-1

"hi, I am trying to make one user with username and password to edit the text on a page; I have a database with a table "users" with only one user and a table "save_text" where I save the text; now I am trying to save the text in the page with the next php code; please let me know if it is posible in this way and how ? I cannot save the text on the page untill next modify for example, thanks"

<?php
require_once 'connect.php';
if (isset($_POST['submit'])){

                      $dbhost="localhost";
                      $dbuser="root";
                      $dbpass="";
                      $dbname="edit text";
                      $conn = new mysqli($dbhost, $dbuser, $dbpass, $dbname); 

$username = $_POST['username'];
$password = $_POST['password'];
$sql = "SELECT * FROM users WHERE username='$username' and     password='$password'";
$result = mysqli_query($conn, $sql) or die(mysqli_error($conn));
$count = mysqli_num_rows($result);
if ($count == 1){

$username = $_POST['username'];
$password = $_POST['password'];
$text = $_POST['text'];

$query = "Insert into save_text (username,password,text) VALUES     ('".$username."','".$password."','".$text."')";
$result = mysqli_query($conn, $query);



echo '<div id="section"><section>'.$text.'</section></div>';
}

else {
echo '<div id="section"><section>fail modify text</section></div>';
}

}
?>
bogdan serbanoiu
  • 1
  • 2
  • 1
    Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). – John Conde May 12 '17 at 20:01
  • **Never store plain text passwords!** Please use **[PHP's built-in functions](http://php.net/manual/en/function.password-hash.php)** to handle password security. If you're using a PHP version less than 5.5 you can use the password_hash() **[compatibility pack](https://github.com/ircmaxell/password_compat)**. Make sure you **[don't escape passwords](http://stackoverflow.com/q/36628418/1011527)** or use any other cleansing mechanism on them before hashing. Doing so changes the password and causes unnecessary additional coding. – John Conde May 12 '17 at 20:01
  • Welcome to [so]! At this site you are expected to try to **write the code yourself**. After **[doing more research](//meta.stackoverflow.com/questions/261592)** if you have a problem you can **post what you've tried** with a **clear explanation of what isn't working** and providing a [**Minimal, Complete, and Verifiable example**](//stackoverflow.com/help/mcve). I suggest reading [ask] a good question and [the perfect question](http://codeblog.jonskeet.uk/2010/08/29/writing-the-perfect-question/). Also, be sure to take the [tour] and read **[this](//meta.stackoverflow.com/questions/347937/)**. – John Conde May 12 '17 at 20:02
  • thank you very much John, you give me a lot of reading and learning; for password i use md5() function; but i still don't know if i can edit/change text in this way??? – bogdan serbanoiu May 12 '17 at 21:16
  • I start to learn myself PHP, I dont have other posibility; I also read about sql injection; – bogdan serbanoiu May 28 '17 at 16:09

1 Answers1

0

one month ago I find myself the answer, using the function : ob_start(); content of the php page; ob_get_contents()); this will tranform the php page content into a html page content; this is not exactly my work, I just find this function and use it, I still need to learn php from stackoverflow; anyway this could help me when I will do the same for a photo to start a local social network;

bogdan serbanoiu
  • 1
  • 2