Member Avatar for vexer007

Hi,

I've run into absolute brickwall and am really desprate for your help please. I have a MYSQL Database with two Tables called user_comment and the second user_table. When a user register with the site, their details are kept in the user_table. the second table user_comment is so that users who are registered on the user_table can leave comments which will be passed into the user_comment table. HERE IS THE CODE FOR THE SECOND PART, CHECKING IF A USER'S EMAIL EXIST IN the user_table IF SO, PUX THESE DATA INTO user_comment TABLE. PLEASE CAN ANYONE SPOT WHAT IS WRONG WITH THE CODE???

undefined


<?php require 'db.private'; ?>
<html>
<head>
<title> Gizmo&reg; Electronics - Login</title>


</head>
<body>



<table width="100%">
<tr><td>


<?php


$connection = mysql_connect($hostname,$username,$password);
mysql_select_db($databaseName, $connection);



$submit = $_POST;
$comment = $_POST;
$email = $_POST;


if(isset($submit))  {


//if(isset($submit))    {
// check if user exists in the database
$query = mysql_query("SELECT email FROM user_table WHERE email = '".$email."'");
//$num_rows = mysql_num_rows($query_email);
//if(!$num_rows) die('Gizmerror!! Either you have typed your USERNAME and or Your PASSWORD incorrectly or you have not registered to access this pages. <p><font color="red" size="+1"><center> Please Try Again</center> </font></p>');


//mysql_query ( "INSERT INTO user_comment (email, comment) VALUES ('$email', '$comment');


$insert = "INSERT INTO user_comment SET
email = '$email',
comment = '$comment'";


//mysql_query($insert);
//$row_comment = mysql_fetch_Array($query);
die("<META http-equiv=\"Refresh\" content=\"0;url=commentdisplay.php\">");


//die("Thank you for registering.  Your Registration was Successful! You can now login");


//$insert = "INSERT INTO user_comment SET
//comment = '$comment'";


//mysql_query($insert);


die("Thank you for registering.  Your Registration was Successful! You can now login");


//}


//echo mysql_error();
//mysql_close();
}
?>


<center>



<form action="comment.php" method="post">
<table summary="comment page">


<tr>
<td><label for="comment">Your Comment:</label></td>
<td><textarea name="comment" cols="70" rows="5" wrap="VIRTUAL" id="comment" value="comment"></textarea><br /></td>
</tr>


<tr>
<td><label for="email">Email Address:</label></td>
<td><input type="text" id="email" name="email"  value="type ur email here"></td>
</tr>


<tr>
<td><input type="submit" name="submit" /></td>
</tr>


</table>
</form>


<p><a href="home.htm">...or return to our Homepage</a></p>



</td>
</tr>
</table>
</body>
</html>

THANK YOU, I REALLY APPRECIATE YOUR TIME AND EFFORT.
:confused:

Edited by happygeek because: fixed formatting
  • 3 Contributors
  • 2 Replies
  • 421 Views
  • 9 Years Discussion Span
  • Latest Post Latest Post by chocolatte.lavista_1

Dani AI

Generated

The posted script shows a few classic problems that stop the comment flow: POST values are not read by their keys (so $email and $comment are never actual strings), the script aborts with die() before the insert runs, and SQL is built by concatenation which allows injection. Also, legacy mysql_* use is fragile in modern PHP—migration to PDO or MySQLi is recommended.

Correct workflow (concise):

  • Detect a POST submit, read email and comment from the POST array, validate and trim them (use filter_input/FILTER_VALIDATE_EMAIL for email).
  • Check whether the email exists in user_table with a parameterized query.
  • If it exists, insert into user_comment with a prepared statement, then redirect. Log or display errors during development (enable E_ALL) instead of silently die()-ing.

Example (PDO, minimal):

try {
  $pdo = new PDO('mysql:host=HOST;dbname=DB;charset=utf8mb4', DB_USER, DB_PASS, [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
  ]);

  if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
    $comment = trim($_POST['comment'] ?? '');
    if ($email && $comment !== '') {
      $check = $pdo->prepare('SELECT 1 FROM user_table WHERE email = ? LIMIT 1');
      $check->execute([$email]);
      if ($check->fetchColumn()) {
        $ins = $pdo->prepare('INSERT INTO user_comment (email, comment) VALUES (?, ?)');
        $ins->execute([$email, $comment]);
        header('Location: commentdisplay.php'); exit;
      }
    }
  }
} catch (PDOException $e) {
  error_log($e->getMessage());
}

Notes and quick checklist:

  • correctly flagged missing $_POST['...'] keys; use explicit keys.
  • asked for error output — enable error_reporting(E_ALL) and check logs.
  • Remove default text in inputs (use placeholder), do not use a value attribute on textarea, escape output with htmlspecialchars() when displaying comments, and add length limits + spam protections.

Recommended Answers

All 2 Replies

Member Avatar for Roberdin

It would be helpful if you were to provide the error returned, or a description of what's not working correctly.

Member Avatar for chocolatte.lavista_1

27.$submit = $_POST[' '];
28.$comment = $_POST[' '];
29.$email = $_POST[' '];

what is you trying to post?

Edited by chocolatte.lavista_1
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.