通过页面ID获取评论

Question

Hello i have created a databse which store the information sended by the form on my page. The structure of the database is this :

cid(comment id)    uid(value='Anonymous')   id(of the page)   date     message(text of the message)

So when i goes to a particular page of my website, for example http://miostio.com/page.php?id=15 here i can put a comment by a form which send the information that u can see up in my database.

Now on my database are stored the id of the page in which i have putted the comments, but when i try to see the comment in that page by the function : getComments($conn); ,here are displayed all the comments saved in the database and not only the comments with the id of the page.

I want that the comments displayed corresponds to the id of the page, in page with id(15) display the comment of the page with id(15), in page with id(10) display the comment of the page with id(10) exc ...

PHP --> form that send data

echo "<form method='POST' action='".setComments($conn)."'>
                <input type='hidden' name='id' value='".$row['id']."'>
                <input type='hidden' name='uid' value='Anonymous'>
                <input type='hidden' name='date' value='".date('Y-m-d H:i:s')."'>
                <textarea name='message'></textarea><br>
                <button name='commentSubmit' type='submit' class='comm-btn'>Comment</button>
                </form>";

                getComments($conn);

other PHP CODE which contain the function called by the form

                        function setComments($conn) {
                    if (isset($_POST['commentSubmit'])){
                        $uid = $_POST['uid'];
                        $date = $_POST['date'];
                        $message = $_POST['message'];
                        $id = $_POST['id'];

                        $sql = "INSERT INTO comments (uid, date, message, id) VALUES ('$uid', '$date', '$message', '$id')";
                        $result = $conn->query($sql);
                    }
                }

                    function getComments ($conn) {
                        $sql = "SELECT * FROM comments WHERE id = id ORDER BY cid DESC";
                        $result = $conn->query($sql);
                        while($row = $result->fetch_assoc()) {
                            echo "<div class='comment-box'><p>";
                                echo $row['uid']."<br>";
                                echo $row['date']."<br>";
                                echo nl2br($row['message']);
                            echo "</p></div>";
                        }
                    }

Answer 1

"SELECT * FROM comments WHERE id = id ORDER BY cid DESC"

id always === id

You need to give a real id there...

"SELECT * FROM comments WHERE id = $id ORDER BY cid DESC"

Would consider protecting it from sql injection like this:

"SELECT * FROM comments WHERE id = " . (int)$id . "ORDER BY cid DESC"

Answer 2

You got at least two mistakes (I don't know yet if the rest is ok and working):

1st: Your sql statement doesn't include the variable you're aming for, it just says kinda 'if 1=1'. So change it to:

$sql = "SELECT * FROM comments WHERE id = $id ORDER BY cid DESC"

2nd: You don't have yet $id available in that function. So include that:

function getComments ($conn) {
   $id = intval($_POST['id']); // cast to int for security
   $sql = "SELECT * FROM comments WHERE id = $id ORDER BY cid DESC";
   $result = $conn->query($sql);
   while($row = $result->fetch_assoc()) {
       echo "<div class='comment-box'><p>";
       echo $row['uid']."<br>";
       echo $row['date']."<br>";
       echo nl2br($row['message']);
       echo "</p></div>";
   }
}