MySQL php create individual named page

Question

I am learning to create my own database and so far I have "thanks to tutorials and stackoverflow" to create a register page.

Once registered, they enter username and password and it opens the upload page.

Its to upload house details

On the upload page they enter City: Price: Decription: Bedrooms: Bathrooms: Photo:

So far, once they input the data it displays on the index page, I have done pagination, re-sized the uploaded image, and all ok.

My next step is on the index page each entry for it to open to a new window displaying their data.

The thing is that makes it hard for me to find the code, is that I want the user to input a name for their details page when uploading the house details.

And for it not to end in .php or .html just www.mysite.com/the-desired-name

my code so far might be using bad code but it works fine, and its helping me achieve what I want till I have the experience to perfect it all.

my code is upload page

 <form enctype="multipart/form-data" action="add.php" method="POST"> 
City: <input type="text" name="city"><br> 
Price: <input type="text" name = "price"><br> 
Decription: <input type="text" name ="description"><br> 
Bedrooms: <input type="text" name="bed"><br> 
Bathrooms: <input type="text" name="bath"><br> 
Your desired link name MYSITE.COM/ <input type="text" name="link"><br> 
Photo: <input type="file" name="photo"><br> 

<input type="submit" value="Add"> 
</form>

And then it uploads via

<?php 

//This is the directory where images will be saved 
$target = "upload/"; 
$target = $target . basename( $_FILES['photo']['name']); 

//This gets all the other information from the form 
$city=$_POST['city']; 
$price=$_POST['price']; 
$description=$_POST['description']; 
$bed=$_POST['bed'];
$bath=$_POST['bath'];
$link=$_POST['link'];
$pic=($_FILES['photo']['name']); 

// Connects to your Database 
mysql_connect("host", "username", "password") or die(mysql_error()) ; 
mysql_select_db("mydatabase") or die(mysql_error()) ; 

//Writes the information to the database 
mysql_query("INSERT INTO `employees` VALUES ('$city', '$price', '$description', '$bed',         '$bath', '$link', '$pic')") ; 

if(move_uploaded_file($_FILES['photo']['tmp_name'], $target)) 
{ 
require_once 'SimpleImage.php';
$image = new SimpleImage();
$image->load($target);
$image->resize(50,50);
$image->save($target); 

//Tells you if its all ok 

echo "<script>window.location = 'http://www.mysite.com'</script>";
} 
else { 

//Gives and error if its not 
echo "Sorry, there was a problem uploading your file."; 
} 
?>

and then it displays on the index page

<?php 
// Connects to your Database 
mysql_connect("host", "username",     "password") or die(mysql_error()) ; 
mysql_select_db("mydatabase") or die(mysql_error()) ; 
if (isset($_GET["page"])) { $page  = $_GET["page"]; } else { $page=1; }; 
$start_from = ($page-1) * 2; 
$data = mysql_query("SELECT * FROM employees ORDER BY bath ASC LIMIT $start_from, 2")     or die(mysql_error());

//Puts it into an array 
while($info = mysql_fetch_array( $data )) 
{ 
?>
<?php 
//Outputs the image and other data

echo "<img src=http://www.mysite.com/upload/".$info['photo'] . " /><br />"; 
echo "<b>City:</b> ".$info['city'] . " ";  
echo "<b>Price:</b> ".$info['price'] . " ";
echo "<b>Bed:</b> ".$info['bed'] . " ";
echo "<b>Bath:</b> ".$info['bath'] . " ";
echo "<b>Extra:</b> ".$info['description'] . " ";
echo "<b>Link:</b> <u>www.mysite.com/</u> ".$info['link'] . " <br /><br /></a>";




}?>
<?php 
$data = mysql_query("SELECT COUNT(photo) FROM employees") or die(mysql_error());
$info = mysql_fetch_row($data);
$total_records = $info[0]; 
$total_pages = ceil($total_records / 2); 

for ($i=1; $i<=$total_pages; $i++) { 
        echo "<a href='index.php?page=".$i."'>".$i."</a> "; 
}; 
?>

Watch out! Your code in vulnerable to SQL injection and XSS attacks! Use parametrized queries to protect against the former and [`htmlspecialchars`](http://php.net/htmlspecialchars) to protect against the latter. And don't use `mysql_*` functions anymore, they're deprecated (see the [red box](http://php.net/mysql_query)). — Marcel Korpel, Feb 01 '13 at 16:13
Your script looks highly insecure. Please use PDO instead of direct MySQL statements and read this: http://bobby-tables.com/ — insertusernamehere, Feb 01 '13 at 16:14

score 0 · Answer 1 · edited May 23 '17 at 12:12

for it not to end in .php or .html just www.mysite.com/the-desired-name

Assuming you are on Apache, have a look at mod_rewrite. You can use that to turn requests like the one you stated into internal requests to /showpage.php/the-desired-name. Inside that showpage.php script, you can access the-desired-name via the $_SERVER['PATH_INFO'] variable. Or, if that does not work, via some other variable which phpinfo() will tell you.

MySQL php create individual named page

1 Answers1