tags:

views:

39

answers:

2

Hello,

The code below works well. It submits some variables into a MySQL database. How could I block the submission and redirect the user back to domain.com/index.php if the conditions below are met?

Conditions:

  • $uid has been used more 11 or more times in a calendar day.
  • $cleanurl has ever been used before.

Thanks in advance,

John

Code:

 if(isURL($site1)==true)
     mysql_query("INSERT INTO submission VALUES (NULL, '$uid', '$title', '$slug', '$cleanurl', '$displayurl', NULL)");
    else
     echo "<p class=\"topicu\">Not a valid URL.</p>\n";
A: 

You would simply need to run queries to apply these checks prior to your INSERT and if the criteria isn't met, forward them on as you mentioned.

[REMOVED STUPID COMMENT]

mysql_real_escape_string() is definitely the route to take

Webnet
No, no, heck no. You should either use prepared queries or a function like `mysql_real_escape_string()` to quote dangerous characters. You should not switch quoting styles in an attempt to combat SQL injection... **Edit:** I do agree with the first line in your answer. That is a typical solution to this kind of "problem"...
ircmaxell
Or even better, use prepared statements with mysqli or similar.
Byron Whitlock
+1  A: 

$uid has been used more 11 or more times in a calendar day:

select uid from submissions where date > '$todaysDate 00:00' and date < '$todaysDate 23:59' group by uid having count() > 11

$cleanurl has ever been used before.

SELECT count(*) from ... where cleanurl='$cleanurl'

if both conditions are met, then

Header("Location: http://domain.com/index.php");

Byron Whitlock
Thanks... how do I make the variable for $todayDate?
John
date('Y-m-d'). check the php manual for date.
Byron Whitlock