php mysql insert condition judgment
I have an html form with 4 items.
title
and content
are required.
link
and image
are optional.
So this is what i wrote, but i cannot insert the data in my data base. Is there a mistake in my condition statement for url and image? Thanks
if($_SERVER['REQUEST_METHOD'] == "POST") {
$ttt = strlen(htmlspecialchars(trim($_POST['title'])));
$ccc = strlen(htmlspecialchars(trim($_POST['content']))); // count title and content charters
$title = htmlspecialchars(trim($_POST['title']));
$content = htmlspecialchars(trim($_POST['content']));
$url = htmlspecialchars(trim($_POST['url']));
$image = htmlspecialchars(trim($_POST['image']));
if($url!=''){
if ( !preg_match( '|^(ht|f)tp(s?))://|', $url ){
echo "wrong";
mysql_close($db);
}
} // if $url is not empty, judge is it began as a htt开发者_StackOverflowp:// ? else close the db link
if($image!=''){
if ( !getimagesize($image)){
echo "wrong";
mysql_close($db);
}
} // if $image is not empty, use getimagesize judge is it a real image? else close the db link
if(($ttt > 2 && $ttt < 201) && ($ccc > 29 && $ccc < 1001)) {
$sql= "INSERT INTO msg (title, content,image,link) VALUES ('".$title."','".$content."', '".$image."', '".$url."')";//if title charters between 3-200 and content charters between 30-1000, do insert into thing
if(mysql_query($sql))
{
echo "insert done";
}else{
echo "insert wrong";
}
}else{
echo "your title or content is out of the words limit";
}
}
mysql_close($db);
Change:
if($link!=''){
if ( !preg_match( '|^(ht|f)tp(s?))://|', $url ){
echo "wrong";
mysql_close($db);
}
}
to
if($url !=''){
if ( !preg_match( '|^(ht|f)tp(s?))://|', $url ){
echo "wrong";
mysql_close($db);
}
}
for us to be able to help yuou better show your $sql statement;
UPDATE:
It's very hard to figure the problem like that here is what you can do, to see what is the problem:
$result = mysql_query($sql) or die ('Error: 'mysql_error());
This way you can see what is the error in your query, i a pretty sure it is an escaping problem so here is what you can add;
$title = htmlspecialchars(trim($_POST['title']));
$content = htmlspecialchars(trim($_POST['content']));
$url = htmlspecialchars(trim($_POST['url']));
$image = htmlspecialchars(trim($_POST['image']));
$title = mysql_real_escape_string($title);
$content = mysql_real_escape_string($content);
$url = mysql_real_escape_string($url);
$image = mysql_real_escape_string($image);
this way if there are any special characters they will be escaped
Seems likely one of the mysql_close_db calls could be the problem? If not, please post the results of echoing $sql before the mysql_query call, plus any error or errors you receive.
精彩评论