cannot check the data provided by a form

scifo

I have a file which processes the data submitted by the form. I want to check whether the data submitted is identical to the data in mysql database so that if it is not the user corrects the form and submits it again. Here is the code which cannot check the data in submitted form:

<?php
global $HTTP_POST_VARS;
if (isset($HTTP_POST_VARS['mybutton'])) {
$Host = "";
$DBName = "";
$TableName = "patientsform";
$Link = mysql_connect ($Host, '', '');
if ($Link==false) {
echo mysql_errno().": ".mysql_error()." \n";
}
mysql_select_db ($DBName, $Link);
$Query1 = "SELECT Forename FROM patients WHERE Forename = {$HTTP_POST_VARS['forename']} AND Surname = {$HTTP_POST_VARS['surname']}";
//The query to check the data submitted
$Query = "INSERT INTO $TableName VALUES ('0', '{$HTTP_POST_VARS['forename']}')";
//The query to put the submitted data into the table

if (mysql_query ($Query1, $Link)) {
print "The query1 was successfully executed! \n";

if (mysql_query ($Query, $Link)) {
print "The query was successfully executed! \n";
}
else {
print "The query could not be executed! \n";
echo mysql_errno().": ".mysql_error()." \n";
}

}
else {
print "The query1 could not be executed! \n";
echo mysql_errno().": ".mysql_error()." \n";
}

mysql_close($Link);
} //end of isset function

else {
echo "you must have come here from somewhere else.\n";
}

vornn

One of the ways I check things is to echo everything to the screen, so I can see what is happening.

Make the query names different, not query and query1, type user_submitted_query and database_extraction_query, this will help keep the code readable.

Here's what I use:


$query = "SELECT * FROM messages WHERE message_id = '".$HTTP_GET_VARS['rev_id']."' LIMIT 1";


$result    = mysql_query($query) or die("Error: " . mysql_error());  

if(mysql_num_rows($result) == 0) 
   echo("Nothing to Display!"); 

//Loop to display the results
while ($row = mysql_fetch_array($result))
{
   //stuff
}

I carn't see where you script fetches the info from the database, but you haven't posted the whole script.

Hope this helps...

🙂

dalecosp

if (mysql_query ($Query1, $Link)) {

Most of the time, you want to assign this resource handle to a variable so you can continue to manipulate it later ...

if ($some_result=mysql_query ($Query1, $Link)) {

Now you have something ($some_result) that you can use in your comparisons later ...

HTH,