KbaHaxor/add.php

## add.php
<?php

session_start();
ob_start();

?>
<!DOCTYPE html>
<html>
<head>
    <title>Add a story</title>
    <style type="text/css">
        span.err{
            font-size: 15px;
            color: red;
            font-family: "Geneva";
        }
    </style>
</head>
<body>
<?php
    require 'database.php';

    if(isset($_SESSION["user"])){//Judge if the user has logged in.
        //Judge if there is request forgery detected
        if($_SESSION['token'] !== $_POST['token']){
            die("Request forgery detected");
        }

        //Get the username
        $user = $_SESSION["user"];
        //Get the contents
        $conts = $_POST["contents"];
        //Get the title
        $title = $_POST["title"];
        //Set the current time
        date_default_timezone_set('Asia/Ho_Chi_Minh');
        $date = date("Y-m-d H:i:s");

		$sql = "INSERT INTO story (username, date, title, content) VALUES ('$user','$date','$title','$conts');";
     	if (mysqli_query($mysqli, $sql)) {
            header("Location: index.php");
            exit;
        } else {
            $err = "Query Failed: %s\n".$mysqli->error.".";
        }
    }
    else{
        $err = "You should sign in first.";
    }

    echo "<span class=\"err\">$err..</span>";
    echo "<span class=\"err\">$sql</span>";
    exit;
?>
</body>
</html>
	<?php

	session_start();
	ob_start();

	?>
	<!DOCTYPE html>
	<html>
	<head>
	<title>Add a story</title>
	<style type="text/css">
	span.err{
	font-size: 15px;
	color: red;
	font-family: "Geneva";
	}
	</style>
	</head>
	<body>
	<?php
	require 'database.php';

	if(isset($_SESSION["user"])){//Judge if the user has logged in.
	//Judge if there is request forgery detected
	if($_SESSION['token'] !== $_POST['token']){
	die("Request forgery detected");
	}

	//Get the username
	$user = $_SESSION["user"];
	//Get the contents
	$conts = $_POST["contents"];
	//Get the title
	$title = $_POST["title"];
	//Set the current time
	date_default_timezone_set('Asia/Ho_Chi_Minh');
	$date = date("Y-m-d H:i:s");

	$sql = "INSERT INTO story (username, date, title, content) VALUES ('$user','$date','$title','$conts');";
	if (mysqli_query($mysqli, $sql)) {
	header("Location: index.php");
	exit;
	} else {
	$err = "Query Failed: %s\n".$mysqli->error.".";
	}
	}
	else{
	$err = "You should sign in first.";
	}

	echo "<span class=\"err\">$err..</span>";
	echo "<span class=\"err\">$sql</span>";
	exit;
	?>
	</body>
	</html>