0

Bottom line: I don't know what the hell I'm doing. I just want this comment box to submit information to my database. Let me show you what I got.

<form method="POST" action="post.php" style="font-
 size:200%;padding:50px">
<label for="comments">Comments:</label>
<textarea class="form-control" placeholder="How can I improve?" 
 style="background-color:#fff4c9;border-radius:15px;width:100%;" 
 name="comments" rows="5" id="comments" value=""></textarea> <br>
<button type="submit" class="btn btn-default">Share Your Ideas</button>
</form>`

and then my php i guess????

<?php
if($_SERVER["REQUEST_METHOD"] == "POST") {
$servername = "localhost";
$username = "id1403626_wp_4764008ac42f7398450c24184e47c38a";
$password = "blahblahblah";
$dbname = "id1403626_wp_257ecd760342ffcefce424435ed4e776";
//Collect Value of Input Field
$name = $_POST['comments'];
$timestamp = date('Y-m-d H:i:sa');

//Create connection
$connect = mysqli_connect($servername, $username, $password);

//Check connection
if ($connect->connect_error) {
die("So here's the problem...:".$connect->connect_error);
}
//Select Database
mysqli_select_db($connect,$dbname)
or die("Whoops! Can't find that pesky database!");
//Insert Data Query
$sql = "INSERT INTO `Comments`(`comments`, `date`) VALUES ($name, 
$timestamp)";
//What should happen
$result = mysqli_query($connect, $sql);

if($result){
echo 'thank you for your feed back';
}else {
echo "...";
}
}
?>

I just cannot find what I am doing wrong.

philobythekilo
  • 1
  • 2
  • 1
    Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). – John Conde Apr 19 '17 at 22:21
  • Can I go back and do this once I get everything running? How important is that right now and when it's preparing what is the $stmt defined as in that first example, I'm so confused. – philobythekilo Apr 20 '17 at 00:14
  • also thank you so much cause it's working now – philobythekilo Apr 20 '17 at 00:14

0 Answers0