Qube

<html>
<head>
    <title>gel dealear: feedback</title>
</head>

<body>
  <h2>Feedback</h2>
  <br>
<?
  if ($_SERVER['REQUEST_METHOD'] === 'POST') { # This is a POST request - so lets handle the POST
    $user     = isset($_POST['user'])     ? $_POST['user'] : '';   # Set $user to the posted value if it exists, otherwise use ''
    $email    = isset($_POST['email'])    ? $_POST['email'] : '';
    $comments = isset($_POST['comments']) ? $_POST['comments'] : '';
    $spam     = isset($_POST['spam'])     ? $_POST['spam'] : '';
    if (empty($user) || empty($email) || empty($comments) || empty($spam)) { # one of the fields was not supplied or left blank
      echo <<<EOVALIDATION
		<H2>Whoops!</h2>
		<BR>
		Please fill in all fields.
		<BR>
		<A HREF="feedback.html">Click here to go bac to the feedback page.</A>
EOVALIDATION;
    } else { # all is good - we passed the empty check on all fields so add to the db

      $db = mysql_connect("localhost");
      if (mysql_errno()) die mysql_error();
      mysql_select_db("sample", $db);
      if (mysql_errno()) die mysql_error();
      $addfeedback = sprintf("INSERT INTO feedback (user, email, spam, comments)
		VALUES ('%s','%s', '%s','%s')", # use sprintf to separate out the user supplied data
           mysql_real_escape_string($user), # and escape the data to keep the SQL safe from injections
           mysql_real_escape_string($email),
           mysql_real_escape_string($spam),
           mysql_real_escape_string($comments));
;
      $result = mysql_query($addfeedback) or die("Cannot query the database.<br>" . mysql_error());
      echo <<<EOSUCCESS
        We have added your comments to our database.<BR><BR>
        <A HREF="feedback.html">Click here to go back to the feedback page.</A>
</body>
</html>
EOSUCCESS;
    }
  } else { # this is a GET request - do something here, or nothing, whatever you want
  }