Tweet
htmlspecialchars problem
vorab erst mal der aufbau:
(sind nur die wichtigen auszüge)
[COLOR=red]join_form.html :[/COLOR]
[COLOR=red]eintrag.php[/COLOR]
//Problem:
sonderzeichen mag der im textfeld wohl nicht. wenn ich abschicke kommt ne fehlermeldung:
aber warum ? habe ich htmlspecialchars falsch angewendet ?
(sind nur die wichtigen auszüge)
[COLOR=red]join_form.html :[/COLOR]
HTML-Code:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Schüler hinzufügen</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> </head> <body> <form action="eintrag.php" method="post" enctype="multipart/form-data" name="form1"> <table width="100%" border="0" cellpadding="4" cellspacing="0"> <tr bgcolor="#CCCCCC"> <td align="left" valign="top"><font color="#000000">Persönliche Angaben:</font></td> <td><font color="#CCCCCC"> </font></td> </tr> <tr> <td width="24%" align="left" valign="top">Vorname</td> <td width="76%"><input name="first_name" type="text" id="first_name" value="<? echo $first_name; ?>"></td> </tr> <tr> <td align="left" valign="top">Nachname</td> <td><input name="last_name" type="text" id="last_name" value="<? echo $last_name; ?>"></td> </tr> <tr> <td align="left" valign="top">Spitzname</td> <td><input name="spitzname" type="text" id="spitzname" value="<? echo $spitzname; ?>"></td> </tr> <tr> <td align="left" valign="top">Email Addresse</td> <td> <input name="email_address" type="text" id="email_address" value="<? echo $email_address; ?>"></td> </tr> <tr> <td align="left" valign="top">Straße, Hausnummer</td> <td> <input name="street" type="text" id="street" value="<? echo $street; ?>"> <br> </td> </tr> <tr> <td align="left" valign="top">PLZ, Stadt</td> <td><input name="plz" type="text" id="plz" value="<? echo $plz; ?>"> <input name="town" type="text" id="town" value="<? echo $town; ?>"></td> </tr> <tr> <td align="left" valign="top">Geburtstag</td> <td><input name="birthday" type="text" id="birthday" value="<? echo $birthday; ?>"></td> </tr> <tr> <td align="left" valign="top">Telefon</td> <td><input name="phone" type="text" id="phone" value="<? echo $phone; ?>"></td> </tr> <tr> <td align="left" valign="top">Handy</td> <td><input name="mobile" type="text" id="mobile" value="<? echo $mobile; ?>"></td> </tr> <tr bgcolor="#CCCCCC"> <td align="left" valign="top">Schulische Angaben</td> <td> </td> </tr> <tr> <td align="left" valign="top">Abifach 1 ( LK1)</td> <td><input name="abi1" type="text" id="abi1" value="<? echo $abi1; ?>"></td> </tr> <tr> <td align="left" valign="top">Abifach 2 (LK 2)</td> <td><input name="abi2" type="text" id="abi2" value="<? echo $abi2; ?>"></td> </tr> <tr> <td align="left" valign="top">Literaturfach</td> <td valign="top"> <p> <input type="checkbox" name="literatur[]" value="Schauspiel"> Schauspiel<br> <input type="checkbox" name="literatur[]" value="Musik"> Musik<br> <input type="checkbox" name="literatur[]" value="Bühnenbild"> Bühnenbild <br> <input type="checkbox" name="literatur[]" value="Technik"> Technik<br> <input type="checkbox" name="literatur[]" value="Internet"> Internet<br> <input type="checkbox" name="literatur[]" value="Textgruppe"> Textgruppe </p> </td> </tr> <tr bgcolor="#CCCCCC"> <td align="left" valign="top">Sonstige Angaben</td> <td> </td> </tr> <tr> <td align="left" valign="top">Informationen über dich:</td> <td><textarea name="info" id="info"><? echo $info; ?></textarea></td> </tr> <tr> <td align="left" valign="top">Bild:</td> <td> <input name="bilddir" type="file" id="bilddir"> </td> </tr> <tr> <td align="left" valign="top"> </td> <td><input type="submit" name="Submit" value="Join Now!"> </td> </tr> </table> </form> </body> </html>
PHP-Code:
<?
include 'settings.php';
// Define post fields into simple variables
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$spitzname = $_POST['spitzname'];
$email_address = $_POST['email_address'];
$birthday = $_POST['birthday'];
$phone = $_POST['phone'];
$mobile = $_POST['mobile'];
$abi1 = $_POST['abi1'];
$abi2 = $_POST['abi2'];
$literatur[] = $_POST['literatur[]'];
$literatur = join(",",$literatur);
$info = $_POST['info'];
//$bilddir = $_POST['bilddir'];
$bildname = $HTTP_POST_FILES['bilddir']['tmp_name'];
$street = $_POST['street'];
$plz = $_POST['plz'];
$town = $_POST['town'];
/* Let's strip some slashes in case the user entered
any escaped characters. */
$first_name = stripslashes($first_name);
$last_name = stripslashes($last_name);
$spitzname = stripslashes($spitzname);
$email_address = stripslashes($email_address);
$adress = stripslashes($adress);
$birthday = stripslashes($birthday);
$phone = stripslashes($phone);
$mobile = stripslashes($mobile);
$abi1 = stripslashes($abi1);
$abi2 = stripslashes($abi2);
$info = stripslashes($info);
$street = stripslashes($street);
$plz = stripslashes($plz);
$town = stripslashes($town);
/* Do some error checking on the form posted fields */
if((!$first_name) || (!$last_name) )
{
echo 'Sie müssen folfende Felder ausfüllen: <br />';
if(!$first_name){
echo "Bitte füllen Sie das Feld <strong>Vorname</strong> korrekt aus.<br />";
}
if(!$last_name){
echo "Bitte füllen Sie das Feld <strong>Nachname</strong> korrekt aus.<br />";
}
include 'join_form.html'; // Show the form again!
exit(); // exit wenn error
}
/*checken obs namen schon gibt */
$sql_first_check = mysql_query("SELECT first_name FROM lampen_user WHERE first_name='$first_name'");
$sql_last_check = mysql_query("SELECT last_name FROM lampen_user WHERE last_name='$last_name'");
$first_check = mysql_num_rows($sql_first_check);
$last_check = mysql_num_rows($sql_last_check);
if(($last_check > 0) and ($first_check > 0))
{
echo "Schüler ist schon eingetragen: <a href=\"eintrag.php\">zurück</a><br />";
// include 'join_form.html'; // form zeigen
exit(); // exit wenn error
}
// Enter info into the Database
$info = htmlspecialchars($info);
$sql = mysql_query("INSERT INTO lampen_user (first_name, last_name, email_address, spitzname, info, street, plz, town, birthday, phone, mobile, abi1, abi2, literatur, bilddir )
VALUES('$first_name', '$last_name', '$email_address', '$spitzname' , '$info' , '$street' , '$plz' , '$town' , '$birthday', '$phone' ,'$mobile' , '$abi1', '$abi2', '$literatur' , '$bilddir' )")
or die (mysql_error());
//erfolg anzeigen!
include 'success.php';
if(!$sql){
echo 'Es gab einen Fehler beim eintragen der Schülerdaten';
}
//dateiupload
if (isset($_FILES['bilddir']) and ! $_FILES['bilddir']['error']) {
move_uploaded_file($bildname, "../images/schuler/".$first_name."_".$last_name.".jpg");
}
?>
//Problem:
sonderzeichen mag der im textfeld wohl nicht. wenn ich abschicke kommt ne fehlermeldung:
aber warum ? habe ich htmlspecialchars falsch angewendet ?
Moderator
Kommentar