PHP - Form Validation And Info To Table

Hi,

I have a website where users can log on and edit their profile pic, name, biography etc.
I was wondering about the correct way to:-
Add data to the database through forms (Register.php) Display the data on a page Using mysql escape sting, however, the way I am currently using will display a '\' before any ' symbol. So it's >> it\'s ...

Here is a snippet of the code I am using...

Code: [Select]
//insert data
$about1 = mysql_real_escape_string($_POST['about']);

//get
$query = mysql_query("SELECT * FROM `staff` WHERE username='$username'");
$row = mysql_fetch_array($query);
$about = $row['about'];
echo $about;

I have two different tables and I am trying to condense them into one table.   The structure of the tables is   cc -- ci -- cc -- cn -- alpha_2   countries -- id -- cn -- alpha_2 -- alpha_3   What I want to do is place the info from the column alpha_2 in the countries table into the alpha_2 column in the cc table. I have tried inner joins, left joins, Insert and Select index. Everything that I have tried gives me an error message. I do not know what I am doing wrong and I was hoping that someone would be able to give me a hand.   I forgot to mention that I want the placement of the alpha_2 column to be based on the cn columns in both tables. So that the information in the alpha_2 column lines up with the right name in the cn column
Edited by mdmartiny, 09 August 2014 - 01:07 PM.

Hello, me again.

I have created a little forum - very very basic.

main_forum.php :

Code: [Select]
<?php
$host="localhost"; // Host name 
$username="yvonnedp"; // Mysql username 
$password="yvonne"; // Mysql password 
$db_name="forum"; // Database name 
$tbl_name="forum_question"; // Table name 

// Connect to server and select databse.
mysql_connect('localhost', 'yvonnedp', 'yvonne')or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

$sql="SELECT * FROM $tbl_name ORDER BY id";
// OREDER BY id DESC is order result by descending 
$result=mysql_query($sql);
?>
<table width="90%" border="0" align="center" cellpadding="3" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<td width="6%" align="center" bgcolor="#E6E6E6"><strong>#</strong></td>
<td width="53%" align="center" bgcolor="#E6E6E6"><strong>Topic</strong></td>
<td width="15%" align="center" bgcolor="#E6E6E6"><strong>Views</strong></td>
<td width="13%" align="center" bgcolor="#E6E6E6"><strong>Replies</strong></td>
<td width="13%" align="center" bgcolor="#E6E6E6"><strong>Date/Time</strong></td>
</tr>

<?php
while($rows=mysql_fetch_array($result)){ // Start looping table row 
?>
<tr>
<td bgcolor="#FFFFFF"><? echo $rows['id']; ?></td>
<td bgcolor="#FFFFFF"><a href="view_topic.php?id=<? echo $rows['id']; ?>"><? echo $rows['topic']; ?></a><BR></td>
<td align="center" bgcolor="#FFFFFF"><? echo $rows['view']; ?></td>
<td align="center" bgcolor="#FFFFFF"><? echo $rows['reply']; ?></td>
<td align="center" bgcolor="#FFFFFF"><? echo $rows['datetime']; ?></td>
</tr>

<?php
// Exit looping and close connection 
}
mysql_close();
?>
create_topic.php :

Code: [Select]
<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<form id="form1" name="form1" method="post" action="add_topic.php">
<td>
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td colspan="3" bgcolor="#E6E6E6"><strong>Create New Topic</strong> </td>
</tr>
<tr>
<td width="14%"><strong>Topic</strong></td>
<td width="2%">:</td>
<td width="84%"><input name="topic" type="text" id="topic" size="50" /></td>
</tr>
<tr>
<td valign="top"><strong>Detail</strong></td>
<td valign="top">:</td>
<td><textarea name="detail" cols="50" rows="3" id="detail"></textarea></td>
</tr>
<tr>
<td><strong>Name</strong></td>
<td>:</td>
<td><input name="name" type="text" id="name" size="50" /></td>
</tr>
<tr>
<td>&nbsp;</td>
<td>&nbsp;</td>
<td><input type="submit" name="Submit" value="Submit" /> <input type="reset" name="Submit2" value="Reset" /></td>
</tr>
</table>
</td>
</form>
</tr>
</table>
add_topic.php :

Code: [Select]
<?php
$host="localhost"; // Host name 
$username="yvonnedp"; // Mysql username 
$password="yvonne"; // Mysql password 
$db_name="forum"; // Database name 
$tbl_name="forum_question"; // Table name 

// Connect to server and select database.
mysql_connect('localhost', 'yvonnedp', 'yvonne')or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// get data that sent from form 
$topic=$_POST['topic'];
$detail=$_POST['detail'];
$name=$_POST['name'];

$datetime=date("d/m/y h:i:s"); //create date time

$sql="INSERT INTO $tbl_name(topic, detail, name, datetime)VALUES('$topic', '$detail', '$name', '$datetime')";
$result=mysql_query($sql);

if($result){
echo "Successful<BR>";
echo "<a href=main_forum.php>View your topic</a>";
 
 $email_from = "forums@thenewme.co.za";
     $email_to = "info@thenewme.co.za";
     $email_subject = "The New Me - New Forum Topic";

     $email_message = "A new topic has been posted on the Forum!\n";
     $email_message .= "Check it out : http://www.thenewme.co.za/forum/main_forum.php";
     
     $headers = 'From: '.$email_from."\r\n";
 'Reply-To: '.$email_from."\r\n" . 'X-Mailer: PHP/' . phpversion();
  @mail($email_to, $email_subject, $email_message, $headers);


}
else {
echo "ERROR";
}
mysql_close();
?>
add_answer.php :

Code: [Select]
<?php
 
$host="localhost"; // Host name 
$username="yvonnedp"; // Mysql username 
$password="yvonne"; // Mysql password 
$db_name="forum"; // Database name 
$tbl_name="forum_answer"; // Table name 

// Connect to server and select databse.
mysql_connect('localhost', 'yvonnedp', 'yvonne')or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// Get value of id that sent from hidden field 
$id=$_POST['id'];

// Find highest answer number. 
$sql="SELECT MAX(a_id) AS Maxa_id FROM $tbl_name WHERE question_id='$id'";
$result=mysql_query($sql);
$rows=mysql_fetch_array($result);

// add + 1 to highest answer number and keep it in variable name "$Max_id". if there no answer yet set it = 1 
if ($rows) {
$Max_id = $rows['Maxa_id']+1;
}
else {
$Max_id = 1;
}

// get values that sent from form 
$a_name=$_POST['a_name'];
$a_answer=$_POST['a_answer']; 

$datetime=date("d/m/y H:i:s"); // create date and time 

// Insert answer 
$sql2="INSERT INTO $tbl_name(question_id, a_id, a_name, a_answer, a_datetime)VALUES('$id', '$Max_id', '$a_name', '$a_answer', '$datetime')";
$result2=mysql_query($sql2);

if($result2){
echo "Successful<BR>";
echo "<a href='view_topic.php?id=".$id."'>View your answer</a>";

// If added new answer, add value +1 in reply column 
$tbl_name2="forum_question";
$sql3="UPDATE $tbl_name2 SET reply='$Max_id' WHERE id='$id'";
$result3=mysql_query($sql3);

 $email_from = "forums@thenewme.co.za";
     $email_to = "info@thenewme.co.za";
     $email_subject = "The New Me - New Forum Answer";

     $email_message = "A new answer to a forum topic has been posted on the Forum!\n";
     $email_message .= "Check it out : http://www.thenewme.co.za/forum/main_forum.php";
     
     $headers = 'From: '.$email_from."\r\n";
 'Reply-To: '.$email_from."\r\n" . 'X-Mailer: PHP/' . phpversion();
  @mail($email_to, $email_subject, $email_message, $headers);

}
else {
echo "ERROR";
}

mysql_close();
?>
view_topic :

Code: [Select]
<?php
$tbl_name2="forum_answer"; // Switch to table "forum_answer" 

$sql2="SELECT * FROM $tbl_name2 WHERE question_id='$id'";
$result2=mysql_query($sql2);

while($rows=mysql_fetch_array($result2)){
?>
<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<td><table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td bgcolor="#F8F7F1"><strong>ID</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><? echo $rows['a_id']; ?></td>
</tr>
<tr>
<td width="18%" bgcolor="#F8F7F1"><strong>Name</strong></td>
<td width="5%" bgcolor="#F8F7F1">:</td>
<td width="77%" bgcolor="#F8F7F1"><? echo $rows['a_name']; ?></td>
</tr>
<tr>
<td bgcolor="#F8F7F1"><strong>Answer</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><? echo $rows['a_answer']; ?></td>
</tr>
<tr>
<td bgcolor="#F8F7F1"><strong>Date/Time</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><? echo $rows['a_datetime']; ?></td>
</tr>
</table></td>
</tr>
</table><br>

<?
}

$sql3="SELECT view FROM $tbl_name WHERE id='$id'";
$result3=mysql_query($sql3);

$rows=mysql_fetch_array($result3);
$view=$rows['view'];

// if have no counter value set counter = 1
if(empty($view)){
$view=1;
$sql4="INSERT INTO $tbl_name(view) VALUES('$view') WHERE id='$id'";
$result4=mysql_query($sql4);
}

// count more value
$addview=$view+1;
$sql5="update $tbl_name set view='$addview' WHERE id='$id'";
$result5=mysql_query($sql5);

mysql_close();
?>
the problem is. With add_answer, I am not able to insert an answer. This has worked for the very first question, but all subsequent questions, I am unable to add answers. It keeps telling me ERROR.

This is where the live forum is : http://www.thenewme.co.za/forum/main_forum.php

Can it be an issue with the field that gets autmatically incremented? i have echo'd the data which get entered in when someone types in an answer, and everything is perfect!

Can anyone help me?

Hi, okee so I'm new to everything that has to do with scripting, especially when it comes to PHP and stuff,
but what is the best way to display information from a table on a page?
I'm creating this site where users can post their events, but I want the Location to be based on the Location they inserted during the registration process, so that the location will be displayed directly.
How am I able to do that? I've already got an login script, it looks like this:
Code: [Select]
<?php
ob_start();
$host="localhost"; // Host name
$username="root"; // Mysql username
$password=""; // Mysql password
$db_name="whats_happening_db"; // Database name
$tbl_name="members"; // Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");
header("location:membersarea.php?user=$myusername");
}
else {
echo "Wrong Username or Password";
}

ob_end_flush();
?>
Sorry if my English is terrible haha.

Dante.

Hello I'm trying to set up a user area for my site where it displays the current logged in users ranking and other information in the future.  

<?
 ini_set('display_errors', 1);
require_once "header.php";

$sql = "SELECT * FROM users WHERE username = ?";

  if($stmt = mysqli_prepare($link, $sql)){
  
    mysqli_stmt_bind_param($stmt, 's', $_SESSION['username']);
  
   if(mysqli_stmt_execute($stmt)){
                
   
   $info = mysqli_fetch_array($stmt);
   
   echo "Current rank:" . $info['rank'];
   
   
   } else {
   
   echo "Can't find user";
   }
   }
   mysqli_stmt_close($stmt);





?>

That's the code I currently have but it gives me the error "but get an error message of mysqli_fetch_array() expects parameter 1 to be mysqli_result"