As per ImBS' suggestion, I've removed the original foreach loop by putting it within a comment (for future reference) since it does affect the array for categories, and did some tweaks by moving the SQL data below it and it works fine now. :)
if (!isset($_POST['submit']) || $_SERVER['REQUEST_METHOD'] != "POST") {
exit("<p>You did not press the submit button; this page should not be accessed directly.</p>");
}
else {
$exploits = "/(content-type|bcc:|cc:|document.cookie|onclick|onload|javascript|alert)/i";
$profanity = "/(beastial|bestial|blowjob|clit|cum|cunilingus|cunillingus|cunnilingus|cunt|ejaculate|fag|felatio|fellatio|fuck|fuk|fuks|gangbang|gangbanged|gangbangs|hotsex|jism|jiz|kock|kondum|kum|kunilingus|orgasim|orgasims|orgasm|orgasms|phonesex|phuk|phuq|porn|pussies|pussy|spunk|xxx)/i";
$spamwords = "/(viagra|phentermine|tramadol|adipex|advai|alprazolam|ambien|ambian|amoxicillin|antivert|blackjack|backgammon|texas|holdem|carisoprodol|ciara|ciprofloxacin|debt|dating|porn)/i";
$bots = "/(Indy|Blaiz|Java|libwww-perl|Python|OutfoxBot|User-Agent|PycURL|AlphaServer)/i";
if (preg_match($bots, $_SERVER['HTTP_USER_AGENT'])) {
exit("<h1>Error</h1>\nKnown spam bots are not allowed.<br /><br />");
}
/* FOREACH LOOP
foreach ($_POST as $key => $value) {
$value = trim($value);
if (preg_match($exploits, $value)) {
exit("<h1>Error</h1>\nExploits/malicious scripting attributes aren't allowed.<br /><br />");
}
elseif (preg_match($profanity, $value) || preg_match($spamwords, $value)) {
exit("<h1>Error</h1>\nThat kind of language is not allowed through our form.<br /><br />");
}
$_POST[$key] = stripslashes(strip_tags($value));
}
END FOREACH LOOP */
$connect = mysqli_connect("$db_server", "$db_user", "$db_password", "$db_database");
$select=mysqli_query($connect, "SELECT * FROM `$table_members` WHERE username='$_SESSION[logged_in]'");
while($row=mysqli_fetch_assoc($select)) {
$id = $row['id'];
$name = $row['username'];
}
$title = htmlspecialchars(strip_tags($_POST['title']));
$entry = $_POST['entry'];
$category = $_POST['category'];
$cat = implode(", ", $_POST['category']);
date_default_timezone_set('Asia/Manila');
$timestamp = date('Y-m-d H:i:s');
$entry = nl2br(htmlentities($entry, ENT_QUOTES, 'UTF-8'));
if (!get_magic_quotes_gpc()) {
$title = addslashes($title);
$entry = addslashes($entry);
}
$insert = "INSERT INTO `blog` (`id`, `username`, `entry_id`, `title`, `entry`, `category`, `timestamp`) VALUES ('$id', '$name', '', '$title', '$entry', '$cat', '$timestamp')";
if(mysqli_query($connect, $insert)) {
echo '<h1>Success!</h1>
You have successfully posted a new blog entry!';
}
else {
echo '<h1>Error</h1>
It looks like there was an error in processing your submitted form.';
}
}
Thank you for all the suggestions! :)
categorycolumn in your table? What is the value of$catif you print it?categorycolumn must be varchar if it isint