Code: Alles auswählen
<?php
$link = mysql_connect('localhost', 'mysql_user', 'mysql_password');
if (!$link) {
die('Could not connect to DB');
}
mysql_select_db('mydb');
if (isset($_POST['submit'])) {
$income = $_POST['comment'];
foreach ($income as $value) {
@strip_tags($value);
}
$badStrings = array("Content-Type:","MIME-Version:","Content-Transfer-Encoding:","bcc:","cc:", "[URL","[/URL]");
foreach ($income as $key => $value) {
if ((@eregi("<[^>]*script*\"?[^>]*>", $value)) ||
(@eregi("<[^>]*iframe*\"?[^>]*>", $value)) ||
(@eregi("<[^>]*object*\"?[^>]*>", $value)) ||
(@eregi("<[^>]*applet*\"?[^>]*>", $value)) ||
(@eregi("<[^>]*meta*\"?[^>]*>", $value)) ||
(@eregi("<[^>]*style*\"?[^>]*>", $value)) ||
(@eregi("<[^>]*form*\"?[^>]*>", $value)) ||
(@eregi("<[^>]*img*\"?[^>]*>", $value))){
// echo 'Nice try, Round Up!';
exit;
}
}
foreach($income as $k => $v){
foreach($badStrings as $v2){
if(@strpos($v, $v2) !== false){
// echo 'Nice try, one more Time!';
exit;
}
}
}
// man könnte noch auf eine korrekte email prüfen
mysql_query('INSERT INTO comments SET
page = "'.$income['page'].'",
poster = "'.$income['poster'].'",
email = "'.$income['email'].'",
rating = "'.$income['rating'].'",
body = "'.$income['body'].'"
');
}
// hier der eigentliche Inhalt der Seite
// und $page mit irgendwas sinnvollem belegen
// eine DB Table "comments" mit den feldern: "page,poster,email,rating,body" anlegen
// hier etwas zum auslesen der Comments
$result = mysql_query('SELECT poster,email,rating,body FROM comments WHERE page = "'.$page.'"');
while ($row = mysql_fetch_assoc($result)) {
echo '
Name: '.$row['poster'].'<br>
Email: '.$row['email'].'<br>
Bewertung: '.$row['rating'].'<br>
'.$row['body'].'
<hr>';
}
echo '<form action="'.$_SERVER['PHP_SELF'].'" method="post">
<input type="hidden" name="comment[page]" value="'.$page.'">
<table BORDER=0 >
<tr><td WIDTH="15%"><b><font face="Arial"><font size=-1>Name:</font></font></b></td><td><input type="text" name="comment[poster]" size="28"></td></tr>
<tr><td WIDTH="15%"><b><font face="Arial"><font size=-1>Email:</font></font></b></td><td><input type="text" name="comment[email]" size="28"></td></tr>
</table>
<table BORDER=0 >
<tr>
<td><b><font face="Arial"><font size=-1>Bewertung:</font></font></b></td>
<td><select name="comment[rating]" size="1">
<option value="0" selected="selected">-</option>
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
<option value="6">6</option>
<option value="7">7</option>
<option value="8">8</option>
<option value="9">9</option>
<option value="10">10</option>
</select>
</td>
<td><b><font face="Arial"><font size=-1>von 10 Augen</font></font></b></td>
</tr>
</table>
<table BORDER=0 >
<tr>
<td COLSPAN="2">
<textarea name="comment[body]" wrap="virtual" rows="10" cols="70"></textarea>
</td></tr>
<tr><td> </td></tr>
<tr><td ALIGN=CENTER><input name="submit" value=" Eintragen " type="submit"><input value=" Löschen " type="reset"></td></tr>
</table>
</form>';
?>
Danksagungen und Beileidsbekundungen bitte auf mein PayPal Konto
oder in Form von Links
