Reputation: 219
everyone..
trying to submit a form.. and form and php code is in the same file index.php
if(isset($_POST['post_form'])) {
echo "ISSET";
$post_sender=$id;
$post_reciever=$id2;
$post_cont=$_POST['news_text'];
$post_cont=htmlentities($post_cont);
$post_cont=mysql_real_escape_string($post_cont);
$post_sql=mysql_query("INSERT INTO wall_posts (from, to, content, date) VALUES ('$post_sender','$post_reciever','$post_cont',now())") or die(mysql_error());
}else{
echo "NOT SET";
}
html form
<form method='POST' action='index.php' enctype='multipart/form-data' id='news_form' name='post_form' >
<textarea id='news_text' name='news_text' >type here..........</textarea>
<input type='submit' id='wall_post_btn' name='wall_post_btn' value='submit'>
</form>
where is my mistake..???
there is no mistake in the code..the file itself is corrupted..just made a test in a new PHP file...works just fine...thanks guys..
Upvotes: 0
Views: 98
Reputation: 1003
There are two problems:
Take a look here for alternatives: http://php.net/manual/en/function.mysql-real-escape-string.php
Upvotes: 0
Reputation: 218
Use this code its working fine
<?php
if($_SERVER['REQUEST_METHOD']=="POST") {
echo "ISSET";
$post_sender=$id;
$post_reciever=$id2;
$post_cont=$_POST['news_text'];
$post_cont=htmlentities($post_cont);
$post_cont=mysql_real_escape_string($post_cont);
$post_sql=mysql_query("INSERT INTO wall_posts (from, to, content, date) VALUES ('$post_sender','$post_reciever','$post_cont',now())") or die(mysql_error());
}else{
echo "NOT SET";
}
?>
<form method='post' action='index.php' enctype='multipart/form-data' id='news_form' name='post_form' >
<textarea id='news_text' name='news_text' >type here..........</textarea>
<input type='submit' id='wall_post_btn' name='wall_post_btn' value='submit'>
</form>
Upvotes: 0
Reputation: 2291
post_form
is the name of form. You must check for the submit button, wall_post_btn
.
if(isset($_POST['wall_post_btn'])) {
// entire code here
}
Upvotes: 2
Reputation: 16055
The problem is You are checking the name of the form present in the $_POST
, which is never present...
What You should test is the name of the submit button, e.g.:
if(isset($_POST['wall_post_btn'])) {
Next You could use one line for sanitizing the input:
$post_cont= mysql_real_escape_string(htmlentities($_POST['news_text']));
And last one: start using PDO with prepared statements or at least mysqli_*
functions as mysql_*
ones are deprecated now...
Upvotes: 0
Reputation: 1416
You should not use mysql as it has been depreciated. look into mysqli or PDO
This:
"INSERT INTO wall_posts (from, to, content, date) VALUES ('$post_sender','$post_reciever','$post_cont',now())"
should be:
"INSERT INTO wall_posts (from, to, content, date) VALUES ('".$post_sender."','".$post_reciever."','".$post_cont."',now())"
Upvotes: 0