safe users commenting

[auriaks]

hi, i want to know how i need to change forum script that noone could enter some php or other code to damage my site. (as example !error strings)
My script:

<?php 

//connect to the database 
$connect = mysql_connect("nnn","nnn","nnn") or die("Error connecting to db"); 
//select table 
mysql_select_db("nnn") or die("Error selecting db"); 

//use query to get ALL data 
$queryget = mysql_query("SELECT * FROM guestbook ORDER BY `date` DESC, `time` DESC") or die("Error with query");
while ($row = mysql_fetch_array($queryget)) 
{ 
    // get row data and store in variables 
    $id = $row['id']; 
    $name = $row['name']; 
    $message = $row['message']; 
    $date = $row['date']; 
    $time = $row['time']; 
     
    // show data to user 
    echo " 
    <table> 
        <tr> 
            <td width='500px'>
            <font size='2' face='Showcard Gothic'>            
            <hr>Autorius: <b>$name</b> <br> $date 
            </b></font>
            </td> 
        </tr> 
        <tr> 
                <td width='500px' bgcolor='#5CB3FF'>
                <font size='2' face='Showcard Gothic'><b>
                $message<br><hr>
                </b></font>
                </td> 
        </tr> 
    </table> 
    ";     
} 

echo "<hr>"; 

if ($_POST['submit']) 
{ 
   
  $name = $_SESSION['nick']; 
  $message = $_POST['message']; 
  $date = date("Y-m-d"); 
  $time = date("H:i:s"); 
   
  if ($message) 
  { 
   
  $tag = $_POST['message']; // this is the posted message field, from the form 

$tag = str_replace(':|', '<img src="images/emoticons/blank.gif" alt="">', $tag); 


echo $tag; // echo the output, with emoticons showing. 

// all else is self-explanatory.  
   
  mysql_query("INSERT INTO guestbook (Name, Message, time, date) 
        VALUES('$name', '$tag', '$time', '$date')") or die(mysql_error());
  echo "Please wait...<meta http-equiv='refresh' content='2'>";
  
  } 
  else 
    echo "Please fill out all fields!"; 


} 
?>

i use tag to convert pictures, i also could use it to solve this problem, but i need better idea, because i cant write all the error variables, etc... There always will be new code to broke my webpage.

If you need more info ASK. THANKS

[fg123]

Is there a strip tag thing to remove tags??

[thetestingsite]

you could use mysql_real_escape_string(), strip_tags(), htmlspecialchars(), and htmlentities() to take care of this.

Hope this helps.

[Nile]

Remember to use the functions before the data is inserted into any database, especially mysql_real_escape_string, or your database is vulnerable to sql injection.

[auriaks]

ok. Thanks you guys

[fg123]

Ur welcome.

[auriaks]

hey, when i want to check variable is it is only number i write:

if (!is_numeric($password)) { } else {
  exit("only numbers!"); 

what i have to write to check if there are characters like .,/\|#$%^&!@)(_+? ?

[thetestingsite]

for that you would want to use preg_match and regular expressions.

Hope this helps.

[Nile]

When learning regular expressions, keep in mind it can get frustrating, and they are hard to learn (atleast for me).

[auriaks]

What then will happen? "frustrating" what thet means?