Guestbook adding entry without checking fields - php

Question

I got the code for this guestbook from a tutorial, but I decided to add some security and ip checking to it. I am learning php while doing this. The problem I'm having is with the "If else" statements not checking anything and just adding it to the database. Here's the code:
if ($_POST['postbtn']) {
$name = strip_tags($_POST['name']);
$email = strip_tags($_POST['email']);
$message = strip_tags($_POST['message']);
$answer = 'abcdefg';
$response = strtolower(strip_tags($_POST['answer']));
// Check if all fields were filled out
if ($name && $email && $message && $response) {
$time = date("h:i A");
$date = date("m/d/Y");
$ip = $_SERVER['REMOTE_ADDR'];
}
else {
echo "<p style='color:red;'>You didn't fill out all of the fields.</p>";
}
// Check if security answer was correct
if ($response === $answer) {
echo "<p style='color:red;'>Security answer was incorrect.</p>";
} else {
// Check ip address
$checkIP = mysql_query("SELECT ip FROM guestbook WHERE ip = '$ip'");
}
if (mysql_num_rows($checkIP) > 0) {
echo "<p style='color:red;'>You already signed.</p>";
} else {
// add to the database
mysql_query("INSERT INTO guestbook VALUES (
'', '$name', '$email', '$message', '$time', '$date', '$ip'
)");
// refresh page
header('Location: http://www.example.com/guestbook');
}
}

Answer 1

if (isset($_POST['postbtn'])) {
// define variables after the check if the postbtn is pressed
$name = strip_tags($_POST['name']);
$email = strip_tags($_POST['email']);
$message = strip_tags($_POST['message']);
$answer = 'abcdefg';
$response = strtolower(strip_tags($_POST['answer']));
// Check if all fields were filled out, I turned it arround for you, it checks now if it's empty, if so, process an error, else continue
if (empty($name) || empty($email) || empty($message) || empty($response)) {
echo "<p style='color:red;'>You didn't fill out all of the fields.</p>";
// Check if security answer was correct, you check here if its correct and state incorrect answer.
}else if ($response != $answer) {
echo "<p style='color:red;'>Security answer was incorrect.</p>";
// so now we have all errors out of the way, lets go deeper
}else{
$time = date("h:i A");
$date = date("m/d/Y");
$ip = $_SERVER['REMOTE_ADDR'];
$checkIP = mysql_query("SELECT ip FROM guestbook WHERE ip = '$ip'");
// check if we get anything back from the query
if (mysql_num_rows($checkIP) > 0) {
echo "<p style='color:red;'>You already signed.</p>";
} else {
mysql_query("INSERT INTO guestbook VALUES ('', '$name', '$email', '$message', '$time', '$date', '$ip')");
// refresh page
header('Location: http://www.example.com/guestbook');
}
}
}
I do this out of my head, so dont shoot me down on it. I tried to point out where your flaws where. For example, you had a flaw in the checking of your variables, you had a flaw for your security (you actually would give an error message when you typed in the right security answer)
So to explain it all, in if statements, you need to go deep into the rabbit hole as they say it nicely. Sometimes you need the else statement to continue and go deeper in. This way you can catch better your errors. For example. Your code would input anyway in the database, because even if you had a error it would just get to the point of entering it into the database. (your answers would be ignored, because variabels set inside an if else statement, cant be used outside of that loop. See it as a localized variable)
But if you keep digging deeper in if else statements, you can take them with you.
edit
Also, I indent the code for you, so you see how deep we go and how many if-else statements there actually are. If you have any questions, please dont hesitate ;)
edit2
I actually replaced the response and answer check 1 if else statement down and made an else if to keep all errors near each other. You could also do this with the variable to check the num_rows, but I havent done it. You could also toss that in an else if statement after the security check. This should also work, but to make it prettier, you can go the way i described.
In theory, this should work fine.

Answer 2

It checks everything, but execution is not blocked by errors.
Wrap your code into try-catch block and throws exception on every error.
try {
if ($_POST['postbtn']) {
$name = strip_tags($_POST['name']);
$email = strip_tags($_POST['email']);
$message = strip_tags($_POST['message']);
$answer = 'abcdefg';
$response = strtolower($_POST['answer']);
// Check if all fields were filled out
// Invert condition
if (!$name || !$email || !$message || $response) {
throw new Exception("You didn't fill out all of the fields.");
}
$time = date("h:i A");
$date = date("m/d/Y");
$ip = $_SERVER['REMOTE_ADDR'];
// And so on...
}
}
catch (Exception $e) {
echo "<p style='color:red;'>" . $e->getMessage() . "</p>";
}