Enable posting in browser (post.php?name=MyName&body=MyText?) - php

Question

I've created a text posting website. Except the posting on the post.php page I want to enable users to post text when they type www.mywebsite.com/post.php?name=MyName&body=MyText? How can I make this?
The post code looks like this:
<?php
//insert category to database
if(isset($_POST['qty'])) {
// Fetch and clean the <select> value.
// The (int) makes sure the value is really a integer.
$qty = (int)$_POST['qty'];
// Create the INSERT query.
$sql = "INSERT INTO `table`(`quantity`)
VALUES ({$qty})";
// Connect to a database and execute the query.
$dbLink = mysql_connect('MyServer', 'username', 'password') or die(mysql_error());
mysql_select_db('database_name', $dbLink) or die(mysql_errno());
$result = mysql_query($sql);
// Check the results and print the appropriate message.
if($result) {
echo "Record successfully inserted!";
}
else {
echo "Record not inserted! (". mysql_error() .")";
}
}
if ($_POST['post'])
{
//get data
$title = $_POST['title'];
$body = $_POST['body'];
//check for existance
if ($title&&$body)
{
mysql_connect("MyServer","username","password") or die(mysql_error());
mysql_select_db("database_name") or die(mysql_error());
$date = date("Y-m-d");
//insert data
$insert = mysql_query("INSERT INTO news VALUES ('','$title','$body','$date')") or die(mysql_error());
die("Your text has been posted!");
}
else
echo "Please fill out your name and text";
}
?>

Answer 1

You will want to use $_GET not POST for the data from the query string.
//get data
$title = $_GET['title']; // or name if it's name
$body = $_GET['body'];

Answer 2

Try to use $_REQUEST - it has all the data you have posted to the script (from $_GET, $_POST and $_COOKIE global arrays)

Answer 3

First suggestion is, avoid direct queries based on query strings at all possible costs! This is a huge security concern.
Also, the code you supplied would is open to numerous security holes and concerns.
Anytime you call a variable via $_COOKIE, $_POST or $_GET and it is used in a query, use MySQLI/PDO Prepared statements when possible, or at least mysql_real_escape_string. This will attempt to sanitize the data going into your database.
Also, You are GETTING parameters from the the url/query string, change POST to GET.
Additionally, your line which says:
if($_GET['post'])
Will always fail, you do not have a parameter in your url called post. For that to work, it would need to look like:
post.php?post&name=MyName&body=MyText?)
See below:
<?php
//insert category to database
// makes sure qty is numeric # added by sixeightzero
if(isset($_GET['qty']) && is_numeric($_GET['qty'])) {
// Fetch and clean the <select> value.
// The (int) makes sure the value is really a integer.
$qty = (int)$_GET['qty'];
// Create the INSERT query.
$sql = "INSERT INTO `table`(`quantity`)
VALUES ({$qty})";
// Connect to a database and execute the query.
$dbLink = mysql_connect('MyServer', 'username', 'password') or die(mysql_error());
mysql_select_db('database_name', $dbLink) or die(mysql_errno());
$result = mysql_query(mysql_real_escape_string($sql));
// sanitizes input # added by sixeightzero
// Check the results and print the appropriate message.
if($result) {
echo "Record successfully inserted!";
}
else {
echo "Record not inserted! (". mysql_error() .")";
}
}
if (!isset($_GET['name']) && !isset($_GET['body'])){
//get data
$title = $_GET['name'];
$body = $_GET['body'];
//check for existance
if ($title && $body)
{
mysql_connect("MyServer","username","password") or die(mysql_error());
mysql_select_db("database_name") or die(mysql_error());
$date = date("Y-m-d");
//insert data
$insert = mysql_query("INSERT INTO news VALUES ('','".mysql_real_escape_string($title)."','".mysql_real_escape_string($body)."','".mysql_real_escape_string($date)."')") or die(mysql_error());
// sanitizes input # added by sixeightzero
die("Your text has been posted!");
}
else
echo "Please fill out your name and text";
}
?>

Answer 4

Here's the complete source code!!
Try using this
<?php
//insert category to database
if(isset($_POST['qty'])) {
// Fetch and clean the <select> value.
// The (int) makes sure the value is really a integer.
$qty = (int)$_POST['qty'];
// Create the INSERT query.
$sql = "INSERT INTO `table`(`quantity`)
VALUES ({$qty})";
// Connect to a database and execute the query.
$dbLink = mysql_connect('MyServer', 'username', 'password') or die(mysql_error());
mysql_select_db('database_name', $dbLink) or die(mysql_errno());
$result = mysql_query($sql);
// Check the results and print the appropriate message.
if($result) {
echo "Record successfully inserted!";
}
else {
echo "Record not inserted! (". mysql_error() .")";
}
}
if ($_SERVER['REQUEST_METHOD'] == "GET") //check whether its a GET method
{
//get data, since you know that a valid "GET" request was sent
$title = $_REQUEST['title'];
$body = $_REQUEST['body'];
if (isset($title) && isset($body)) //check for existance
{
mysql_connect("MyServer","username","password") or die(mysql_error());
mysql_select_db("database_name") or die(mysql_error());
$date = date("Y-m-d");
//insert data
$insert = mysql_query("INSERT INTO news VALUES ('','$title','$body','$date')") or die(mysql_error());
die("Your text has been posted!");
}
else
echo "Please fill out your name and text";
}
?>

Answer 5

$_REQUEST is basically the result of array_merge($_GET,$_POST,$_COOKIE), so you can use it to get a value which may be a GET or POST variable.