Quote
Replace DB_HOST with the host of your database. This is usually “localhost”, but some hosts differ
They only differ if the mysql server is on a seperate node to the php parser.
As the HTTP server won't have a clue about what to do with MySQL connections, it's left up to PHP.
You could replace in that instance say mysqluser@192.168.0.1 say if the mysql host is on a seperate computer this time 192.168.0.1.
Or if you're like me and have a FQDN working on a local network, then you'd use something along the lines of databasehost.mydomain.com
Or incase of MySQL mysqluser@mysql.mydomain.com, but you would need to allow for 3306 (which allot of hosting plans block anyways), I could open it up on my own server but prefer not to!
Just thought I would give you a heads up on the comparison to the localhost var in the mysql_connect, quite essentially it's just where the mysql server is located compared to the PHP parser.
Quote
$inf = "SELECT * FROM `comments` WHERE page = '".stripslashes($_SERVER['REQUEST_URI'])."' ORDER BY time ASC";
You do not need to escape out of parsing with PHP at all, all you'd need to do on occasion is use mysql_real_escape_string($foo);
This puts in what you want, also what you put in your logic is making your code (if you're opening it up to the public, if not then ignore this), your actually opening up your code for SQL injection attacks.
When a hacker gets into your text boxes or creates some form of XSS attack (cross site scripting), and inject code into your variables potentially wiping your database off completely, reading data from it, that they should not be doing.
mysql_real_escape_string() sends the variable in as a piece of text not a command like escaping out of parsing in PHP alone will make you prone to XSS attacks and not using mysql_real_escape_string leaves you open to SQL injection attacks.
Just thought I would give you a word of warning.
Very good tutorial though, but I would never use it for a productional system, you might want for instance to start thinking about using MySQL based sessions, trying to work out a set of logic for saving instead of filesystem based sessions, using MySQL saved sessions, so instead of a file the row in the database is the session and does go no where near the file system.
It's a good idea when one uses hosting based solutions, they want to keep track of users actions or maybe even have a cluster of mysql servers.
Edited by Jez, 03 June 2011 - 09:44 AM.
, Please 
4
iGuest, on 13 November 2009 - 12:27 PM, said:
