Databases
StackOverflow2013
Postsdbo
POBuilding a PM system
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POBuilding a PM system
    text
    copied!<p><strong>First of all I am very new to PHP/MySQL and I am aware as others have pointed out that my code is vunerable to MySQL injection, but right now I am working on learning the functionality before I move onto security.</strong></p> <p>Ok so I am building a Private Messaging system from scratch to help with my understanding of the coding, i have hit a road block where I am trying to POST the "to_user" data in a reply string, and I can get everything else to successfully post but the"to_user"(the person who sent the PM) and the subject data isn't carrying over.</p> <p>Here is my "view_pm.php" file.</p> <pre><code>&lt;?php include 'core/init.php'; include 'includes/overall/header.php'; ?&gt; &lt;?php include "includes/inbox-menu.php"; ?&gt; &lt;table&gt; &lt;?php $id = $_GET['id']; $to_user = $user_data['user_id']; $sql = "SELECT users.user_id, users.username, users.profile, messages.id, messages.to_user, messages.from_user, messages.subject, messages.message, messages.has_read, messages.deleted, messages.date_sent FROM `messages` JOIN `users` ON messages.from_user = users.user_id WHERE messages.to_user = '$to_user' AND messages.id = '$id' ORDER BY messages.date_sent DESC"; $result = mysql_query($sql); $rows = mysql_fetch_array($result); ?&gt;&lt;tr&gt; &lt;td width="50px" align="center"&gt; &lt;img src="&lt;?php echo $rows['profile']; ?&gt;" width="40px"&gt;&lt;br&gt;&lt;?php echo $rows['username']; ?&gt; &lt;/td&gt; &lt;td valign="top" width="350px"&gt; &lt;b&gt;&lt;?php echo $rows['subject']; ?&gt;&lt;/b&gt;&lt;br&gt; &lt;?php echo $rows['message']; ?&gt; &lt;/td&gt;&lt;td&gt;&lt;?php echo $rows['date_sent']; ?&gt;&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td colspan="3"&gt;&lt;hr&gt;&lt;/td&gt; &lt;/tr&gt; &lt;?php $sql2 = "SELECT users.user_id, users.username, users.profile, messages.id, messages.reply_id, messages.to_user, messages.from_user, messages.subject, messages.message, messages.has_read, messages.deleted, messages.date_sent FROM `messages` JOIN `users` ON messages.from_user = users.user_id WHERE messages.to_user = '$to_user' AND messages.reply_id = '$id' ORDER BY messages.date_sent DESC"; $result2 = mysql_query($sql2); while ($rows = mysql_fetch_assoc($result2)) { ?&gt; &lt;tr&gt; &lt;td width="50px" align="center"&gt; &lt;img src="&lt;?php echo $rows['profile']; ?&gt;" width="40px"&gt;&lt;br&gt;&lt;?php echo $rows['username']; ?&gt; &lt;/td&gt; &lt;td valign="top" width="350px"&gt; &lt;b&gt;&lt;?php echo $rows['subject']; ?&gt;&lt;/b&gt;&lt;br&gt; &lt;?php echo $rows['message'] ?&gt; &lt;/td&gt;&lt;td&gt;&lt;?php echo $rows['date_sent']; ?&gt;&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td colspan="3"&gt;&lt;hr&gt;&lt;/td&gt; &lt;/tr&gt; &lt;?php } ?&gt; &lt;/table&gt; &lt;form method="post" action="parsers/reply_pm.php"&gt; Reply: &lt;textarea name="message"&gt;&lt;/textarea&gt;&lt;br&gt; &lt;input type="hidden" name="from_user" value="&lt;? echo $to_user; ?&gt;"&gt; &lt;input type="hidden" name="to_user" value="&lt;? echo $rows['from_user']; ?&gt;"&gt; &lt;input type="hidden" name="subject" value="&lt;? echo $rows['subject']; ?&gt;"&gt; &lt;input type="hidden" name="reply_id" value="&lt;? echo $id ?&gt;"&gt; &lt;input type="submit" name="submit" value="Send Message"&gt; &lt;/form&gt; &lt;?php include 'includes/overall/footer.php'; ?&gt; </code></pre> <p>And here is my "reply_pm.php" file.</p> <pre><code>&lt;?php include '../core/init.php'; $reply_id = $_POST['reply_id']; $to_user = $_POST['to_user']; $from_user = $user_data['user_id']; $subject = $_POST['subject']; $message = $_POST['message']; echo $sql = "INSERT INTO `messages` (reply_id, to_user, from_user, subject, message, date_sent) VALUES ('$reply_id','$to_user','$from_user','$subject','$message',now())"; $result = mysql_query($sql); exit(); if($result){ header("Location: ../view_pm.php?id=$reply_id"); } else { echo "Error sending message."; } ?&gt; </code></pre> <p>And you may or may not have noticed I am echoing the result while testing, it's currently returning..</p> <p>INSERT INTO <code>messages</code> ( reply_id, to_user, from_user, subject, message, date_sent ) VALUES ( '8','','1','','test reply goes here',now() )</p> <p>Thanks in advance.</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload