VERY simple Guestbook in PHP

[TOPMAYRJJJ]

This is one of my first ones
ATTENTION: I forgot to use IF statements to check if the variables i defined weren't null, so feel free to do it
guest.php



<table width="500" border="0" align="center" cellpadding="3" cellspacing="0">
<tr>
<td><strong>Guestbook</strong></td>
</tr>
</table>
<table width="500" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<form id="form1" name="form1" method="post" action="addguest.php">
<td>
<table width="500" border="0" cellpadding="3" cellspacing="0" bgcolor="#FFFFFF">
<tr>
<td width="120">Name</td>
<td width="15">:</td>
<td width="400"><input name="name" type="text" id="name" size="40" /></td>
</tr>
<tr>
<td>Email</td>
<td>:</td>
<td><input name="email" type="text" id="email" size="40" /></td>
</tr>
<tr>
<td align="top"> Comment </td>
<td align="top">:</td>
<td align="top"><textarea name="comment" cols="40" rows="3" id="comment"></textarea></td>
</tr>
<tr>
<td>&nbsp;</td>
<td>&nbsp;</td>
<td><input type="submit" name="Submit" value="Send" /> <input type="reset" name="Submit2" value="Reset" /></td>
</tr>
</table>
</td>
</form>
</tr>
</table>
<table width="500" border="0" align="center" cellpadding="3" cellspacing="0">
<tr>
<td><strong><a href="viewguest.php">Guestbook</a> </strong> </td>
</tr>
</table>

<?
$name = $_POST['name'];
$email = $_POST['email'];
$comment = $_POST['comment'];
?>



__

addentry.php


<?
include("guest.php");
$host="localhost";
$username="root";
$password="";
$db_name=" "; // DATABASE NAME HERE !
$tab_name=" "; // TABLE NAME !

mysql_connect("$host","$username","$password")or die("cannot connect to server!");
mysql_select_db("$db_name")or die("cannot select database !");

$datetime=date("y-m-d h:i:s");

$sql="INSERT INTO $tab_name(name,email,entry,datetime)VALUES('$name' ,'$email','$comment','$datetime')";
$result=mysql_query($sql);
if($result)
{
echo "Successful !";
echo "<BR>";
echo "<a href='viewguest.php'>Guestbook</a>";
}
else
{
echo "an error has occured !";
}

mysql_close();
?>



---

viewguest.php


<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td>&nbsp;</td>
<td><strong><a href="guest.php">Add Guestbook</a></strong></td>
</tr>
</table>
</td>
</tr>
</table>
<?
$host="localhost";
$username="root";
$password="";
$db_name=" "; // DB NAME !
$tab_name=""; // TABLE NAME !

mysql_connect("$host","$username","$password")or die("cannot connect to server !");
mysql_select_db("$db_name")or die("cannot select database !");

$sql="SELECT * FROM $tab_name";
$result=mysql_query($sql);

while($rows=mysql_fetch_array($result))
{
?>
<table width="500" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<td><table width="500" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td>ID</td>
<td>:</td>
<td><? echo $rows['id']; ?></td>
</tr>
<tr>
<td width="120">Name</td>
<td width="15">:</td>
<td width="400"><? echo $rows['name']; ?> </td>
</tr>
<tr>
<td>Email</td>
<td>:</td>
<td><? echo $rows['email']; ?> </td>
</tr>
<tr>
<td valign="top">Comment</td>
<td valign="top">:</td>
<td><? echo $rows['entry']?></td>
</tr>
<tr>
<td valign="top">Date/Time</td>
<td valign="top">:</td>
<td><? echo $rows['datetime']; ?></td>
</tr>
</table></td>
</tr>
</table>
<BR>
<?
}
mysql_close();
?>


THX 4 READING !

PS: If you find any mistakes plz post it (it's been a long time ago since i wrote this script - so be gentle )

[thepainkiller]

isset($var)

[Sir Rogers]

Any of the variables you are transfering from one script to another (i.e. user input) has to be string escaped before you insert the values into your database, else anyone can abuse your site with SQL injection.


Regards,
Sir Rogers