I can only store numbers in the database, a simple shoutbox in php

Question

I've started to build some very basic shoutbox \ Chat in php. It uses just a basic mysql table with (int) id as unique index and (text) message columns. It works but it stores only numbers in the database. I've searched everywhere for a solution but can't find one yet. I suspect the problem resides either in the mysql database or the query, but maybe something is wrong with code.

Here is the code:

<?php
// ****************
// Database Settings
// ****************

$sql_hst = "localhost";
$sql_db = "chatbox";
$sql_usr = "chatbox";
$sql_pwd = "chatbox";

// ****************
//  Core Functions
// ****************

function connectdb()
{
    //conection:
    global $sql_srv,$sql_usr,$sql_pwd,$sql_db;
    $link = mysqli_connect($sql_srv,$sql_usr,$sql_pwd,$sql_db) or die("Error " . mysqli_error($link));
    return $link;
}

function getMessages()
{
        $result = mysqli_query(connectdb(),"SELECT message FROM messages");
        while($row = mysqli_fetch_array($result))
        {
            echo $row['message'];
            echo "<br>";
        }
}

function postMessage()
{
if (isset($_POST['message'])) 
{
    mysqli_query(connectdb(), "INSERT INTO messages (message) VALUES (".$_POST['message'].")");
    //echo $_POST['message']; //test post data
}
}

connectdb();
postMessage();

//END OF MAIN PHP
?>
<!DOCTYPE html>
<html>
    <head><title>Chatbox</title>
    <style>
    body { background-color: gray; }
    input{width:375px;display:block;border: 1px solid #999;height: 25px;--moz-box-shadow: 0px 0px 8px rgba(0, 0, 0, 0.3);box-shadow: 0px 0px 8px rgba(0, 0, 0, 0.3);}
    .message_box{ background-color: white; height: 500px; width: 100%;}
    .message_form{width: 100%;}
    .message_input{width: 100%;}
    .message_submit{}
    </style>
    </head>
    <body>

    <div class="message_box"><?php getMessages(); ?></div>
    <form class="message_form" action="chatbox.php" method="post">
    <input class="message_input" type="text" name="message">
    <!-- <input type="submit"> -->
    </form>
    </body>
</html>

You are vulnerable to [SQL injection attacks](http://bobby-tables.com). DO NOT USE THIS CODE. That being said, this code is "fine" (badly vulnerable to attacks, but... 'fine'). What's the type of your `message` field in the database? char? varchar? int? — Marc B, Jul 26 '13 at 19:11
Before you do **anything** else, you must read up on [proper SQL escaping](http://bobby-tables.com/php) to avoid the severe [SQL injection bugs](http://bobby-tables.com/) present in this. When using `mysqli` you should be using [`bind_param`](http://php.net/manual/en/mysqli-stmt.bind-param.php) to add values to your query. Do not use string concatenation to add `$_POST` values to your query string. — tadman, Jul 26 '13 at 19:12
Like others have said, this is one of the simplest exploits for hackers to attack and for you to avoid. Check out this stackoverflow question for how to use PHP PDO to simplify santizing your SQL. http://stackoverflow.com/questions/1943069/are-there-good-tutorials-on-how-to-use-pdo — taco, Jul 26 '13 at 19:20

score 0 · Accepted Answer · answered Jul 26 '13 at 19:12

0

See if this helps:

function postMessage($message){
    mysqli_query(connectdb(), "INSERT INTO messages (message) VALUES ("'".mysqli_real_escape_string($message)."'")");
}

// connectdb(); // this is probably not needed since this function
// is called in postMessage function 
if (isset($_POST['message'])){
    postMessage($_POST['message']);
}

answered Jul 26 '13 at 19:12

Maximus2012

1,799
2
12
15

Either use a prepared query or you have to use `mysqli_real_escape_string()`. – Barmar Jul 26 '13 at 19:15
1

The message field in the database is using the type TEXT. I agree that the code is vulnerable to attacks, but it's just a localhost dev thing for getting the hang of it, I'm not concerned with any attackers as they don't have any access to this local server. I will certainly improve it's security once I deal with the "only numbers" bug. The behavior is as follows: Once I enter a number the page updates as usual and shows me the new entry, as well as in the db. but then if i enter even 1 letter I get nothing, even not an error. It just updates and shows the same old entries. – meta11144 Jul 26 '13 at 21:03
what happens when you remove the postMessage function and just use this: if (isset($_POST['message'])) { mysqli_query(connectdb(), "INSERT INTO messages (message) VALUES ('".$_POST['message']."')"); } – Maximus2012 Jul 26 '13 at 21:10
Ok. now it works just fine. Thanks! I still do not understand the problem and the solution but at least it runs fine. – meta11144 Jul 26 '13 at 21:30

I can only store numbers in the database, a simple shoutbox in php

1 Answers1