<?php
$p_title = $_POST['title'];
$p_menu_title = $_POST['menutitle'];
$p_summary = $_POST['summary'];
$p_body = $_POST['body'];
$address = "localhost";
$username = "mark1e_bourne";
$password = "******";
$database = "mark1e_bourne";
mysql_connect($address,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
$query = "INSERT INTO news VALUES ('$p_title','$p_menu_title','$p_summary','$p_body')";
print($query);
mysql_query($query);
mysql_close();
?>
<html>
<body>
<form action="" method="post">
<p>Title - <input type="text" name="title" /></p>
<p>Menu Title - <input type="text" name="menutitle" /></p>
<p>Summary - <input type="text" name="summary" /></p>
<p>Body - <input type="text" name="body" /></p>
<p><input type="submit" name="submit" /></p>
</form>
</body>
</html>
$query = "INSERT INTO news (p_title, p_menu_title, p_summary, p_body) VALUES ('$p_title','$p_menu_title','$p_summary','$p_body')";
putting single quotes around variable names will not work
insert into news (col1,col2,col3) values ($var1,$var2,$var3)
you don't have to put the primary key field in because it'll assume null if you don't
$address = "localhost";
$username = "mark1e_bourne";
$password = "******";
$database = "mark1e_bourne";
mysql_connect($address,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
$newsID = false;
if (!empty($_GET['id']) && is_numeric($_GET['id']))
{
$qry = mysql_query("SELECT * FROM news WHERE id='".mysql_real_escape_string($_GET['id'])."'");
if (mysql_num_rows($qry) == 1)
$newsID = true;
}
if (!$newsID)
{
//List of news - but truncated to 50 chars.
$qry = mysql_query("SELECT * FROM news");
while ($obj = mysql_fetch_object($qry))
{
echo($obj->p_title . " - " . substr($obj->p_body, 0, 50) . "... <a href=\"news.php?id=$obj->id\">(full story here)</a><br />");
}
}
else
{
//Full News Post
$newsObj = mysql_fetch_object($qry);
echo($newsObj->p_title . "<br />" . $newsObj->p_body);
}
mysql_close();
if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
//php code to submit to the database...
}
else
{
//display the form...
}
<?php
if (isset($_GET['title']))
{
$address = "localhost";
$username = "mark1e_bourne";
$password = "******";
$database = "mark1e_bourne";
mysql_connect($address,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
$p_title = mysql_real_escape_string($_POST['title']);
$p_menu_title = mysql_real_escape_string($_POST['menutitle']);
$p_summary = mysql_real_escape_string($_POST['summary']);
$p_body = mysql_real_escape_string($_POST['body']);
$query = "INSERT INTO news (p_title, p_menu_title, p_summary, p_body) VALUES ('$p_title','$p_menu_title','$p_summary','$p_body')";
print($query);
mysql_query($query) or die(mysql_error());
mysql_close();
}
else
{
?>
<html>
<body>
<form action="save.php" method="post">
<p>Title - <input type="text" name="title" /></p>
<p>Menu Title - <input type="text" name="menutitle" /></p>
<p>Summary - <input type="text" name="summary" /></p>
<p>Body - <input type="text" name="body" /></p>
<p><input type="submit" name="submit" /></p>
</form>
</body>
</html>
<?php
}
?>
substr($obj->p_body, 0, 50)
$obj->p_summary
$qry = mysql_query("SELECT * FROM news");
$qry = mysql_query("SELECT * FROM news ORDER BY id DESC");
Putting single quotes around variable names in a sql query - like (s)he's done will work. Infact, unless the field is of INT (or another numeric only) type if you don't put them you'll get a mysql syntax error.
True about the primary key field though.