Question

I have an html form with 4 items.

title and content are required.

link and image are optional.

So this is what i wrote, but i cannot insert the data in my data base.
Is there a mistake in my condition statement for url and image? Thanks

if($_SERVER['REQUEST_METHOD'] == "POST") {

$ttt = strlen(htmlspecialchars(trim($_POST['title'])));
$ccc = strlen(htmlspecialchars(trim($_POST['content']))); // count title and content charters

$title = htmlspecialchars(trim($_POST['title']));
$content = htmlspecialchars(trim($_POST['content']));
$url = htmlspecialchars(trim($_POST['url']));
$image = htmlspecialchars(trim($_POST['image']));


if($url!=''){
    if ( !preg_match( '|^(ht|f)tp(s?))://|', $url ){
        echo "wrong";
        mysql_close($db);
    }
} // if $url is not empty, judge is it began as a http:// ? else close the db link 

if($image!=''){
    if ( !getimagesize($image)){
        echo "wrong";
        mysql_close($db);
    }
} // if $image is not empty, use getimagesize judge is it a real image? else close the db link

if(($ttt > 2 && $ttt < 201) && ($ccc > 29 && $ccc < 1001)) {
$sql= "INSERT INTO msg (title, content,image,link) VALUES ('".$title."','".$content."', '".$image."', '".$url."')";//if title charters between 3-200 and content charters between 30-1000, do insert into thing

if(mysql_query($sql))
{
  echo "insert done"; 
}else{
  echo "insert wrong";
}

}else{
  echo "your title or content is out of the words limit";
}


}

mysql_close($db);

Answer 1

Change:

if($link!=''){
    if ( !preg_match( '|^(ht|f)tp(s?))://|', $url ){
        echo "wrong";
        mysql_close($db);
    }
}

to

if($url !=''){
    if ( !preg_match( '|^(ht|f)tp(s?))://|', $url ){
        echo "wrong";
        mysql_close($db);
    }
} 

for us to be able to help yuou better show your $sql statement;

UPDATE:

It’s very hard to figure the problem like that here is what you can do, to see what is the problem:

$result = mysql_query($sql) or die (‘Error: ‘mysql_error());

This way you can see what is the error in your query, i a pretty sure it is an escaping problem so here is what you can add;

$title = htmlspecialchars(trim($_POST['title']));
$content = htmlspecialchars(trim($_POST['content']));
$url = htmlspecialchars(trim($_POST['url']));
$image = htmlspecialchars(trim($_POST['image']));


$title = mysql_real_escape_string($title);
$content = mysql_real_escape_string($content);
$url = mysql_real_escape_string($url);
$image = mysql_real_escape_string($image);

this way if there are any special characters they will be escaped