PHP - What Means This Syntax Line

<?php
ob_start();
include "connect.php";



// Define $myusername and $mypassword 
$username=$_POST['username']; 
$password=$_POST['password']; 

// To protect MySQL injection (more detail about MySQL injection)
$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);

$sql="SELECT * FROM accounts WHERE username='$username' and password='$password'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1)
{
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("username");
session_register("password"); 
echo "&msgText=Entrance Granted!\n";
}
else
{
echo "&msgText=Invalid Login!\n";
}
return false;
ob_end_flush();
?>


this line right here what would the URL be to work correctly
$sql="SELECT * FROM accounts WHERE username='$username' and password='$password'";

if this line means this
$sql="SELECT * FROM accounts WHERE username='$username'";

http://wiistream.net/flash.login.php?username=Mytest

= echo "&msgText=Entrance Granted!\n";

see i dont know is it
http://wiistream.net/flash.login.php?username=Mytest&password=123456

I cant seem to login with a URL code because I dont know what it is?

Hi - I’m getting an error all of a sudden, can somebody point me to the issue please?

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘-1%’’ LIMIT 18446744073709551615’ at line 1

// begin Recordset
$suggestParam__colours = '-1';
if (isset($_GET['suggest1_choice'])) {
  $suggestParam__colours = $_GET['suggest1_choice'];
}
$query_colours = sprintf("SELECT colour_name FROM colours WHERE colour_name LIKE '%s'", GetSQLValueString($suggestParam__colours . "%", "text"));
$colours = $autocomplete->SelectLimit($query_colours) or die($autocomplete->ErrorMsg());
$totalRows_colours = $colours->RecordCount();
// end Recordset

 

I finished making an entire php and it will not go to my SQL document. The problem is on line 1. Line 1 would be <?php . Anyway I will include the php here. Do you know what the problem is?


Code: [Select]
<?php 


//This gets all the other information from the form 
$Fname=$_POST['Fname'];
$Lname=$_POST['Lname'];
$Compname=$_POST['Compname'];
$emailad=$_POST['emailad'];
$urlname=$_POST['urlname'];
$address=$_POST['address'];
$address2=$_POST['address2'];
$address3=$_POST['address3'];
$phone=$_POST['phone'];
$phone2=$_POST['phone2'];
$phonename=$_POST['phonename'];
$listingtype=$_POST['listingtype'];
$formcheck1=$_POST['formcheck']['name'];
$formcheck2=$_POST['formcheck']['name'];
$formcheck3=$_POST['formcheck']['name'];
$pic=($_FILES['photo']['name']);
$pic2=($_FILES['photo']['name']);
$pic3=($_FILES['photo']['name']);
$pic4=($_FILES['photo']['name']);
$description=$_POST['atDescription']; 



// Connects to your Database
mysql_connect ("", "", "") or die(mysql_error()) ;
mysql_select_db("") or die(mysql_error()) ;




//Writes the photos to the server and store the names in $picname[]
foreach ($_FILES["photo"]["error"] as $key => $error) {   
     if ($error == UPLOAD_ERR_OK) {        
     $tmp_name = $_FILES["photo"]["tmp_name"][$key];        
 $name = $_FILES["photo"]["name"][$key];        
 move_uploaded_file($tmp_name, "upload/$name");        
 $picname[] = $name;    
 }
else {
 //Gives and error if its not 
 echo "bldf"; 
 }
 }  
 
// setup empty names so that the variable will exist
$pic = "";
$pic2 = "";
$pic3 = "";
$pic3 = "";

// overwrite the empty pic names if they exist
if (count($picname) > 0) {  //at least 1 pic
$pic = $picname[0];
}
if (count($picname) > 1) {  //at least 2 pics
$pic2 = $picname[1];
}
if (count($picname) > 2) {  //at least 3 pics
$pic3 = $picname[2];
}
if (count($picname) > 3) {  //at least 4 pics
$pic4 = $picname[3];
}  // don't care if there's more than 4







//Writes the information to the database 
$sql = ("INSERT INTO bestform (Fname,Lname,Compname,emailad,urlname,address,address2,address3,phone,phone2,phonename,listingtype,formcheck_1,formcheck_2,formcheck_3,photo_1,photo_2,photo_3,photo_4,atDescription,) 
VALUES ('$Fname', '$Lname', '$Compname', '$emailad', '$urlname', '$address', '$address2', '$address3', '$phone', '$phone2', '$phonename', '$listingtype', '$formcheck1', '$formcheck2', '$formcheck3', '$pic', '$pic2', '$pic3', '$pic4', '$description')") ; 


//Writes the information to the database 
mysql_query($sql) or die(mysql_error()); // and catch any error 


echo date("m/d/y : H:i:s", time()) 


?>

$tab is a variable for my table's name


<?php
       while($row=mysqli_fetch_assoc($result)){
?>

       <?php echo $row['{$tab}_name']?>




   

Hello,

I have a syntax error on line 203 that is causing my code NOT work.
Could someone please look at it and tell me what is wrong & more important how to fix it?
Below is what I am getting. This " ~ " is server path info

" Parse error: syntax error, unexpected $end in /~ /~ /~ /phptestform/real_form_processing.php on line 203"

Also, how do I prevent "header injection", to keep my mail form from being open to abuse by spammers?

thanks
mrjap1



Code: [Select]

<?php # Script 

if (isset($_POST['submit'])) { // Handle the form.

// Register the user in the database.
require_once ('mysql_connect_page.php'); // Connect to the db.

// Create a function for escaping the data.
function escape_data ($data) {
global $dbc; // Need the connection.
if (ini_get('magic_quotes_gpc')) {
$data = stripslashes($data);
}
return mysql_real_escape_string($data, $dbc);
} // End of function.

$message = NULL; // Create an empty new variable.

// Check for a first name.
if (empty($_POST['first_name'])) {
$fn = FALSE;
$message .= '<p>You forgot to enter your first name... its Required!</p>';
} else {
$fn = escape_data($_POST['first_name']);
}

// Check for a last name.
if (empty($_POST['last_name'])) {
$ln = FALSE;
$message .= '<p>You forgot to enter your last name... its Required!</p>';
} else {
$ln = escape_data($_POST['last_name']);
}

// Check for an email address.
if (empty($_POST['email'])) {
$e = FALSE;
$message .= '<p>You forgot to enter your email address... its Required!</p>';
} else {
$e = escape_data($_POST['email']);
}

// Check for a address.
if (empty($_POST['address'])) {
$u = FALSE;
$message .= '<p>You forgot to enter your address... its Required!</p>';
} else {
$u = escape_data($_POST['address']);
}

// Check for a country.
if (empty($_POST['country'])) {
$u = FALSE;
$message .= '<p>You forgot to enter your country... its Required!</p>';
} else {
$u = escape_data($_POST['country']);
}


if ($salutation && $first_name && $last_name && $address && $city && $state_province && $zip_code && $email && $zip_code && $newsletter && $registration_date ) { // If everything's OK.

$query = "SELECT id FROM visitors WHERE address='$address'";
$result = @mysql_query ($query); // Run the query.
if (mysql_num_rows($result) == 0) {
// Make the query. This code is what you will use to prevent duplicate of usernames
$query = "INSERT INTO  `mrjap1_database`.`visitors` (`id` , `salutation` , `first_name` , `last_name` , `address` ,
`city` , `state_province` , `zip_code` , `country` , `email` , `newsletter` , `registration_date`) VALUES (
NULL ,  '$_POST[salutation]',  '$_POST[first_name]',  '$_POST[last_name]',  '$_POST[address]',  '$_POST[city]',  '$_POST[state_province]',  '$_POST[zip_code]',  '$_POST[country]',  '$_POST[email]',  '$_POST[newsletter]', '$_POST[registration_date]' , NOW() )";
$result = @mysql_query ($query); // Run the query.
if ($result) { // If it ran OK.

exit(); // Quit the script.

} else { // If it did not run OK.
$message = '<p>You could not be registered due to a system error. We apologize for any inconvenience.</p><p>' . mysql_error() . '</p>'; 
}

mysql_close(); // Close the database connection.

} else {
$message .= '<p>Please try again.</p>';
} 
} // End of the main Submit conditional.

// Print the error message if there is one.
if (isset($message)) {
echo '<font color="red">', $message, '</font>';
}
?>

<?php

// ALL THE SUBJECT and EMAIL VARIABLES

$emailSubject = 'MY TEST EMAIL SCRIPTING!!! ';
$webMaster = 'myemailaddress@gmail.com';



// GATHERING the FORM DATA VARIABLES

$salutation = $_POST['salutation'];
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$address = $_POST['address'];
$city = $_POST['city'];
$state_province = $_POST['state_province'];
$zip_code = $_POST['zip_code'];
$country = $_POST['country'];
$email = $_POST['email'];
$newsletter = $_POST['newsletter'];
    $registration_date = $_POST['registration_date'];
$date = date ("l, F jS, Y");
    $time = date ("h:i A");



$body = <<<EOD
<br /><hr><br />
<strong>Salutation: </strong>$salutation <br />
<strong>First Name:</strong>$first_name <br />
<strong>Last Name: </strong>$last_name <br />
<strong>Address: </strong>$address <br />
<strong>City: </strong>$city <br />
<strong>State_Province: </strong>$state_province <br />
<strong>Zip Code: </strong>$zip_code <br />
<strong>Country: </strong>$country <br />
<strong>Email:</strong> $email <br />
<strong>Zip Code:</strong> $zip_code <br />
<strong>Newsletter:</strong> $newsletter <br />
<strong>Registration Date:</strong> $date at $time <br />
EOD;

 
// THIS SHOW ALL E-MAILED DATA, ONCE IN THE E-MAILBOX AS READABLE HTML

$headers = "From: $email\r\n";
$headers .= "Content-type: text/html\r\n";
$success = mail($webMaster, $emailSubject, $body, $headers);


// THE RESULTS OF THE FORM RENDERED AS PURE HTML 

$theResults = <<<EOD
<!DOCTYPE HTML>
<html lang="en">
<head>
<style type="text/css">
body {
font-family:Arial, Helvetica, sans-serif;
font-size:11px;
font-weight:bold;
}

#thankyou_block {
width: 400px;
height: 250px;
text-align:center;
border: 1px solid #666;
padding: 5px;
background-color: #0CF;
border-radius:8px;
-webkit-border-radius:8px;
-moz-border-radius:8px;
-opera-border-radius:8px;
-khtml-border-radius:8px;
box-shadow:0px 0px 10px #000;
-webkit-box-shadow: 0px 0px 10px #000;
-moz-box-shadow: 0px 0px 10px #000;
-o-box-shadow: 0px 0px 10px #000;
margin: 25px auto;
}

p {
font-family: Arial, Helvetica, sans-serif;
font-size: 14px;
line-height: 18px;
letter-spacing:1px;
color: #333;
}

</style>
<meta charset="UTF-8">
<title>THANK YOU!!!</title>
</head>

<body>

<div id="thankyou_block">
<br><br><br>
<h1>CONGRATULATIONS!!</h1>
<h2>YOUR FORM HAS BEEN PROCESSED!!!</h2>
<p>You are now registered in our Database...<br>
we will get back to you very shortly.<br>
Please have a very wondeful day.</p>

</div>
</body>
</html>

EOD;
echo "$theResults"; 

?>