buildBlock.php
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>BuildBlock.php</title>
<meta http-equiv="Content-Type" content="text/html;charset=UTF-8" />
</head>
<body>
<?php
//retrieve data from form
$password = filter_input(INPUT_POST, "password");
$blockType = filter_input(INPUT_POST, "blockType");
$title = filter_input(INPUT_POST, "title");
$content = filter_input(INPUT_POST, "content");
$pageID = filter_input(INPUT_POST, "pageID");
//clean input for sql use
$blockType = mysql_real_escape_string($blockType);
$title = mysql_real_escape_string($title);
$content = mysql_real_escape_string($content);
$pageID = mysql_real_escape_string($pageID);
//check password
if ($password == "allInOne"){
manageResults();
} else {
print "<h2>Unauthorized access...</h2>";
} // end if
function manageResults(){
global $blockType, $title, $content, $pageID;
//return output
print <<<HERE
<h2>Page input:</h2>
<p>
blockType: $blockType <br />
title: $title <br />
content: $content <br />
pageID: $pageID
</p>
HERE;
//connect to db
$con = mysql_connect("localhost", "xfd", "xfdaio");
mysql_select_db("xfd");
//build and submit query
$query = <<<HERE
INSERT INTO cmsBlock VALUES(
null, $blockType, '$title', '$content', $pageID);
HERE;
print "<pre>$query</pre>";
$result = mysql_query($query);
if ($result == -1){
print mysql_error();
} else {
print "system updated";
} // end if
} // end function
?>
<p>
<a href = "dbCMS.php">return to the CMS</a>
</p>
</body>
</html>