Inserting row - anti spammer

wheres me jumpa

Guys,

I want a user to add a row to db. In this row is yes/no field to determine whether it is published or not. When a row is entered an email is sent to myself and if it is appropriate I set this field to Yes.

Before what i would do is just get the info via email and enter it myself but I recieved alot of spammers trying to add links to my site. Links to the usual crapola, healthcare, viagra, dating etc.

With this in mind are there any dangers to allowing user direct access to an insert statement?

dahamsta

Not if the resultant data isn't going to be displayed/utilised without approval.

However you should make sure the input is clean anyway -- google for "sql injection" for methods.

adam

wheres me jumpa

Thanks Ken,

Rather than start another thread anyone want t try explain this one for me.

Im using a while loop in php to output rows form DB but it is displaying one less than it should each time. The sql statement is fine in phpymyadmin.

		echo"<tr><td class=tdBottom><b>Act</b></td><td class=tdBottom><b>Category</b></td></tr>";
		while($row=mysql_fetch_array($result, MYSQL_ASSOC)){
			echo"<tr><td colspan=3>&nbsp;</td></tr>";
			echo"<tr><td width=160>" . "<a href=acts.php?aid=" . $row['act_id'] . ">" . $row['act_name'] . "</a></td><td>" . $row['act_category'] . "</td></tR>";
			echo"<tr><td class=tdBottom colspan=3>&nbsp;</td></tr>";
		}

Webmonkey

By any chance you using the $result sql query before you get. You may have used it somewhere making the result forward one row. Try placing this before the while loop:

[php]mysql_data_seek($result, 0);[/php]

Edit:

actually try this:
just a little different looking.
[php]

mysql_data_seek($result, 0);
$row = mysql_fetch_assoc($result);

do
{

echo"<tr><td colspan=3> </td></tr>";
echo"<tr><td width=160>" . "<a href=acts.php?aid=" . $row . ">" . $row . "</a></td><td>" . $row . "</td></tR>";
echo"<tr><td class=tdBottom colspan=3> </td></tr>";

} while($row=mysql_fetch_assoc($result));
[/php]

wheres me jumpa

Webmonkey wrote:

By any chance you using the $result sql query before you get. You may have used it somewhere making the result forward one row. Try placing this before the while loop:

Excellent Monkey, thanks, I was actually using $result beforehand.