Ultimate Guestbook Tutorial: How to build a Guestbook with a honeypot, error checking, IP banning, pagination, e-mail notification and smilies with PHP and mySQL

This last part is simple. We want to receive an e-mail notification when someone successfully submits a guestbook entry. To do this open up index.php and:

Under:

$postentry = @mysql_query("INSERT INTO `entries` (name, email, website, message, date, ip) VALUES ('".addslashes($_POST['name'])."', '".addslashes($_POST['email'])."', '".addslashes($_POST['website'])."', '".addslashes($_POST['message'])."', now(), '".$_SERVER['REMOTE_ADDR']."')");

Add:

$message = "Hey there!\n\r You're popular today!\n Someone gave you a guestbook entry:\n\r";
				$message .= "From: ".stripslashes($_POST['name'])."\n";
				$message .= "E-mail: ".stripslashes($_POST['email'])."\n";
				$message .= "Website: ".stripslashes($_POST['website'])."\n\r";
				$message .= "Message:\n".stripslashes($_POST['message'])."\n";
				mail($email, 'New GuestBook Entry!', $message);

Next open up config.php and under the $dbname line add:

$email = 'mymail@mail.com';

Obviously change the e-mail address to the one you want to receive the notifications from! This will send you an e-mail everytime someone fills out the guestbook correctly!

On the topic of e-mail, we need to change something on our interface so that our loving users dont get sucked up by the spam e-mail sucker bots trawling the internet! Last thing i promise!!

Open up entries.php and:

Find:

<td valign="bottom" width="100%"><?php echo stripslashes($row['email']); ?></td>

Replace it with:

<td valign="bottom" width="100%"><?php
							$email = explode('@',stripslashes($row['email']));
							echo $email[0].' *at* '.$email[1];
							 ?></td>

This breaks up the e-mail string by the @ symbol, and stores the parts into an array. Where we then join them back together but instead of with an @ symbol we add our own in. That way those pesky little sucker bots won’t get your guests e-mails!

Lastly
Lets clean up index.php quickly.

Make a new file in the includes folder called actions.php. Then cut out everything in the index.php file so that you only have the 3 includes statements, and paste the rest into the actions.php file. Make sure it starts with Save and close it. Your actions.php file should now look like:

<?php
$query = mysql_query("SELECT * FROM `spam` WHERE `ip`='".$_SERVER['REMOTE_ADDR']."' LIMIT 1");
	$spamip = mysql_num_rows($query);

	if($spamip == 0){
		if(isset($_POST['submit']) && strlen($_POST['message2']) == 0){

			if(strlen($_POST['name']) == 0){
				$error['name'] = 'Please enter your name';
			}

			if(strlen($_POST['email']) == 0){
				$error['email'] = 'Please enter an e-mail address';
			} else {
				if(!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $_POST['email'])){
					$error['email'] = 'Please enter a correct e-mail address';
				}
			}

			if(strlen($_POST['message']) < 2){
				$error['message'] = 'Please enter a message';
			}	

			if(!isset($error)){
				$postentry = @mysql_query("INSERT INTO `entries` (name, email, website, message, date, ip) VALUES ('".addslashes($_POST['name'])."', '".addslashes($_POST['email'])."', '".addslashes($_POST['website'])."', '".addslashes($_POST['message'])."', now(), '".$_SERVER['REMOTE_ADDR']."')");

				$message = "Hey there!\n\r You're popular today!\n Someone gave you a guestbook entry:\n\r";
				$message .= "From: ".stripslashes($_POST['name'])."\n";
				$message .= "E-mail: ".stripslashes($_POST['email'])."\n";
				$message .= "Website: ".stripslashes($_POST['website'])."\n\r";
				$message .= "Message:\n".stripslashes($_POST['message'])."\n";
				mail($email, 'New GuestBook Entry!', $message);

				if($postentry == true){
					unset($_POST);
				}
			}

		} else if(isset($_POST['submit']) && strlen($_POST['message2']) > 0){
			$spamentry = @mysql_query("INSERT INTO `spam` (ip) VALUES ('".$_SERVER['REMOTE_ADDR']."')");
		}
	} else {
		$error['spam'] = 'Your IP: '.$_SERVER['REMOTE_ADDR'].' is banned!';
	}
?>

Next under the line in your index.php file:

include('includes/functions.php');

Add:

include('includes/actions.php');

So that your index.php file looks like:

<?php
	include('includes/config.php');
	include('includes/functions.php');
	include('includes/actions.php');
	include('templates/skin.php');
?>

Much neater!

**Update**

People can post HTML, which you may or may not like? Anyways, you can fix this easily. Open up entries.php and:

Find:

<td valign="top" colspan="2"><?php echo smilies(stripslashes($row['message'])); ?></td>

Replace with:

<td valign="top" colspan="2"><?php echo smilies(htmlspecialchars(stripslashes($row['message']))); ?></td>

Find:

<td valign="bottom" width="100%"><a href="<?php echo stripslashes($website); ?>" target="_blank"><?php echo substr($website,0,30); ?></a></td>

Replace with:

<td valign="bottom" width="100%"><a href="<?php echo stripslashes($website); ?>" target="_blank"><?php echo htmlspecialchars(substr($website,0,30)); ?></a></td>

Find:

<td valign="bottom" width="100%"><?php echo stripslashes($row['name']); ?></td>

Replace with:

<td valign="bottom" width="100%"><?php echo htmlspecialchars(stripslashes($row['name'])); ?></td>

htmlspecialchars() is a built in php function that escapes any html tags within a string! That way the text is treated a literal and not formatted by the browser as standard HTML.

Done! *clap clap clap*