simple form input to database problem...or is it?

madhavr

ive had two seperate occasions both where forms were made to insert data from a form into a table in the database. both times im experiencing similar behaviour of the form. basically when i press submit the form simply reloads or seems like its clearing itself giving no indication whether an input is made or not even when there was coded instruction asking the script to display some indication in either case.

the code for the present form is below, please note it was adapted from a book:



 <html>
 <head>
 <title>Listing 12.3 Adding user input to a database</title>
 </head>
 <body>
 <?php


 if ( isset( $firstname ) && isset( $surname ) )
 {
 // check user input here!
 $dberror = "";
 $ret = add_to_database( $firstname, $surname, $dberror );
 if ( ! $ret )
 print "Error: $dberror<BR>";
 else
 print "Thank you very much";
 }
 else {
 write_form();
 }

 function add_to_database( $firstname, $surname, $dberror )
 {
 $user = "root";
 $pass = "";
 $db = "test";
 $link = mysql_pconnect( "localhost", $user, $pass );
 if ( ! $link )
 {
 $dberror = "Couldn't connect to MySQL server";
 return false;
 }
 if ( ! mysql_select_db( $db, $link ) )
 {
 $dberror = mysql_error();
 return false;
 }
 $query = "INSERT INTO landlord ( LandlordFirstname, LandlordSurname )
 values( '$firstname', '$surname' )";
 if ( ! mysql_query( $query, $link ) )
 {
 $dberror = mysql_error();
 return false;
 }
 return true;
 }

 function write_form()
 {
 global $PHP_SELF;
 print "<form action=\"$PHP_SELF\" method=\"POST\">\n";
 print "<input type=\"text\" name=\"firstname\"> ";
 print "Your name<p>\n";
 print "<input TYPE=\"text\" name=\"surname\"> ";
 print "Your surname<p>\n";
 print "<input type=\"submit\" value=\"submit!\">\n</form>\n";
 }
 ?>
 </body>
 </html>

please let me know what you think thanks

could the problem be something in my php config file??

cgraz

Are you running your own server? PHP sets register globals to off by default. Taht means you would need to change all your form variables from

$var_name

$_POST['var_name']

Do that all through your script, then try again.

Cgraz

madhavr

would it not be easier just to turn globals on in the php.ini file???

also when you meant ....
$_POST['var_name']
is that for only when decalring variables?

thanks

madhavr

hi mate ,

it does work with register_global = On in the ini file

but i wanted to ask for an intranet setup not a website is this still safe??

i think the server might also have access to the internet as well but is there a standard practice to ensure variables are secure when register_globals is on?

thanks