help error

[ecabrera]

when i click add video i tells me "for some reason the video was not added to the database" i dont know why before it was fine and you could upload but now its telling me this when uploading

 

 

 

 

<?php $title = "Add Video";
?>
<?php require("styles/top.php"); ?>

<div id='left'>
<?php

if ($username){

	$categories = "
                <option value='Children'>Children</option>
	<option value='Music'>Music</option>
	<option value='Sports'>Sports</option>
	<option value='News'>News</option>";

	$form = "<form action='$site/addvideo' method='post'>
	<table>
	<tr>
		<td>Title:</td>
		<td><input type='text' name='title' style='width: 450px;'></td>
	</tr>
	<tr>
		<td>Description:</td>
		<td><textarea name='description' style='width: 450px; height: 100px;'></textarea></td>
	</tr>
	<tr>
		<td>Keywords:</td>
		<td><input type='text' name='keywords' style='width: 450px;'></td>
	</tr>
	<tr>
		<td>Category:</td>
		<td><select name='category' style='width: 455px;'>
			<option value=''>Select One</option>
			$categories
		</select></td>
	</tr>
	<tr>
		<td></td>
		<td>If you would like a new category, <a href='$site/contact' target='_blank'>Please request it here!</a></td>
	</tr>
	<tr>
		<td>Video ID:</td>
		<td><input type='text' name='videoid' maxlength='20' style='width: 450px;'><br />
		Not the entire URL just the video ID! Just the part in RED!!!<br />
		http://www.youtube.com/watch?v=<font color='red'>Rqhdap5UGas</font></td>
	</tr>
	<tr>
		<td></td>
		<td><input type='submit' name='addbtn' value='Add Video'></td>
	</tr>
	</table>
	</form>";

	if (@$_POST['addbtn']){
		$title = $_POST['title'];
		$description = $_POST['description'];
		$keywords = $_POST['keywords'];
		$category = $_POST['category'];
		$videoid = $_POST['videoid'];

		if ($title){
		if ($description){
		if ($keywords){
		if ($category){
		if ($videoid){
			if (strstr($categories, "<option value='$category'>$category</option>")){
				require("scripts/connect.php");

				$query = mysql_query("SELECT * FROM videos WHERE videoid='$videoid'");
				$numrows = mysql_num_rows($query);
				if ($numrows == 0){

					$date = date("F d, Y"); // October 09, 2010
					mysql_query("INSERT INTO videos VALUES ('', '$userid', '$username', '$title', '$description', '$keywords', '$category', '$videoid', '0', '$date')");
					$query = mysql_query("SELECT * FROM videos WHERE user_id='$userid' AND title='$title' AND videoid='$videoid'");
					$numrows = mysql_num_rows($query);
					if ($numrows == 1){
						$row = mysql_fetch_assoc($query);
						$id = $row['id'];

						echo "Your video has been added. <a href='$site/videos?id=$id'>Click here to view it.</a>";

					}
					else
						echo "<font color='red'>Your video was not added to the database for some reason.</font>";
				}
				else
					echo "You can not add a video that is already in the database. $form";

				mysql_close();
			}
			else
				echo "You did not submit a valid category. $form";
		}
		else
			echo "You did not submit a video ID. $form";
		}
		else
		echo "You did not select a category. $form";
		}
		else
		echo "You did not submit any keywords. $form";
		}
		else
		echo "You did not submit a description. $form";
		}
		else
			echo "You did not submit a title. $form";
	}
	else
		echo "$form";

}
else
	echo "<h2><font color='red'>You must be logged in to add a video.</font></h2>";

?>
</div>

<div id='right'></div>

<?php require("styles/bottom.php"); ?>

[Pikachu2000]

Are you getting any errors/warnings/notices?

 

You have no logic in place to check if any of the queries have succeeded with the expected result, succeeded with other than an expected result or failed entirely.

 

There is no reason to store a date in a MySQL database in any format other than YYYY-MM-DD, in a DATE or DATETIME type field

 

You don't need to run a SELECT query to see if an INSERT query succeeded (see point #1)

 

You have your query strings embedded in the query execution, therefore you can't even echo them to help yourself debug the code.

 

Look at these functions:

mysql_error

mysql_affected_rows

 

Your queries should be formatted (in general) as such:

$query = "INSERT INTO table (field1, field2, field3) VALUES ('value1', 'value2', 'value3')";
if( !$result = mysql_query( $query ) ) {
// query failed to execute successfully
echo "<br>Query: $query<br>on: " . __LINE__ . 'of' . __FILE__ . '<br>Failed with error: ' . mysql_error() . '<br>';
// for a live server, the error message should be a generic, "Sorry, try again later" message, and the error details should be logged.
}

[phpSensei]

There are many unnecessary if/else statements in your code, specially in regards to the logic your using as Pickachu2000 specified. 

 

this code

 

if ($title){
		if ($description){
		if ($keywords){
		if ($category){
		if ($videoid){

 

can be all in 1 line, simply tell the user he needs to fill in the marked as required fields "*". This is just my opinion though, if you want to specify which field they didn't enter, there is no issue either way.

 

All of this code

 

mysql_query("INSERT INTO videos VALUES ('', '$userid', '$username', '$title', '$description', '$keywords', '$category', '$videoid', '0', '$date')");
					$query = mysql_query("SELECT * FROM videos WHERE user_id='$userid' AND title='$title' AND videoid='$videoid'");
					$numrows = mysql_num_rows($query);
					if ($numrows == 1){
						$row = mysql_fetch_assoc($query);
						$id = $row['id'];

						echo "Your video has been added. <a href='$site/videos?id=$id'>Click here to view it.</a>";

					}

 

can simply be

 

$query = mysql_query("INSERT INTO videos VALUES ('', '$userid', '$username', '$title', '$description', '$keywords', '$category', '$videoid', '0', '$date')");
if ($query){
$id = mysql_insert_id();
echo "Your video has been added. <a href='$site/videos?id=$id'>Click here to view it.</a>";
}

 

You also need to protect your data against sql injection and several other possible hacks.

 

$title = $_POST['title'];
$description = $_POST['description'];
$keywords = $_POST['keywords'];
$category = $_POST['category'];
$videoid = $_POST['videoid'];