|
|
PHP Quellcode |
1 2 3 4 5 6 7 8 9 10 |
<? $myhost="localhost"; $mydb="buch"; $myuser="buch"; $mypassword="123456"; mysql_connect("$myhost","$myuser","$mypassword")or die ("Keine Verbindung moeglich"); mysql_select_db("$mydb")or die ("Die Datenbank existiert nicht"); ?> |
|
|
MySQL Code |
1 2 3 4 5 6 7 8 9 10 11 12 13 |
-- -- Tabellenstruktur für Tabelle `icc_gb` -- CREATE TABLE `icc_gb` ( `uid` INT(11) NOT NULL AUTO_INCREMENT, `an` LONGTEXT COLLATE latin1_general_ci, `von` LONGTEXT COLLATE latin1_general_ci, `datum` TEXT COLLATE latin1_general_ci NOT NULL, `uhrzeit` TEXT COLLATE latin1_general_ci NOT NULL, `messa` LONGTEXT COLLATE latin1_general_ci NOT NULL, PRIMARY KEY (`uid`) ) ENGINE=MyISAM AUTO_INCREMENT=5 DEFAULT CHARSET=latin1 COLLATE=latin1_general_ci PACK_KEYS=1 AUTO_INCREMENT=5 ; |
Quoted from ""mycros""
Willst du die Variable messa nicht übergeben? Oder was willst du denn erreichen?
Wann bzw. Wo soll denn die Variable Messa übergeben werden?
|
|
PHP Quellcode |
1 |
$eintrag = "INSERT INTO icc_gb (an, von, datum, uhrzeit, messa) VALUES ('$an','$von','$datum','$uhrzeit','$messa')"; |
Quoted from ""eLKane""
Wenn du eine Variable über die URL weitergibst, dann musst du auf $_GET['variable'] benutzen...siehe register_globals
[1] http://de.php.net/register_globals
|
|
PHP Quellcode |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
error_reporting(E_ALL); mysql_error(); var_dump($messa); $messa =$_GET['messa']; $nick = $_GET['nick']; $user = $_GET['user']; $acti = $_GET['acti']; if ($messa) { // kann vom User mit get/post/cookies übermittelt werden $good_login = 1; } if ($good_login == 1) { // kann vom User mit get/post/cookies übermittelt werden } if ($acti == "save") { include "log.php"; $von = $nick; |
Quoted
Notice: Undefined variable: messa in D:\Programme\webserver\xampp\htdocs\gb\gb.php on line 4
NULL
Notice: Undefined index: messa in D:\Programme\webserver\xampp\htdocs\gb\gb.php on line 5
Notice: Undefined variable: good_login in D:\Programme\webserver\xampp\htdocs\gb\gb.php on line 12
Quoted
Notice: Undefined variable: messa in D:\Programme\webserver\xampp\htdocs\gb\gb.php on line 4
NULL
Quoted
Notice: Undefined index: messa in D:\Programme\webserver\xampp\htdocs\gb\gb.php on line 5
Quoted
Notice: Undefined variable: good_login in D:\Programme\webserver\xampp\htdocs\gb\gb.php on line 12
|
|
HTML Code |
1 2 3 4 5 |
<tr class="row2"><td><form enctype="multipart/form-data" action="gb.php?acti=save&nick=<? echo $nick; ?>&user=<? echo $user; ?>" method="post"> <div align="center"> <br><textarea name="userpro" cols="50" rows="7"></textarea> <br> <input type="submit" value="Speichern"> |
|
|
HTML Code |
1 2 3 4 5 6 7 8 9 |
<form enctype="multipart/form-data" action="gb.php" method="post"> <input type="hidden" name="nick" value="<? echo $nick; ?>" /> <input type="hidden" name="user" value="<? echo $user; ?>" /> <input type="hidden" name="acti" value="delet" /> <input type="hidden" name="uid" value="<? echo $row->uid; ?>" /> <div align="center"> <input type="submit" value="Löschen"> </div> </form> |
|
|
PHP Quellcode |
1 2 3 4 5 6 7 8 9 10 |
</tr> <tr class="row2"><td<form enctype="multipart/form-data" action="gb.php" method="post"> <div align="center"> <input type="hidden" name="nick" value="<? echo $nick; ?>" /> <input type="hidden" name="user" value="<? echo $user; ?>" /> <input type="hidden" name="acti" value="save" /> <input type="hidden" name="uid" value="<? echo $row->uid; ?>" /> <br><textarea name="messa" cols="50" rows="7"></textarea> <br> <input type="submit" value="Speichern"> |
|
|
PHP Quellcode |
1 2 3 4 |
$messa =$_post['messa']; $nick = $_post['nick']; $user = $_post['user']; $acti = $_post['acti']; |
|
|
PHP Quellcode |
1 2 3 4 |
$messa =$_GET['messa']; $nick = $_GET['nick']; $user = $_GET['user']; $acti = $_GET['acti']; |
|
|
HTML Code |
1 2 3 4 5 6 7 8 9 10 11 12 |
<tr class="row2"><td<form enctype="multipart/form-data" action="gb.php" method="post"> <div align="center"> <input type="hidden" name="nick" value="plankton" /> <input type="hidden" name="user" value="tristar" /> <input type="hidden" name="acti" value="save" /> <br><textarea name="messa" cols="50" rows="7"></textarea> <br> <input type="submit" value="Speichern"> </div> </form> |
|
|
HTML Code |
1 2 3 4 5 6 7 8 9 |
<tr class="row2"><td<form enctype="multipart/form-data" action="gb.php" method="post"> <div align="center"> <input type="hidden" name="nick" value="" /> <input type="hidden" name="user" value="" /> <input type="hidden" name="acti" value="save" /> <br><textarea name="messa" cols="50" rows="7"></textarea> <br> <input type="submit" value="Speichern"> |
Quoted
#15 if ($messa != "") {;
Quoted
#20 function eintrag($messa) { ...}
#35 function check_messa($messa) { ...}
|
|
PHP Quellcode |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 |
<?php error_reporting(E_ALL); include "log.php"; function check_messa($messa) { if (strlen($text)>2000) { fehlermeldung("Der Text im Feld 'Text' ist zu lang (".strlen($text)." Zeichen)"); return false; } else return true; } if(isset($_GET['nick']) && isset($_GET['user'])) { $nick = mysql_real_escape_string($_GET['nick']); $user = mysql_real_escape_string($_GET['user']); } else die('Falsche Anzahl Parameter'); if(isset($_POST['messa']) && isset($_POST['nick']) && isset($_POST['user'])) { $messa= mysql_real_escape_string($_POST['messa']); $acti = $_POST['acti']; $uid = intval($_POST['uid']); if ($acti == "save") { $von = $nick; $an = $user; $datum = date("d.m.Y"); $uhrzeit = date("H:i"); if ($messa != "") { $messa = strip_tags($messa); if(check_messa($messa)) { $messa = nl2br ($messa); $messa = str_replace("[img]","<img src=\"", $messa); $messa = str_replace("[/img]","\">", $messa); $eintrag = "INSERT INTO icc_gb (an, von, datum, uhrzeit, messa) VALUES ('$an','$von','$datum','$uhrzeit','$messa')"; mysql_query($messa)or die(mysql_error()); } } } if ($acti == "delet") { $loesch = "DELETE FROM icc_gb WHERE uid = '$uid'"; mysql_query($loesch)or die(mysql_error());; } if ($acti == "check") { //... } } ?> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Gästebuch von <? echo $user; ?> </title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> </head> <body> <table width="90%" border="1" align="center" cellpadding="0" cellspacing="0" class="outer"> <tr> <td> <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tr> <th><div align="center">Gästebuch von <? echo $user; ?></div></th> </tr> <?php $abfrag = "SELECT * FROM icc_gb WHERE an = '$user' ORDER by datum DESC"; $abfrage = mysql_query($abfrag); while ($row = mysql_fetch_object($abfrage)) { $num = true; echo '<tr class="row2"> <td align="center"><em><strong>von <a href="gb.php?user='. $row->von .'&nick='. $nick .'"> '.$row->von.'</a> geschrieben am '.$row->datum.' '.$row->uhrzeit.'</strong></em><br /> <br />'.$row->messa.'<br />'; if ($user == $nick) { echo '<form enctype="multipart/form-data" action="gb.php?user='.$user.'&nick='.$nick.'" method="post"> <input type="hidden" name="uid" value="'.$row->uid.'" /> <input type="hidden" name="acti" value="delet" /> <input type="submit" value="Löschen"> </form>'; } echo '<hr /></td> </tr>'; } if(!isset($num)) echo "<div align=\"center\">Keine Einträge vorhanden</div>"; ?> </table> </td> </tr> <tr class="row2"><td align="center"> <form enctype="multipart/form-data" action="gb.php?nick=<? echo $nick; ?>&user=<? echo $user; ?>" method="post"> <input type="hidden" name="acti" value="save" /> <br /><textarea name="userpro" cols="50" rows="7"></textarea> <br /><input type="submit" value="Speichern"> </form> </td></tr> </table> </body> </html> |
Quoted
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'ODBC'@'localhost' (using password: NO) in D:\Programme\webserver\xampp\htdocs\gb\gb2.php on line 13
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in D:\Programme\webserver\xampp\htdocs\gb\gb2.php on line 13
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'ODBC'@'localhost' (using password: NO) in D:\Programme\webserver\xampp\htdocs\gb\gb2.php on line 14
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in D:\Programme\webserver\xampp\htdocs\gb\gb2.php on line 14
Quoted from ""toxic""
... Die user ist ja nur der, von dem das GB ist... da es mehrere user gibt, somit mehrere GB´s in einen und der Nick ist nur, der den Eintrag hinterlässt...
deswegen bring es nichts, wenn der User oder Nick versucht auf die SQL zuzugreifen...