Ensuring Data Submitted Does Not Fail - PHP

Next we are adding slashes to the data submitted by the user through the form. This ensures that any characters that could cause the MySQL query to fail are escaped. The code we used to do this is detailed below:

$__name = addslashes($__name);
$__url = addslashes($__url);
$__entry = addslashes($__entry);

Before I continue I would just like to mention that the variables $__name, $__entry and $__url have all been fed to the function by the following code:

doInsert($_POST['__name'], $_POST['__entry'], $_POST['__url']);

which resides in our switch statement. This may seem quite obvious to most of us, but it is still good to keep this in mind, as if you changed the field name of one of our input fields and didn’t replicate those changes here, you could find yourself pulling your hair out in no time.

Now we will move on to the following code:

if (empty($__name))
{
?>
<p style="font-family: verdana,arial,helvetica,sans-serif; font-size: 11px; background-color: #FFFFFF">Name Field Is Required</p>
<meta http-equiv="refresh" content="5;url='board.php?do=Tags'">
<?
} elseif (empty($__entry))
{
?>
<p style="font-family: verdana,arial,helvetica,sans-serif; font-size: 11px; background-color: #FFFFFF">Entry Field Is Required</p>
<meta http-equiv="refresh" content="5;url='board.php?do=Tags'">
<?
} else {

[Code removed, as there is no need to replicate it again]

}

This will check to see if all the required fields have been filled out (name and entry). As you can see, the script first checks whether the variable is empty; if the variable is empty an error message is displayed and then five seconds later the page in the Inline Frame is refreshed to display the tags. The data the user entered into the other fields’ remains in tact.

As you can see we have used an elseif statement here. It works in the same method as a standard if / else statement except it allows more than one statement. In our case, if the $__name variable is empty the error will be displayed, if it is not empty, we will then check if the $__entry variable is empty, if it is, display an error, if not, proceed to enter the tag into the database.

We will now have a look at the code which is executed if the $__name and $__entry variables are not empty. This code is below:

} else {

$stSql = "INSERT INTO tagboard(tagId, tag_name, tag_url, tag_entry, tag_date) values('', '$__name', '$__url', '$__entry', ".time().")";
$arrResult = @mysql_query($stSql);
if (!$arrResult) { echo "Query Failed - Unable to Retrieve tags - ".mysql_error()." - Line: __LINE__"; exit(); }

if (mysql_affected_rows() == 1)
{
?>
<meta http-equiv="refresh" content="3;url='board.php?do=Tags'">
<?
} else {
echo "Unable to Add Entry to Database";
?>
<meta http-equiv="refresh" content="5;url='board.php?do=Tags'">
<?
}
}
}

This snippet of code is similar to the code used to retrieve the tags from the database. There are several obvious differences, which we will look into next.