Question

This is an example of the code am using. I use a modified version of this code for another one of my pages. The other page uses a textbox instead of a textarea. The textbox version works just fine. When I click submit, It just returns to the current page and the textarea erased and nothing added to the DB. What am I doing wrong?

<? function renderForm($words, $type, $error){ ?>
<?php if ($error != '') { echo '<div style="padding:4px; border:1px solid red; color:red;">'.$error.'</div>'; } ?> 

<form action="" method="post">
<select name="type">
<option value="intro">Intro</option>
<option value="phrase">Phrase</option>
<option value="phrase2">Phrase2</option>
<option value="phrase3">Phrase3</option>
<option value="phrase4">Phrase4</option>
<option value="phrase5">Phrase5</option>
<option value="phrase6">Phrase6</option>
<option value="phrase7">Phrase7</option>
<option value="phrase8">Phrase8</option>
<option value="phrase9">Phrase9</option>
<option value="phrase10">Phrase10</option>
<option value="phrase11">Phrase11</option>
<option value="phrase12">Phrase12</option>
<option value="phrase13">Phrase13</option>
<option value="phrase14">Phrase14</option>
<option value="phrase15">Phrase15</option>
<option value="phrase16">Phrase16</option>
<option value="phrase17">Phrase17</option>
<option value="phrase18">Phrase18</option>
<option value="phrase19">Phrase19</option>
<option value="phrase20">Phrase20</option>
<option value="keyword" selected>Keyword</option>
<option value="keyword2">Keyword2</option>
<option value="keyword3">Keyword3</option>
</select>

<br>
<textarea rows="20" cols="10" name="words"></textarea>
<input type="submit" name="submit" value="Add">
</form>
<?php 
}

// connect to the database
include('connection.php');

// check if the form has been submitted. If it has, start to process the form and save it to the database
if (isset($_POST['submit']))
{ 

$words = $_POST['words'];
$type = $_POST['type'];

if ($words == '' )
{
// generate error message
$error = 'ERROR: Please fill in all required fields!';

// if either field is blank, display the form again
renderForm($words, $error);
}
else
{
$item = explode("\n", $words);

foreach($item as $words){ 
    mysql_query("INSERT subs SET word='$words', type='$type'") or die(mysql_error()); 
}

}
}
else
// if the form hasn't been submitted, display the form
{ renderForm('',''); }
?> 

Answer 1

You are missing the = for words and you have some major security holes. Try this snippet:

<?
// connect to the database
include('connection.php');

// check if the form has been submitted. If it has, start to process the form and save it to the database
if (isset($_POST['submit'])) {

    $words = $_POST['words'];
    $type = $_POST['type'];

    if ($words == '') {
        // generate error message
        $error = 'ERROR: Please fill in all required fields!';

        // if either field is blank, display the form again
        renderForm($words, $error);
    } else {
        $item = explode("\n", $words);

        foreach ($item as $words) {
            mysql_query("INSERT INTO subs SET word='".mysql_real_escape_string( sanitizeString($words) )."', type='".mysql_real_escape_string( sanitizeString($type) )."'") or die(mysql_error());
        }
    }
} else {
    // if the form hasn't been submitted, display the form
    renderForm('', '');
}

function renderForm($words, $type, $error='') {
    if ($error != '') {
        echo '<div style="padding:4px; border:1px solid red; color:red;">' . $error . '</div>';
    }
    $options = array();
    $options['intro'] = 'Intro';
    $options['phrase'] = 'Phrase';
    $options['phrase1'] = 'Phrase1';
    $options['phrase2'] = 'Phrase2';
    $options['phrase3'] = 'Phrase3';
    $options['phrase4'] = 'Phrase4';
    $options['phrase5'] = 'Phrase5';
    $options['phrase6'] = 'Phrase6';
    $options['phrase7'] = 'Phrase7';
    $options['phrase8'] = 'Phrase8';
    $options['phrase9'] = 'Phrase9';
    $options['phrase10'] = 'Phrase10';
    $options['phrase11'] = 'Phrase11';
    $options['phrase12'] = 'Phrase12';
    $options['phrase13'] = 'Phrase13';
    $options['phrase14'] = 'Phrase14';
    $options['phrase15'] = 'Phrase15';
    $options['phrase16'] = 'Phrase16';
    $options['phrase17'] = 'Phrase17';
    $options['phrase18'] = 'Phrase18';
    $options['phrase19'] = 'Phrase19';
    $options['phrase20'] = 'Phrase20';
    $options['keyword'] = 'Keyword';
    $options['keyword2'] = 'Keyword2';
    $options['keyword3'] = 'Keyword3';
    ?> 
    <form action="" method="post">
        <select name="type">
            <?php
            foreach ($options as $key=>$val) {
                echo '<option value="'.$key.'"'.(($key == $type) ? ' selected="selected"' : '').'>'.$val.'</option>'.PHP_EOL;
            }
            ?>
        </select>
        <br />
        <textarea rows="20" cols="10" name="words"><?php echo $words; ?></textarea>
        <input type="submit" name="submit" value="Add" />
        <?php
}

function sanitizeString($string) {
    return htmlentities( (string) $string, ENT_COMPAT, "UTF-8" );
}
?>