Question

Im about to create a simple code for adding news…(small project of mine)
When I click submit i get a success text, and a rediret back to the page but there is no data added and if I leave the form empty-the error message does not appear.

…and is the mysql_real_escape_string gonna save me some trouble?

<?php 
include('connect_db.php');
if(isset($_POST['submit']))
{
    $title = mysql_real_escape_string(htmlspecialchars($_POST['title']));
    $text = mysql_real_escape_string(htmlspecialchars($_POST['text']));

    if ($title == '' || $text == '')
    {

         // generate error message
         $error = 'ERROR: Please fill in all required fields!';
    }

    $result = mysql_query("INSERT INTO news ('id', 'date', 'title', 'text')
                           VALUES ('NULL', NOW(),'$title','$text')",$conn);

    echo "<b>Thank you!<br>You'll be redirected in (4) secs...";
    echo "<meta http-equiv=Refresh content=4;url=add.php>";

    } else {

    echo "<form method='post' action='add.php'>
          <legend>Add news</legend>
          <label>Title</label>
          <input type='text' name='title'>
          <label>Text</label>
          <textarea rows='5' name='text'></textarea>
          <br />
          <button type='submit' name='submit' class='btn'>Submit</button>
          </form>";
}?>

Answer 1

Your code is a little unfinished.

<?php 

// connect to the database
include('connect_db.php');


if(isset($_POST['submit']))

{

    // htmlspecialchars is needed when displaying HTML to the user from an input, not for inserting into a database. mysql_real_escape_string is plenty for this purpose.

    $title = mysql_real_escape_string($_POST['title']);
    $text = mysql_real_escape_string($_POST['text']);

    if ($title == '' || $text == '')

    {

        // You have generated an error but you are not displaying it anywhere.

        // generate error message
        echo 'ERROR: Please fill in all required fields!';

       // You will want to either send the error in a query string to this page again and display it above the form or re-echo the form here.

    }else{

        // Don't submit the data if there is an error.

        // ID should be auto-increment in your database, don't set it here even if you set it NULL, you can also have MySQL apply the current time rather than here.

        $result = mysql_query("INSERT INTO news (`title`, `text`)
        VALUES ('$title','$text')");

        echo "<b>Thank you!<br>You'll be redirected in (4) secs...";
        echo "<meta http-equiv=Refresh content=4;url=add.php>";

    }

} else {

    echo "<form method='post' action='add.php'>
    <legend>Add news</legend>
    <label>Title</label>
    <input type='text' name='title'>
    <label>Text</label>
    <textarea rows='5' name='text'></textarea>
    <br />
    <button type='submit' name='submit' class='btn'>Submit</button>
    </form>";

}
?>