Phoenix Network Forums

I've got nothin else better to do so here's a simple tutorial of howto make your own guestbook.

You only need 2 files, a process.php and a index.php.

What does process.php do? Well it connects to your mysql database. here's the code for it:

Code: Select all

<?
$username="username";
$password="password";
$database="your_database";

$first=$_POST['first'];
$last=$_POST['last'];
$email=$_POST['email'];
$web=$_POST['web'];
$comment=$_POST['comment'];

mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

$query = "INSERT INTO contacts VALUES ('','$first','$last','$email','$web','$comment')";
mysql_query($query);

mysql_close();
?>

And what about index.php? Well here you have the form such as First name,last name ect., you know probably how a form looks like, so let's get the code here:

Code: Select all

<html>
<head>
<title>Guest Book</title>
</head>
<body>
<form action="process.php" method="post">
First Name: <input type="text" name="first"><br>
Last Name: <input type="text" name="last"><br>
E-mail: <input type="text" name="email"><br>
Web: <input type="text" name="web"><br>
Comments: <textarea rows="6" name="comment" cols="27"></textarea>
<input type="Submit">
</form>
</body>
</html>[/code]
And that's it, you've just created your own guestbook, hurray, you've got any questions don't hesitate to msg me ;)

Greetz knedl.


Nice, i can share this code to a friend, because he doesn't know anything about php yet and he wants to create a guestbook. So you are right on time with this post. Thanks.

nice guestbook.. very userful for beginner like me..

knedl wrote:I've got nothin else better to do so here's a simple tutorial of howto make your own guestbook.

You only need 2 files, a process.php and a index.php.

What does process.php do? Well it connects to your mysql database. here's the code for it:

Code: Select all

<?
$username="username";
$password="password";
$database="your_database";

$first=$_POST['first'];
$last=$_POST['last'];
$email=$_POST['email'];
$web=$_POST['web'];
$comment=$_POST['comment'];

mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

$query = "INSERT INTO contacts VALUES ('','$first','$last','$email','$web','$comment')";
mysql_query($query);

mysql_close();
?>

And what about index.php? Well here you have the form such as First name,last name ect., you know probably how a form looks like, so let's get the code here:

Code: Select all

<html>
<head>
<title>Guest Book</title>
</head>
<body>
<form action="process.php" method="post">
First Name: <input type="text" name="first"><br>
Last Name: <input type="text" name="last"><br>
E-mail: <input type="text" name="email"><br>
Web: <input type="text" name="web"><br>
Comments: <textarea rows="6" name="comment" cols="27"></textarea>
<input type="Submit">
</form>
</body>
</html>[/code]
And that's it, you've just created your own guestbook, hurray, you've got any questions don't hesitate to msg me ;)

Greetz knedl.


I have a little suggestion !
In the process php why not just put in the $_POST variables in the mysql_query instead of making new variables ?

You forgot about the database thing too!

Thanks for the tutorial.(I'm learning php/mysql aswell)
But for this to run, you ll have to create a new mysql database.

What about the mysql host? What if it isn't localhost?
You should put it in a variable like this:
$host='localhost';


One more thing:
To protect the guestbook against mallicious code inserted in the forms you should addslashes, like this:
$first=addslashes($first);
$last=addslashes($last);
...etc...

Well, you can pretty much break the whole script with little skills.
Filter your input, else the script compromisses the security of everything on the server. This is code injection paradise.

bart416 wrote:Well, you can pretty much break the whole script with little skills.
Filter your input, else the script compromisses the security of everything on the server. This is code injection paradise.

Yeah I agree, this was just a sample of how a guestbook should look like, you can mess with code as much as you want. If anyone thinks he can make a "full-proof" source code of the script fell free to repair it and post it again

Greetings.

Excellent, like how you explained what the script does unlike some people who give you the script and just tell you what it does, like without explanation.

Since we assume MagicQuotes is on.

Code: Select all

<?
$username="username";
$password="password";
$database="your_database";

mysql_connect(localhost,$username,$password);
unset($username, $password, $database);
//unset these cause we don't want people to try to call them up
mysql_select_db($database) or die( "Unable to select database");
// the @ here was pretty useless
// no errors the repress, cause you use or die()...

$first = htmlspecialchars($_POST['first'], ENT_QUOTES);
$last = htmlspecialchars($_POST['last'], ENT_QUOTES);
$email = htmlspecialchars($_POST['email'], ENT_QUOTES);
$web= htmlspecialchars($_POST['web'], ENT_QUOTES);
$comment = htmlspecialchars($_POST['comment'], ENT_QUOTES);


$query = "INSERT INTO contacts VALUES ('','$first','$last','$email','$web','$comment')";
mysql_query($query);

mysql_close();
?>


Eventough this is far from enough.
Its better then nothing

knedl wrote:I've got nothin else better to do so here's a simple tutorial of howto make your own guestbook.

You only need 2 files, a process.php and a index.php.

What does process.php do? Well it connects to your mysql database. here's the code for it:

Code: Select all

<?
$username="username";
$password="password";
$database="your_database";

$first=$_POST['first'];
$last=$_POST['last'];
$email=$_POST['email'];
$web=$_POST['web'];
$comment=$_POST['comment'];

mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

$query = "INSERT INTO contacts VALUES ('','$first','$last','$email','$web','$comment')";
mysql_query($query);

mysql_close();
?>

And what about index.php? Well here you have the form such as First name,last name ect., you know probably how a form looks like, so let's get the code here:

Code: Select all

<html>
<head>
<title>Guest Book</title>
</head>
<body>
<form action="process.php" method="post">
First Name: <input type="text" name="first"><br>
Last Name: <input type="text" name="last"><br>
E-mail: <input type="text" name="email"><br>
Web: <input type="text" name="web"><br>
Comments: <textarea rows="6" name="comment" cols="27"></textarea>
<input type="Submit">
</form>
</body>
</html>[/code]
And that's it, you've just created your own guestbook, hurray, you've got any questions don't hesitate to msg me ;)

Greetz knedl.


..well, this is cool! I can easily mess up with the script... This is a simple guestbook which can easily be utilized by php beginners.. Good simple script to study..

tnx for information knedl i'll try to make my guestbook

As people have said, the input does need to be escaped with addslashes() or htmlspecialchars() to make it more secure.

What I noticed is, these guestbook entries are not displayed anywhere! Let's edit the index page to make them display above the form.

For this code I will use two files, mysql.php and index.php. mysql.php just connects to the database to make things a little easier and less repetitive.I am also assuming that in the "contacts" table there is an auto-incrementing ID column and that you have chosen to use addslashes() in process.php.

mysql.php

Code: Select all

$username="username";
$password="password";
$database="your_database";
mysql_connect(localhost,$username,$password);
mysql_select_db($database) or die( "Unable to select database");


index.php

Code: Select all

<html>
<head>
<title>Guest Book</title>
</head>
<body>
<?
// Include database information
include_once("mysql.php");
// Get all entries
$query = "SELECT * FROM `contacts` ORDER BY `id` DESC";
$result = mysql_query($query);
// Display all entries
while($row = mysql_fetch_array($result)){
echo "<B>First: </B>".stripslashes($row['first']);
echo "<BR>";
echo "<B>Last: </B>".stripslashes($row['last']);
echo "<BR>";
echo "<B>Email: </B>".stripslashes($row['email']);
echo "<BR>";
echo "<B>Web: </B>".stripslashes($row['web']);
echo "<BR>";
echo "<B>Last: </B>".stripslashes($row['comment']);
echo "<HR>";
}

?>
<form action="process.php" method="post">
First Name: <input type="text" name="first"><br>
Last Name: <input type="text" name="last"><br>
E-mail: <input type="text" name="email"><br>
Web: <input type="text" name="web"><br>
Comments: <textarea rows="6" name="comment" cols="27"></textarea>
<input type="Submit">
</form>
</body>
</html>


This code could, of course, be cut down in size, but I hope I have made it long enough to be fairly easy to read / understand.

Thank you for the lovely explanation and improving the code, the others were just nagging about it I appreciate it.

Greetings.