(this is my fist post)
I have written a PHP-script to enter a “data-set” into a MySQL database.
Before I enter the data, I want to check, if the “data-set” is already in the database.
My problem: It only works for a few data-sets (yes, I am sure I didn’t forget upper and lowercase)
so here is the script (you don’t need the german comments… ):
<!DOCTYPE html>
<html><head>
<meta charset="utf-8">
<title>Playlist</title>
<link rel="stylesheet" type="text/css" href="style.css" />
<script type="text/javascript">
setTimeout("self.location.href='index.php'",6000);
</script>
</head>
<body>
<div id="enterbody">
<?php
include ('conf.php');
mysql_select_db("$datenbank");
//Zeit
$date = date("d-m-Y");
//Post 2 var
$inp = $_POST["inp"];
$titel = $_POST["titel"];
$link = $_POST["link"];
//Länge der Strings
$l_inp = strlen($inp);
$l_titel = strlen($titel);
$l_link = strlen($link);
//eingabestrings in kleine zeichen umwandeln
$s_inp = strtolower($inp);
$s_titel = strtolower($titel);
//datenbankstrings in kleine zeichen umwandeln
//Ausgabe
echo "Länge des Interpreten: $l_inp (max: 50)</br>";
echo "Länge des Titels: $l_titel (max: 50)</br>";
echo "Länge des Links: $l_link (max: 42)</br>";
if ($inp == "" or $titel == "")
{
echo "Bitte fülle die notwendigen Felder aus!";
}
else
{
if ($l_inp > 50 or $l_titel > 50 or $l_link > 42)
{
echo "Der Interpret/Titel/Link ist zu Lange, deshalb wurde er nicht in die Datenbank eingetragen!";
}
else
{
//stringkonvertierung nicht vergessen
$inp_einlesen = mysql_query("SELECT inp FROM $tabelle WHERE inp='$inp'");
$titel_einlesen = mysql_query("SELECT titel FROM $tabelle WHERE titel='$titel'");
if (mysql_num_rows($inp_einlesen) == 1 and mysql_num_rows($titel_einlesen) == 1)
{
echo "<b>$inp</b> mit dem Track <b>$titel</b> ist schon in der Datenbank vorhanden, deshalb wird der Datensatz nicht eingetragen";
}
else
{
$entry = "INSERT INTO playlist (inp, titel, link, date) VALUES('$inp','$titel','$link', NOW())";
$enter_data = mysql_query($entry);
if ($enter_data == true)
{
echo "Deine Daten wurden gespeichert! Weiterleitung...";
}
else
{
echo "Fehler beim Eintragen der Daten...";
}
}
}
}
mysql_close($connection);
?>
</div>
</body>
</html>
On this line:
You’re just testing for one result. Maybe you have multiple results? Maybe two records have the “inp_einlesen” match and only one matches for the ‘titel_einlesen’? In other words, if your dataset already has duplicates, this line won’t find them unless there is only one duplicate of each field.
Another thing besides upper/lower case is trailing spaces. Be sure to use trim() to remove trailing whitespace.
The other thing you might want to standardize is how you’re handling escapes. If someone enters data with apostrophes in it, you’ll need to either manually escape this or deal with it at a lower level, like with magic_quotes.
Also, the code here as you’ve presented it is susceptible to a MySQL injection attack. Be sure to read the PHP man pages for “mysql_real_escape_string.”