Online Form PHP Script Help!

[adultzone]

I tried everything but NO luck at all. Can anyone give me the right direction where to go to find that script. I have been searching it all over the internet study some php script but I am getting lazy and getting head aches on reading those words! Now I am trying to ask for help.

An online form which basically a sign up form that will post to my database in my server and I can export those details. Or anyone can give me a ready made online form then I will just insert my database name, username and password. Any help will be appreciated.


J

[webboy21]

most database servers won't be accessible from a location that is NOT your own server I think....why not install one on your own server?

if that is what you want I'd be happy to help

[just a punk]

The certainly would but not for free

[webboy21]

why did you think I was suggesting that I could help him? ;)

[fris]

not really hard just modify the submit data to store to a db

[potter]

You guys really saying you'd ask for money for 7 lines of (very common) code? Sheesh!

form.php

<form name="input" action="script.php" method="post">
Username: <input type="text" name="user" />
Email: <input type="text" name="email" />
<input type="submit" value="Submit" />
</form>

script.php

<?php

$dbconnect = mysql_connect('localhost', 'user', 'password') or die("Unable to connect to MySQL");
$database = mysql_select_db('database_name', $dbconnect) or die("Could not select database");

$user = mysql_escape_string($_POST['user']);
$email = mysql_escape_string($_POST['email']);

mysql_query("INSERT INTO table_name VALUES ($user, $email)");

header("form.php");

exit;

?>

[d-null]

what are the most common injection hack vulnerabilities that a simple script like this might inadvertantly run into in the wrong hands? what should be done as basic protection?

[EukerVoorn]

Guys, is there a secure way to send info from a form like this by e-mail? Can you do pgp mail from a server for example?

[Jakez]

what are the most common injection hack vulnerabilities that a simple script like this might inadvertantly run into in the wrong hands? what should be done as basic protection?

The 'mysql_escape_string' part should take of that. It will escape the common characters people use to sql inject.

Now when people want to correctly use ' or " in the form you're going to run into another problem.

You\'re text is going to look something like \\"this\\"