将数据插入mysql数据库

Question

Im trying to insert data into my mysql databse. It succesfully inserts the data but the problem is everytime i load the page i recieve the following error.

   Notice: Undefined index: comment in 
   C:\wamp\www\CMS\addnews.php on line 42
   Call Stack
   #    Time    Memory  Function    Location
   1    0.0004  674184  {main}( )   ..\addnews.php:0

Im aware that the mysql extension is offically depreciated so please dont comment on that.

Here's my code

               <form id="insNews" name="insNews" method="POST" action="addnews.php">


                           <textarea rows="20" cols="90" name="comment"></textarea>
                           <input type="submit" name="InsertNews" id="InsertNews">
                       <?php
                          include 'db.php';
                          $comment=$_POST['comment']; // **ERROR HERE**
                          $tablename="news";
                          $sql="INSERT INTO $tablename(news_content)VALUES('$comment')";

                             if(isset($_POST['InsertNews'])) 
                             {
                             mysql_query($sql);
                            }

                      ?>

Answer 1

You must check if variable exists.

<form id="insNews" name="insNews" method="POST" action="addnews.php">
    <textarea rows="20" cols="90" name="comment"></textarea>
    <input type="submit" name="InsertNews" id="InsertNews">
</form>

<?php
include 'db.php';
if (!empty($_POST['comment'])) {
    $comment   = $_POST['comment']; // **ERROR HERE**
    $tablename = "news";
    $sql="INSERT INTO $tablename(news_content)VALUES('" . mysql_real_escape_string($comment) . "')";

    if(isset($_POST['InsertNews'])) 
    {
        mysql_query($sql);
    }
}

?>

But I want to inform you that mysql_* lib is deprecated. Use PDO or mysqli instead this. Also, be care about Sql injection, if you want to use mysql_* functions, use mysql_real_escape_string.