AllSyntax.com: » Forums » View ?f=4&t=24&p=115

<?
//connect to your database
include("c onfig.php"< img src=/forums/ima ges/smilies/win k.gif border=0>;
mysql_connect($ mysql_hostname, $mysql_user, $mysql_password );
@mysql_select_d b($mysql_databa se) or die( "Unable to select database";

//query comments for this page of this article
$inf = "SELECT * FROM `comments` WHERE page = '".stripsl ashes($_SERVER[ 'REQUEST_URI']) ."' ORDER BY time ASC";
$info = mysql_query($in f);
if(!$info) die(mysql_error ());

$info_rows = mysql_num_rows( $info);
if($info_rows > 0) {
echo '<h5>Comm ents:</h5> ;';
echo '<table width="95% ">';

while($info2 = mysql_fetch_obj ect($info)) {
echo '<tr>';
echo '<td>&quo t;'.stripslashe s($info2->su bject).'" by: <a

href="'.$i nfo2->contac t.'">'. stripslashes($i nfo2->userna me).'</a> </td> <td><d iv align="rig ht"> @ '.date('h:i:s a',

$info2->time ).' on '.$info2->da te.'</div> ;</td>';
echo '</tr>< ;tr>';
echo '<td colspan="2 "> '.stripslashes( $info2->comm ent).' </td>';
echo '</tr>';
}//end while
echo '</table> ';
echo '<hr width="95% " noshade>';
} else echo 'No comments for this page. Feel free to be the first <br><b r>';

if(isset($_POST ['submit'])) {
if(!addslashes( $_POST['usernam e'])) die('<u>E RROR:</u> you must enter a username to add a comment.');
if(!addslashes( $_POST['contact '])) die('<u>E RROR:</u> enter contact method in contact field.');
if(!addslashes( $_POST['subject '])) die('<u>E RROR:</u> enter a subject to your comment.');
if(!addslashes( $_POST['comment '])) die('<u>E RROR:</u> cannot add comment if you do not enter one!?');

//this is for a valid contact
if(substr($_POS T['contact'],0, 7) != 'mailto:' && !strstr($_POST[ 'contact'],'//' )) {
if(strstr($_POS T['contact'],'@ '))
$_POST['contact '] = "mailto:&q uot;.$_POST['co ntact']."& quot;;
else
$_POST['contact '] = "http://&q uot;.$_POST['co ntact']."& quot;;
} //end valid contact

//try to prevent multiple posts and flooding...
$c = "SELECT * from `comments` WHERE ip = '".$_SERVE R['REMOTE_ADDR' ]."'" ;
$c2 = mysql_query($c) ;
while($c3 = mysql_fetch_obj ect($c2)) {
$difference = time() - $c3->time;
if($difference < 300) die('<u>A LERT:</u> '.$c3->usern ame.', You have already commented earlier; if you have a

question, try the forums!<BR&g t;');
} //end while

//add comment
$q ="INSERT INTO `comments` (article_id, page, date, time, username, ip, contact, subject, comment) VALUES

('".$_GET[ 'id']."', '".$_POST[ 'page']."' , '".$_POST[ 'date']."' , '".$_POST[ 'time']."' ,

'".addslas hes(htmlspecial chars($_POST['u sername'])).&qu ot;', '".$_SERVE R['REMOTE_ADDR' ]."',

'".addslas hes(htmlspecial chars($_POST['c ontact'])).&quo t;', '".addslas hes(htmlspecial chars($_POST['s ubject'])).&quo t;',

'".addslas hes(htmlspecial chars(nl2br($_P OST['comment']) ))."')&quo t;;

$q2 = mysql_query($q) ;
if(!$q2) die(mysql_error ());

//refresh page so they can see new comment
header('Locatio n: http://' . $_SERVER['HTTP_ HOST'] . $_POST['page'] . "#comments ";

} else { //display form
?>
<form name="comm ents" action="&l t;? $_SERVER['PHP_S ELF']; ?>" method="po st">

<input type="hidd en" name="page " value="< ;? echo($_SERVER[' REQUEST_URI']); ?>">
<input type="hidd en" name="date " value="< ;? echo(date(" ;F j, Y."); ?>">
<input type="hidd en" name="time " value="< ;? echo(time()); ?>">

<table width="76% " border="0& quot; cellspacing=&qu ot;0" cellpadding=&qu ot;0">
<tr>
<td><i nput name="user name" type="text " size="45&q uot; value="&qu ot; style="fon t-size: 8pt; font-family: Verdana"&g t;<font

size="1&qu ot;>
Username</ font></td >
</tr>
<tr>
<td><i nput type="text " name="subj ect" size="45&q uot; value="&qu ot; style="fon t-size: 8pt; font-family: Verdana"&g t;<font

size="1&qu ot;>
Subject</fo nt></td&g t;
</tr>
<tr>
<td><t extarea name="comm ent" style="fon t-size: 8pt; font-family: Verdana" cols="44&q uot; rows="8&qu ot;

wrap="VIRT UAL">&l t;/textarea> <font size="1&qu ot;>
Comment</f ont></td& gt;
</tr>
<tr>
<td><i nput type="hidd en" name="cont act" size="30&q uot; value="htt p://www.cagintr anet.com"& gt;</td>
</tr>
<tr>
<td><i nput type="subm it" name="subm it" value="Sub mit Review"> ; <input type="rese t" value="Cle ar">< ;/td>
</tr>
</table>
</form>
<?
} // end else
?>