1 php
2 include_once(‘sys/config.php‘);
3
4 if (isset($_POST[‘submit‘]) && !empty($_POST[‘message‘]) && isset($_SESSION[‘username‘])) {
5
6 $clean_message = clean_input($_POST[‘message‘]);
7
8
9 $query = "INSERT INTO comment(user_name,comment_text,pub_date) VALUES (‘{$_SESSION[‘username‘]}‘,‘$clean_message‘,now())";
10
11 mysql_query($query, $conn) or die(mysql_error());
12 mysql_close($conn);
13 header(‘Location: message.php‘);
14 }
15 else {
16 echo "

Not Found

The requested URL ".$_SERVER[‘PHP_SELF‘]." was not found on this server.

1 function clean_input( $dirty ) {
2 return mysql_real_escape_string( stripslashes( $dirty ) );
3 }

1 php
2 include_once(‘../sys/config.php‘);
3
4 if (isset($_POST[‘submit‘]) && !empty($_POST[‘user‘]) && !empty($_POST[‘pass‘])) {
5 $clean_name = clean_input($_POST[‘user‘]);
6 $clean_pass = clean_input($_POST[‘pass‘]);
7 $query = "SELECT * FROM users WHERE user_name = ‘$clean_name‘ AND user_pass = SHA(‘$clean_pass‘)";
8 $data = mysql_query($query, $conn) or die(‘Error!!‘);
9
10 if (mysql_num_rows($data) == 1) {
11 $row = mysql_fetch_array($data);
12 $_SESSION[‘username‘] = $row[‘user_name‘];
13 $_SESSION[‘avatar‘] = $row[‘user_avatar‘];
14 $ip = sqlwaf(get_client_ip());
15 $query = "UPDATE users SET login_ip = ‘$ip‘ WHERE user_id = ‘$row[user_id]‘";
16 mysql_query($query, $conn) or die("updata error!");
17 header(‘Location: user.php‘);
18 }
19 else {
20 $_SESSION[‘error_info‘] = ‘用户名或密码错误‘;
21 header(‘Location: login.php‘);
22 }
23 mysql_close($conn);
24 }
25 else {
26 not_find($_SERVER[‘PHP_SELF‘]);
27 }
28 ?>