nick','$words')" ;
        mysqli_query($str,$link);
        mysqli_close($link);
}
?>

Upvotes: 1

Jocelyn
Jocelyn

Reputation: 11393

Change the code in speak.php to: 

<html> 
<head> 
<title>Speak</title> 
</head> 
<body> 
<?php 
    if ($words){
    $link = mysqli_connect('localhost', 'xxx', 'xxx', 'ChatRoom');
        $time = date('Y-m-d-a:i:s');
        $nick = $link->real_escape_string($_POST['nick']);
        $words = $link->real_escape_string($_POST['words']);
        $str = "INSERT INTO chat(chtime,nick,words) values('$time','$nick','$words')" ;
        mysqli_query($str,$link);
        mysqli_close($link);
}
?>
<form action = "Speak.php" method = "post" target = " _self"> 
<input type = "text" name = "nick"> 
<input type = "text" name = "words">
<input type = "submit" value = "Speak"> 
</form> 
</body> 
</html>

Using real_escape_string prevents SQL code injection.
The values sent by a POST form are stored in $_POST.

Upvotes: 1

Related Questions