CODEWITHSUNDEEP
phpmysql
user2189151
user2189151

Reputation: 47

having issues with php_self

I am trying to implement a page where a user enters a comment and it gets displayed right in the same page. The problem i am having is that every time you go to the page there are no comments in the page(there are actually comments). This is my sceneario i am having:

  1. I go to the page and there are no comments, i enter a comment 'hello' and it gets displayed right away.
  2. I go to a different page and then i come back to the comments page and there are no comments.(the comment "hello" should be already displayed)
  3. I enter a comment "hi" and both comments "hello" and "hi" get displayed

I cant resolve this issue..

This is my code, its pretty long

  <?php
 session_start(); //starts or continues the session
 require_once('functions.php'); //needed for some function calls
 error_reporting(E_ALL ^ E_NOTICE);
 ?>

<!DOCTYPE html>
<html lang = "en">

<head>
<script type = "text/javascript" src = "functions.js"></script>
<link href="style.css" rel="stylesheet" type="text/css">      
</head>

<body>

<?php
 GetUserLayout($_SESSION['userId'], $_SESSION['superUser']);

 ?>

    <div id = "shareyouridea_form" class = "post">
      <h1> Share your post</h1>    
      <!-- used for the form -->
      <form id = "idea_form" method = "post"  
        action = "<?php echo $PHP_SELF;?>"
    onkeypress = "return DisableEnterKey(event);">
        <table>
      <caption> 
        <strong> 
          <br /> Share post form:
        </strong> 
      </caption>
      <tr class = "spacearound"> <!-- input for bright idea -->
                <td> &emsp;Post: </td>
                <td>
          <textarea form = "idea_form" name = "b_idea" rows = "12" 
          cols = "85" title = "Please describe your product idea" 
          id = "bright_idea" maxlength = "1000"
          onkeypress = 
          "return InputLimiter(event, 'lettersSpacePunctuation');">
          </textarea>
                </td>
              </tr>
    </table>

        <p>
      &emsp;&emsp;&emsp;&nbsp;
      <input type = "reset" value = "Reset" />
      &emsp;&emsp;        
      <input type = "submit" value = "Share Idea!"
        title = "complete form first to submit"
        id = "submit_button"
        name = "add_comment"
                onmousedown = "IsIdeaFormCompleted();" />
    </p>
          </form> <!-- end idea_form -->            
        </div>
  </div> <!-- end of ShareYourIdea_middle -->
  <script>
        DisplayFooter();
 </script>

 <?php
  if(isset($_POST['add_comment'])){ // if add comment was pressed

   // get variables
 $name = $_SESSION['firstName'];
     $empId = $_SESSION['userId'];
     $idea = $_POST['b_idea'];

    // CONNECTING TO OUR DATABASE
$db = mysqli_connect(dbHost, dbUser, dbPassword, dbName);

   if (mysqli_connect_errno()) { //if connection to the database failed
 echo("<p id = 'greatideadescription'>
          Connection to database failed: " .
      mysqli_connect_error($db) . "</p>");
exit("goodbye");
  }  //by now we have connection to the database


// WE WRITE OUR QUERY TO INSERT POST INFO TO DATABASE
 $query = "INSERT INTO posts(postId,empl_Id,post,postDate)
        VALUES('','$empId','$idea',NOW())";
    $result = mysqli_query($db, $query);



  }

 ?>

 <?php
  // WE DO A QUERY TO SHOW ALL COMMENTS IN THE PAGE
 $query = "SELECT firstName,lastName, post,
      date_format((date_add(postDate,interval -7 hour)),'%a, %M, %d, %Y at %I:%i%p' ) as        mydatefield 
      FROM users INNER JOIN posts ON userId = empl_Id
      ORDER BY postDate DESC";

 $result = mysqli_query($db,$query);
 if (!$result) { //if the query failed
    echo("<p id = 'greatideadescription'>
     Error, the query could not be executed: " .
     mysqli_error($db) . "</p>");
    mysqli_close($db);}

if (mysqli_num_rows($result) == 0) { //if no rows returned
  echo("<div id = 'blogs'>
          <div id ='name'>
            No posts detected
          </div>
        </div>
        <div class='fb-like' data-href='http://jacobspayroll.zxq.net/index/blog.php'   data-send='true' data-width='450' data-show-faces='true'></div>
    ");
  mysqli_close($db); //close the database
  exit("</table></div></form></div></div>
      <script>DisplayFooter();</script></body></html>");
      } //by now we know that we have some products purchases returned
  $numRows = mysqli_num_rows($result); //gets number of rows
  $numFields = mysqli_num_fields($result); //gets number of fields
  //prints the data in the table

  while($row = mysqli_fetch_assoc($result)){
  $posted = $row['post'];
  $message = wordwrap($posted,5);
  echo 
    '<div id ="blogs">
        <table id = "blog_id">
          </br>
           <div id = "name">
            <strong>'.$row['firstName'] . '&nbsp;' .$row['lastName'].
          '</strong>
          &nbsp;: ' .$message .
          '<br/> 
          </div>
          <div id ="date">'.
          $row['mydatefield'] . '
          </div>
          <div id ="delete_comment">
            Delete this comment 
          </div>
          <p>
        </table>
    </div>';    
 }
  mysqli_close($db); 

  ?>
  </body>

  </html>

Upvotes: 0

Views: 838

Answers (2)

Class
Class

Reputation: 3160

as Kail mentioned you got it wrong but you might want to use $_SERVER['SCRIPT_NAME'] instead of $_SERVER['PHP_SELF'] then you might want to add some script to get GET parameters if you use them for your script(s). If you use PHP_SELF you might have a user link to script.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E%3Cfoo might look like action="script.php/"><script>alert('xss')</script> or could be a redirect to collect cookies and the alike in other words XSS attack.

$_SERVER['PHP_SELF'] vs $_SERVER['SCRIPT_NAME'] vs $_SERVER['REQUEST_URI']

XSS Woes

What's the difference between $_SERVER['PHP_SELF'] and $_SERVER['SCRIPT_NAME']?

Upvotes: 0

Jhonathan H.
Jhonathan H.

Reputation: 2713

You have the wrong Usage of PHP_SELF

//You must use  Server and execution environment information `$_SERVER[]`

$_SERVER['PHP_SELF'];

// For your form action like this
 action = "<?php echo $_SERVER['PHP_SELF'];?>"

Upvotes: 6

Related Questions