Need some help with this form

ovisopa

Hello ppl,
I have made an computer site , and now I need to make an on-line configurator for the site, so the visitors should configure an computer by chosing first procesor type, after motherboard ....
I made first page from where they can chose which procesor they wanna have, so there are 2 links AMD and INTEL

After one link is pressed a new page will load with two comboboxe filds one is with all AMD procesors and one with all mothorbords which suports amd procesor.

the code for procesor is this :

<select class="linktd" name="proc_tip">
<?php
require("db.inc.php");
$result = mysql_query("SELECT * FROM procesoare WHERE tip = 'AMD'");
while ($data = mysql_fetch_array ($result)){
   echo" <option value=\" " . $data["price"] . " \" > " . $data["model"] . "</option>";
}
?>
</select>

After submit button is pressed a new page is loaded with other fields to chose like ram, video card and other optional components.

I want in this 3rd page to be displayed the total price for procesor and motherboard and the name to for those two components. I don't know how to display in the 3rd page the name of the procesor and motherboard I selected in 2nd.

You can see that in "value" I have the price of the component which is displayed in the 3rd page, but I need next to the price to be the name of the component I selected.

If you have understand what I tried to explain here and if you know how to help me pls send me an reply, cause I realy need to do this configurator.

Till I get an answer from you I will try to do it maibe in other way...

10x and see ya

ahundiak

You can put pretty much put whatever you want into the value field i.e.
$value = $data['price'] . '|' . $data['model'];
And then use explode() to break them apart again.

But that's probably not a really good design especially since the user could edit the option field and change the price. Better to return the selected model number then lookup the price.

ovisopa

Hy,
Maibe I should read something about explode function and try to use it, the users can only chose from the combobox a product and they can't modifi the price or other thing. The only thing they could do is tho chose some products and pres next 🙂 .

Do you think that is better to chose the products first and only in the last page to dysplay the total price??

Anyway 10x for help and I wait for other opinion.

See ya

ahundiak

You may not want the user's to be able to change the price but there are several tools out there which will allow them to do so. And there is nothing you can do about it.

Don't rely on the user being unable to change data or you will get burned.

seanpaulcail

Are you talking abpout pirating via user changing the price?

I've never heard of this.

And I'm just implemented a test online shopping cart.

Could you tell me more on how people change the price?

What if you have the price stored in a database?

Can it be changed by the viewer/user?

How can I circumvent this form of piracy?

Thanks.

ovisopa

The "users" you are teling me are hackers, wright ?

I don't think if just every body is able to update an value from a database, I'm wright? or no.

10x for advice and see ya

ahundiak

In general, users will not be able to get into your database. You need to be a bit careful since users could enter sql statements into html input fields and mess things up for you. But, as long as you do a reasonable amount of server side data validation then you will be ok as far as your database is concerned.

However, it's very easy to change the html code received by a browser. You simply do a save as to create a html file, edit the file with your favorite editor and then load the file back into your browser and submit. (You need to change relative links to absolute links).

So, assume you have sent the price to the user as a hidden field or perhaps as an option value. The user can use the above process to change the price and send it back to the server. IF the server relies on the price being sent back to it then the user will be able to give themselves quite a bargain. This was quite common back in the early days of e-commerce and there are still many people who routinely check sites for this defect.

The moral of the story is: don't rely on anyting coming back from the client as being unchanged. And don't think that it takes some super smart cracker to mess with your site.

ovisopa

10x for the "story" in the future I'll be more carefull, maibe starting right now 🙂 ,

10x again for help.

So if I will use a sesion they won't e able to do tha thing with save as and modify the sorce...

Bye

ahundiak

Session variables stored on the server are the way to go. They are not 100% secure. The session id (for example) could be hijacked and someone who really knew what they were doing could, in theory, buy something using someone else's credit card. But that's difficult.

seanpaulcail

Since you are not using e-commerce there is little need for security.

I think seesions are fairly secure and they allow you to store variables without writing to
the database. Then you retrieve the variables with $_POST.

global $total_price;
global $items;
if(!$items) $items = "0";
if(!$total_price) $total_price = "0.00";

then t show the current price

echo "Total Items = $items";

Then the code to calculate price.

You could prbably simplify this by passing a simple array.

P.S. I could not find the page to create my own computer send me an exact link and I will check it out.

ovisopa

I uploaded now, and you can find it here, but remember it's just a test I start working today for this script and I didn;t done to many things on it, but anyway you cann find it here :
http://www.nokitel.ro/configurator.php

and pls don't press intel link (I didn't make it) try on amd ..

10x for help tomorow I'm gona look over the code you sent me, 10x again

Bye