Database input error.

When I submit a comment, all fields are filled except ids which is the id of the page they are on. Which is in the URL.

<?php $title = $_GET['title']; $date = $_GET['date']; $body = $_GET['body']; $id = $_GET['id']; ?> ---More HTML------ <?php mysql_connect ('localhost', '**********', '***********') ; mysql_select_db ('*********_********');

$sql99 = “SELECT comments FROM comments_table WHERE ids=”.$id." ORDER BY timestamp DESC LIMIT 5";

$result99 = mysql_query($sql99) or print (“Can’t select entries from table.
” . $sql99 . “
” . mysql_error());

while($row99 = mysql_fetch_array($result99)) {

$date99 = date("l F d Y", $row99['timestamp']);

$title99 = stripslashes($row99['title']);
$entry99 = stripslashes($row99['entry']);
  $name99 = stripslashes($row99['name']);

?>

<p><strong><?php echo $name99; ?>&nbsp;<?php echo $title99; ?></strong><br /><br />
<?php echo $entry99; ?><br /><br />
Posted on <?php echo $date99; ?>

<hr /></p>

<?php

}
?>
<?php
$current_month99 = date(“F”);
$current_date99 = date(“d”);
$current_year99 = date(“Y”);
$current_time99 = date(“H:i”);
?>


<?php

if (isset($_POST[‘submit’])) {

$month99 = htmlspecialchars(strip_tags($_POST['month']));
$date99 = htmlspecialchars(strip_tags($_POST['date']));
$year99 = htmlspecialchars(strip_tags($_POST['year']));
$time99 = htmlspecialchars(strip_tags($_POST['time']));
$entry99 = $_POST['entry'];
$id99 = $_POST['id'];
$timestamp99 = strtotime($month99 . " " . $date99 . " " . $year99 . " " . $time99);

$entry99 = nl2br($entry99);

if (!get_magic_quotes_gpc()) {
    $entry99 = addslashes($entry99);
}

mysql_connect (‘localhost’, ‘**********’, ‘’) ;
mysql_select_db ('
_
******’);

$sql98 = "INSERT INTO comments_table (timestamp,ids,comments) VALUES ('$timestamp99','$id99','$entry99')";

$result98= mysql_query($sql98) or print("Can't insert into table.<br />" . $sql98 . "<br />" . mysql_error());

if ($result98 != false) {
    print "Your entry has successfully been entered into the database.";
}

mysql_close();

}
?>


Help?

If you put:
[php]
var_dump($id99);
[/php]
after
[php]$id99 = $_POST[‘id’];[/php]
Dose it output anything? and is the ID showing in the forms HTML?

Also you should use mysql_real_escape_string() to escape user input before using it in queries otherwise your script will be vulnerable to SQL Injection attacks.

Sponsor our Newsletter | Privacy Policy | Terms of Service