First foray into PHP/MySQL: some VERY basic questions

[hughanagle]

I have recently built a website for my local youth orchestra. They have no budget whatever to pay a professional to do their site development - that's where I come in, as the father of one of the trumpet players!

They're very happy with the site, but regular updating with news bulletins is something I'd like to offload back to the orchestra committee.

To that end I have created a very simple MySQL database with just one 'news_entries' table containing four fields:

• entry_id (auto_increment, primary)
• entry_title (varchar)
• entry_content (text)
• entry_created (timestamp)

I have created a 'create_news_item.php' page to allow data to be entered into the db: that is working fine.
I have succeeded in pulling the data back out of the db and displaying news entries on the index.php page as individual news items.

I have some general and basic questions, however.

1. in this kind of situation - where one or two designated orchestra committee members are the only ones who will use the create_entry.php page - would I just send them a link to that page and let them work away or would I need to secure the create_entry.php page, somehow? If the page needs to be secured, how would I go about that?
2. Instead of all news entries showing on the home page, I'd like to:

• (a) show, let's say, only the last 5 news items
• (b) for any entries more than 3 or 4 lines long, I'd like to display just the first paragraph and then have a 'More..' link which would reveal (with an expanding div?) the full entry.

How would I script (a) and (b), above, in php?

There are other things I would like to do, e.g.

• allow a news item to be edited and/or deleted
• allow uploading of a photo to accompany each news item

... but, for now, I'll hold off on these steps.

If anyone could help me with the above - in very simple terms for a non-programmer - I'd greatly appreciate it.

Hugh

[Guest]

Hello Hugh,

You said you already succeeded to pull the data from database and display it on the page. So your first task (a) will be an easy one I guess.

When you pull the data from DB, you need to sort the results by date, descending, and limit the results to 5:

SELECT * FROM news_entries ORDER BY entry_created DESC LIMIT 5

This will give you the newest 5 news entries from the DB.

As for your second task (b)

You need an estimate number of characters to limit your news entry output. Something like this will do:

<?php
echo strlen($news["entry_content "]) < 100 ? $news["entry_content "] : substr($news["entry_content "], 0, 100) . "<a href='view_article.php?id={$news["entry_id "]}' title='Click here for more...'>More...</a>";
?>

which means:

If entry_content's length is less than 100, than print whole content; else, print only first 100 chars of the entry and add a link to the and.

The link's URL contains the unique news entry id, so in your php page, you can pull that entry and display the whole content....

Edit:

For your first question:

Yes, you most definitely want to secure that page. Easiest way to do that is, create an admin folder, and put entry creation page in it. Then contact your host and have them set the admin folder password protected (they will do it by using .htaccess).

In the future you will need to delete and edit the news items, so you can put those scripts into the same folder, so only authorized personnel can create, edit and delete news items.

[hughanagle]

Thank you very much Burak.

I've done the LIMIT query no problem and have password protected the directory containing make_entry.php. (That was easy - my hosting package allows me to p/w protect directories easily via a control panel.)

I haven't yet sorted out the display of just the first few lines of the news entry: I'll get to that tomorrow. I've become something of a php/mysql junkie in the last 48 hours. From knowing almost nothing, I've been bitten by the bug...

Hugh

[Guest]

You're welcome, glad to be of help, and welcome to the club

But you are in the most dangerous phase of PHP/MySQL development right now.

Before you proceed any further with database i/o etc. I suggest you to read about security risks of weakly written PHP code.

Google "SQL injection", "PHP data sanitization", "PHP session hijacking" and "PHP email headers injection".

[hughanagle]

Will do. Thanks.