PHP - Need Help With A Php Script For A Guestbook

I'm saving customer comments in an MYSQL. But the when I use mysql_real_escape_string() to filter the input data it's causing wired signs when it's displayed in the guest book. (E.g. whenever there is a ' sign, the output is \').

Is it safe to have a guest book without mysql_real_escape_string( or please suggest how should I go about creating this guest book on my website.

Thanks.
Bickey.

I am trying to modify Guestbook.  In order to access the page, the user must log in using a screen name and email address that has been registered with the website. 

What I want to take the log in information and automatically populate the Name and email field of the input comment form.  I have set up SESSION Variables (see below for the login php).

<?php

session_start();

require_once("dbcon.php");

$form = "<table>
            <form action='login.php' method='post'>
            <tr>
                <td>Username: </td><td><input type='text' name='user' size='20' />
            </tr>
            <tr>
                <td>Email: </td><td><input type='text' name='emad' size='30' />
            </tr>
            <tr>
                <td><input type='submit' name='submit' value='Login' />
      <td><a href='New Contact.html'>New Account </a>
            </tr>
            </form>
        </table>"; // Do NOT use \" when you still have the option to use singlequotes, looks so messy...

$user = $_POST['user'];
$emad = $_POST['emad']; //defining these in the start makes the source looks nicer
   
if(!$_POST['submit']) die($form); // just kill the rest of the script if the form isn't submitted.
if(!$user || !$emad) die("Required fields missing<br /><br /> $form"); // killing the rest of the script and echoing the form and error
   
    $sql = "SELECT ident FROM Mix WHERE password = '$pass' AND username = '$user'"; // just like with the variables and prints/echoes, you don't need to ".$var." anything with double quotemarks
    $res = mysql_query($sql) or die(mysql_error());
    if(mysql_num_rows($res) > 0) {
        $row = mysql_fetch_assoc($res);
   $_SESSION['uid'] = $row['id'];
   $_SESSION['un'] = $_POST['user'];   //Setup user name into session variable.
   $_SESSION['ua'] = $_POST['emad'];   //Setup email address into session variable.
   echo "You have been logged in as $user at $emad. Click <a href=\"gbook.php\">here</a> to the member page.";
    } else {
        echo "That username/password combination doesn't exist!<br /><br/> $form";
    }

?>



Below is a copy of the Sign Form. php.  I am trying to populate teh Name and email fields but the SESSION variables don't show up.  Can someone figure out what I AM DOING WRONG.

<?php session_start ();
$un = $_SESSION['un'];
$ua = $_SESSION['ua'];
?>


<div id="gbook_guestbook" align="center">
   <span class="gbook_guestbook"><?php echo $lang['t48']; ?></span><br class="clear" />
   <span class="gbook_required"><?php echo $lang['t49']; ?></span>
</div>

<form action="gbook.php" method="post">
<!--SIGN FORM -->
<div id="gbook_entries">

   <?php
     if ($error)
    {
      echo '<div class="gbook_sign_error">'.$error.'</div>';
    }
   ?>

   <div class="gbook_left"><span class="gbook_entries"><b><?php echo $lang['t50']; ?></b></span></div>
   <div class="gbook_right"><input type="hidden" name="<?php echo $myfield['name']; ?>" value="<?php echo $un; ?>" /></div> <?php echo $un; ?>

   <div class="clear"></div>

   <div class="gbook_left"><span class="gbook_entries"><?php echo $lang['t51']; ?></span></div>
   <div class="gbook_right"><input type="text" name="from" value="<?php echo $from; ?>" size="45" /></div>

   <div class="clear"></div>

   <?php
   if ($settings['use_url'])
   {
      ?>
      <div class="gbook_left"><span class="gbook_entries"><?php echo $lang['t53']; ?></span></div>
      <div class="gbook_right"><input type="text" name="url" value="<?php echo $url; ?>" size="45" maxlength="80" /></div>

      <div class="clear"></div>
       <?php
   }
   ?>

   <div class="gbook_left"><span class="gbook_entries"><?php echo $lang['t52']; ?></span></div>
   <div class="gbook_right"><input type="hidden" name="email" value="<?php echo $ua; ?>" /> <?php echo $ua; ?>
    <?php
    if ($settings['hide_emails'])
    {
      ?>
      <br class="clear" /><span class="gbook_entries"><i><?php echo $lang['t66']; ?></i></span>
       <?php
    }
    ?>
    </div>

   <div class="clear"></div>

   <div class="gbook_left"><span class="gbook_entries"><b><?php echo $lang['t16']; ?></b></span></div>
   <div class="gbook_right"><span class="gbook_entries"><i><?php echo $lang['t54']; ?></i></span></div>

   <textarea name="<?php echo $myfield['cmnt']; ?>" rows="12" cols="57" id="cmnt"><?php echo $comments; ?></textarea>

   <!--BOTTOM IMAGES -->
   <div id="gbook_bottom_images" class="gbook_bottom_images">

   <a href="#" onclick="document.getElementById('cmnt').value += ' ';return false;"><img src="<?php echo $settings['tpl_path']; ?>images/emoticons/bigsmile.gif"  alt="" title="" width="19" height="19" /></a>&nbsp;
   <a href="#" onclick="document.getElementById('cmnt').value += ' :!cool: ';return false;"><img src="<?php echo $settings['tpl_path']; ?>images/emoticons/cool.gif"  alt=":!cool:" title=":!cool:" width="19" height="19" /></a>&nbsp;
   <a href="#" onclick="document.getElementById('cmnt').value += ' :!cry: ';return false;"><img src="<?php echo $settings['tpl_path']; ?>images/emoticons/crying.gif"  alt=":!cry:" title=":!cry:" width="19" height="19" /></a>&nbsp;
   <a href="#" onclick="document.getElementById('cmnt').value += ' :!devil: ';return false;"><img src="<?php echo $settings['tpl_path']; ?>images/emoticons/devil.gif"  alt=":!devil:" title=":!devil:" width="19" height="19" /></a>&nbsp;
   <a href="#" onclick="document.getElementById('cmnt').value += ' ';return false;"><img src="<?php echo $settings['tpl_path']; ?>images/emoticons/smile.gif"  alt="" title="" width="19" height="19" /></a>&nbsp;
    <a href="#" onclick="document.getElementById('cmnt').value += ' :!mad: ';return false;"><img src="<?php echo $settings['tpl_path']; ?>images/emoticons/mad.gif"  alt=":!mad:" title=":!mad:" width="19" height="19" /></a>&nbsp;
   <a href="#" onclick="document.getElementById('cmnt').value += ' :!thinking: ';return false;"><img src="<?php echo $settings['tpl_path']; ?>images/emoticons/thinking.gif"  alt=":!thinking:" title=":!thinking:" width="19" height="19" /></a>&nbsp;
   <a href="#" onclick="document.getElementById('cmnt').value += ' :p ';return false;"><img src="<?php echo $settings['tpl_path']; ?>images/emoticons/tongueout.gif"  alt=":p" title=":p" width="19" height="19" /></a>&nbsp;
   <a href="#" onclick="document.getElementById('cmnt').value += ' ';return false;"><img src="<?php echo $settings['tpl_path']; ?>images/emoticons/wink.gif"  alt="" title="" width="19" height="19" /></a>&nbsp;
   <a href="#" onclick="document.getElementById('cmnt').value += ' ';return false;"><img src="<?php echo $settings['tpl_path']; ?>images/emoticons/blush.gif"  alt="" title="" width="19" height="19" /></a>&nbsp;

   <a href="javascript:openSmiley()" class="gbook_submitted"><?php echo $lang['t26']; ?></a><br />
   <label><input type="checkbox" name="nosmileys" value="Y" class="gbook_checkbox" <?php echo $nosmileys; ?> /><span class="gbook_entries"><?php echo $lang['t28']; ?></span></label><br class="clear" />

    <?php
    /* Private mesasges */
    if ($settings['use_private'])
    {
       ?>
      <label><input type="checkbox" name="private" value="Y" class="gbook_checkbox" <?php echo $isprivate; ?> /><span class="gbook_entries"><?php echo $lang['t55']; ?></span></label><br class="clear" />
       <?php
    }

    /* Print anti-SPAM features */
    echo $settings['antispam'];
    ?>
   </div>
   <!--BOTTOM IMAGES END -->

   <div align="center">

   <div class="clear">&nbsp;</div>

   <!--SPAM TRAPS -->
    <!-- DON'T DELETE THESE HIDDEN FIELDS AND COMMENTS, THEY HELP CATCH STUPID SPAMBOTS! -->
   <input type="hidden" name="name" />
    <input type="hidden" name="<?php echo $myfield['bait']; ?>" />
    <!-- >
    <input type="text" name="comments" value="1" />
    < -->
    <!--SPAM TRAPS END-->

    <input type="hidden" name="a" value="add" />
   <input type="submit" value="<?php echo $lang['t88']; ?>" class="submit" />
   </div>

    <p>&nbsp;</p>

</div>
<!--SIGN FORM END -->
</form>



   

I've found an example of guestbook that I would like to use on my site, but when I tested it I got the following error: Warning: fread() [function.fread]: Length parameter must be greater than 0 in C:\xampp\htdocs\xampp\index.php on line 66

I've included the bits of code for addguestbook.php guestbook.txt(didnt not include) and index.php. Also, is there a way that I could allow the client to look through out entries?

I know very little about php, so any help is much appreciated.



Code: [Select]

------ addguestbook.php code ------
 
<HTML>
<HEAD>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><style type="text/css">
<!--
body,td,th {
font-size: 12px;
color: #000000;
}
a:link {
text-decoration: none;
color: #0066FF;
}
a:visited {
text-decoration: none;
color: #0066FF;
}
a:hover {
text-decoration: underline;
color: #0066FF;
}
a:active {
text-decoration: none;
}
body {
background-color: #CCCCCC;
SCROLLBAR-FACE-COLOR: #0066FF; MARGIN: 0px; SCROLLBAR-HIGHLIGHT-COLOR: #0066FF; SCROLLBAR-SHADOW-COLOR: #0066FF; SCROLLBAR-3DLIGHT-COLOR: #0066FF; SCROLLBAR-ARROW-COLOR: #51B0F2; SCROLLBAR-TRACK-COLOR: #51B0F2; Courier New; SCROLLBAR-DARKSHADOW-COLOR: #000000
}
-->
</style>
</HEAD>
<BODY>
<?php
$file           = "guestbook.txt";
$name = $_POST['name'];
$email = $_POST['email'];
$site    = $_POST['site'];
$msg = $_POST['msg'];
$site   = stripslashes($site);
$msg  = stripslashes($msg);
$email  = stripslashes($email);
$name = stripslashes($name);
$msg = str_replace ("<","&lt;",$msg);
$msg = str_replace ("\n","<br>",$msg);
$site = str_replace ("<","&lt;",$site);
$site = str_replace ("\n","<br>",$site);
$email = str_replace ("<","&lt;",$email);
$email = str_replace ("\n","<br>",$email);
$name = str_replace ("<","&lt;",$name);
$name = str_replace ("\n","<br>",$name);
 
if(empty($email) || empty($name) || empty($msg)) {
echo "<h3>Sorry all fields are required</h3>";
} else {
 
$fp = fopen($file,"a");
 
fwrite($fp, '
<font size="3">
<BR><BR>
Name: '.$name.'<BR>
Email: <a href="mailto:'.$email.'">'.$email.'</a><BR>
Home Page: <a href="'.$site.'">'.$site.'</a><BR>Message: '.$msg.'<BR>
');
 
fclose($fp);
 
echo '<font size="3"><p align="center">Thank you '.$name.' for singing my guestbook</p></font>'; 
}
?>
<div align="center"></div>
<div align="center"></div>
<div align="center"></div>
<div align="center"></div>
<p align="center"><a href="YOU`R INDEX.PHP LINK HERE">Back to GuestBook</a></p>
<div align="center"></div>
</BODY>
</HTML>
 
---- finish -----
 
---- index.php code -----
 
<HTML>
<HEAD>
<style type="text/css">
<!--
.style1 {font-size: 12px}
body,td,th {
font-size: 14px;
}
a {
font-size: 12px;
}
body {
background-color: #CCCCCC;
SCROLLBAR-FACE-COLOR: #0066FF; MARGIN: 0px; SCROLLBAR-HIGHLIGHT-COLOR: #0066FF; SCROLLBAR-SHADOW-COLOR: #0066FF; SCROLLBAR-3DLIGHT-COLOR: #0066FF; SCROLLBAR-ARROW-COLOR: #51B0F2; SCROLLBAR-TRACK-COLOR: #51B0F2; Courier New; SCROLLBAR-DARKSHADOW-COLOR: #000000
}
a:link {
color: #0066FF;
text-decoration: none;
}
a:visited {
text-decoration: none;
color: #0066FF;
}
a:hover {
text-decoration: underline;
color: #0066FF;
}
a:active {
text-decoration: none;
}
-->
</style>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><BODY>
<form method="post" action="addguestbook.php">
<div align="center"></div>
<div align="center"></div>
<div align="center" class="style1"></div>
<div align="center"><span class="style1">Name:</span><br />
  <input name="name" type="text" size="30" maxlength="40" />
  <br />
  <span class="style1"><br />
  Email:</span><br />
<input name="email" type="text" size="30" maxlength="40" />
<br />
<br />
<span class="style1">Home Page:</span><br />
<input name="site" type="text" size="30" value="http://" maxlength="40" />
<br />
<br />
<span class="style1">Message:</span><br />
<textarea name="msg" cols="22" rows="6"></textarea>
<br />
<br />
<input type="reset" value="Reset" />
&nbsp;
<input type="submit" value="Send" />
</div>
<div align="center">
  <p>&nbsp;</p>
<?php
$file = "guestbook.txt";
 
if (fopen($file, "r")) {
$fil = "guestbook.txt";
$fo = fopen ($fil, "r");
$con = fread ($fo,filesize ($fil));
fclose ($fo);
echo "$con";
} else {
echo "<h3>Sorry there was an error please contact us now<h3>";
}
?></div>
</BODY>
</HTML>
 
---- finish -----

Hi All,

Hope you can help. I am doing a very basic guestbook. Having problems with the posting method.
The code is below all I am doing is insert a record into a mysql table but when I post getting a blank page with no obvious errors! code is below.


if ($_POST['submit'])
{

$name = $_POST['name'];
$email = $_POST['email'];
$message = $_POST['message'];
$date = $_POST("Y-m-d");
$time = $_POST("H:i:s");

if($name&&$email&&$message)
{
$querypost = mysql_query("INSERT INTO guestbook (id, name, email, message, date, time) VALUES ('','$name','$email','$message','$date','$time')");

echo "Please wait.... <meta http-equiv='refresh' content='2'>";
}
else
echo "Please fill out all fields.";



}

I have a guestbook that writes an entry to a text file, but when I first run it I get this error:


Warning: fread() [function.fread]: Length parameter must be greater than 0 in C:\xampp\htdocs\xampp\index.php on line 66

Is there a way I can get rid of that error and still be able to use my guestbook until I actual update my guestbook using a database?