tailieunhanh - PHP & MySQL Everyday Apps for Dummies phần 9

$ _POST ['nút' là không xác định (trên thực tế, trị giá toàn bộ mảng superglobal POST là không xác định). Các báo cáo trường hợp thực hiện khi người dùng hoàn thành hình thức tin nhắn và sau nhấp chuột. Đường 15-18 xây dựng một truy vấn INSERT tạo ra một dòng mới trong bảng chủ đề. | Chapter 8 Hosting Discussions with a Web Forum 341 ftopic topic name ftopicID parentTopic include include break 67 The following numbered items refer to the line numbers in Listing 8-13 9 The switch statement detects which phase the script is running in. If the user has filled in the form and clicked the Post Message button _POST Button is set to Post Message. If the user has not yet seen the form _POST Button is undefined in fact the entire POST superglobal array is undefined . 11 The case statement executes when the user completes the form and clicks Post Message. 15 Lines 15 to 18 build an INSERT query that creates a new row in the Thread table. The htmlentities function is used on line 18 to convert any HTML tags in the subject to entities. This protects against dangerous text entered into the form by bad guys. The addslashes function is used to escape any quotes in the subject. 23 If the INSERT statement succeeds you can call the mysqli_insert_ id function to retrieve the auto-generated ID of the new thread. 25 Lines 25 to 28 prepare the input data for insertion into the database. You see two calls to the mysqli_real_escape_string function. The first call escapes any quotes that the user typed into the author field. The second takes care of any quotes in the body field. You might be wondering why you need to prepare the text entered by the user. Consider a simple INSERT statement that adds a single piece of data to a MySQL table INSERT INTO myTable VALUES userData Assume that a Web user provided the value for userData by filling in a form. If the user typed in a value in the form that you re expecting say Good kitty the INSERT statement translates to INSERT INTO myTable VALUES Good kitty But consider what would happen if instead the user typed in the value There s a good kitty . If you simply plug this text into the INSERT statement the embedded quote mark will produce a syntax error INSERT INTO myTable VALUES There s a good .