In the future, please use a more descriptive subject when posting a question. See posting guidelines.
I went to that link and was able to post without getting an error. I just couldn't use a newline (aka press enter) but that is because your regular expression doesn't allow it. It doesn't allow punctuation either.
Then just use mysql_real_escape_string and you should use it on the name and the message. That will auto escape any special characters that could be used for SQL injection.
See:
PHP Code:
<?php //connect $connect = mysql_connect("","","") or die("Connection failed!"); mysql_select_db("") or die("Database fail!");
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'nobody'@'localhost' (using password: NO) in /home/a5488351/public_html/post.php on line 33
Free Web Hosting
PHP Error Message
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in /home/a5488351/public_html/post.php on line 33
Free Web Hosting
PHP Error Message
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'nobody'@'localhost' (using password: NO) in /home/a5488351/public_html/post.php on line 34
Free Web Hosting
PHP Error Message
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in /home/a5488351/public_html/post.php on line 34
mysql_real_escape_string requires you're connection to the database is established. Ensure that you're using you're mysql_connect prior to the use of mysql_real_escape_string.
Also, until PHP6, there is a possibility of magic_quotes_gpc being enabled on you're server. The idea behind it was to prevent sql injections, but they are not compatible with 'real' (ie: from the database) sanitation. So, you'll need to code to handle that as well:
PHP Code:
$con = mysql_connect('', '', '') or die(mysql_errno()); if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) { $_POST = array_map('stripslashes', $_POST); }
Of course, if its not a string you're intending to handle, cast it to the specific type (like an int), and ignore the mysql_real_escape_string. Any input data in PHP is considered a string, so its up to you to control what is really what.
__________________
As of PHP 5.5, the MySQL library has been officially deprecated. It is recommended to move to either MySQLi or PDO libraries for your mysql connectivity. See here for help choosing which interface you prefer: http://php.net/manual/en/mysqlinfo.api.choosing.php
I don't think that protects from codes. I want a code that stops you and says: "Please use letters only." if they type in stuff like: $[];'{}
Can anyone do this?
Well yes actually it will protect from code, at least PHP code. The purpose of mysql_real_escape_string is to convert escapable data into non-escapable data string allowing you to store it in a database properly. Should you want to remove tags to prevent html and xss injection, you can look at using strip_tags and htmlentities to take care of those conversions.
To match just letters you can pattern match with if (preg_match('/^[a-z]*$/i', $input)), but thats letters only, no spaces or numbers.
__________________
As of PHP 5.5, the MySQL library has been officially deprecated. It is recommended to move to either MySQLi or PDO libraries for your mysql connectivity. See here for help choosing which interface you prefer: http://php.net/manual/en/mysqlinfo.api.choosing.php
he purpose of mysql_real_escape_string is to convert escapable data into non-escapable data string allowing you to store it in a database properly.
Aka meaning it prevents SQL injection. So it should do what you want. There is no need to block $[];'{}. It isn't like if someone were to write $foo = 8; in the message that the code would get executed.
Before you post, read our: 
