[Resolved] Form validation help

n00854180t

Not sure how to do this. I have three functions that will validate a string for allowed input (alpha, alphanum, num). I am just not sure how to make it so that if they haven't submitted the form or there is an error, the form is displayed, otherwise (no error and they submit) the rest of the script is executed.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>


<body>

<?php
session_start();
include('functions.php');

$error = 0;
$firsttime = 1;



$_SESSION['cartid'] = GetCartId();
$_SESSION['table'] = $_GET['table'];
$_SESSION['country'] = $_GET['country'];

$conn = pg_connect("dbname=regrowth") or die("Couldn't Connect ".pg_last_error());  

$cartpsql = "SELECT * FROM cart INNER JOIN " . $_SESSION['table']. " ON cart.itemid = " . $_SESSION['table'] . ".itemid WHERE cart.cookieid = '" . GetCartId() . "' ORDER BY " . $_SESSION['table']. ".itemid ASC"; 

$result = pg_query($cartpsql) or die(pg_last_error());
$aresult = pg_query($cartpsql) or die(pg_last_error());

if(!checkFieldAlpha($_POST['usrfname'])){
$usrfname_err = "Please use only alphabetic characters.";
$usrfname = $_POST['usrfname'];
$error++;
}


$mailto = "dodorius@earthlink.net";
$secmail = $_POST['usremail'];



$headers =  "From: Orders\n";


$subjectnull = "";



$subjectc = "Your Regrowth, LLC Order";
[mailmessage]	  

if(!$submit || $error != 1 && $firsttime = 0){
$firsttime = 0;
?>

[form]


<?php

} else {
$firsttime - 1;

if($_POST['ordtype'] == "cc"){


$mail1 = mail($mailto, $subjectnull, $message, $headers);

$mail2 = mail($secmail, $subjectc, $cusmessage, $headers);

if ($mail1)
{
echo "<font face='verdana' size='3'>Your order has been sent sucessfully.</font><br><br><br>";
echo "<a href='http://www.neogal.com'><font face='verdana'>Click here to return to the website.</font></a><br><br>";
echo "<font face='verdana'>------------------Your Order------------------<br><br><br>";		   

			   		while ($arow = pg_fetch_array($aresult)){
  						  echo "<font face='verdana'>Product Name: " . $arow['itemname'] . "<br>";
  					echo "Product Price: " . $arow['itemprice'] . "<br>";
  			  echo "Quantity: " . $arow['qty'] . "<br><br>";
  		}


	echo $_SESSION['regORrec'] . $_SESSION['rORrPrice'] . $_SESSION['ifbr'];
if ($_SESSION['irowrate'] != ""){
echo "Insurance: $" . $_SESSION['irowrate'] . "<br>";
}

echo "Shipping: $" . $_SESSION['shipping'] . "<br>";
	  echo "TOTAL: $" . $_SESSION['fintotal'] . "<br></font>";


$killsess = GetCartId();
$sql = "DELETE FROM cart WHERE cookieid='" . $killsess . "'";
$kresult = pg_query($sql);
$_SESSION = array();
session_unset();
session_destroy();

} else {
echo "There was an error, please contact us at [email]regrowth@minoxidil.com[/email] .";
}
}


/************************************
********** Print Phone Order ********
*/

if($_POST['ordtype'] == "phone"){


echo '<font face="verdana" size="5">Phone Order Form</font><font face="verdana"><br>';
	 echo "<br><br>";
	  echo "Instructions:  To complete your order call (562) 696-2700 and speak with the operator.<br>";
	 	   echo "------------------Your Order------------------<br><br><br>";		   

			   		while ($arow = pg_fetch_array($aresult)){
  						  echo "Product Name: " . $arow['itemname'] . "<br>";
  					echo "Product Price: " . $arow['itemprice'] . "<br>";
  			  echo "Quantity: " . $arow['qty'] . "<br><br>";
  		}

	echo $_SESSION['regORrec'] . $_SESSION['rORrPrice'] . $_SESSION['ifbr'];
if ($_SESSION['irowrate'] != ""){
echo "Insurance: $" . $_SESSION['irowrate'] . "<br>";
}

echo "Shipping: $" . $_SESSION['shipping'] . "<br>";

  echo "TOTAL: $" . $_SESSION['fintotal'] . "<br>";

$killsess = GetCartId();
$sql = "DELETE FROM cart WHERE cookieid='" . $killsess . "'";
$kresult = pg_query($sql);
$_SESSION = array();
session_unset();
session_destroy();
}


// If they selected to mail their order:
if($_POST['ordtype'] == "mail"){


echo '<font face="verdana" size="5">Mail Order Form</font><font face="verdana"><br>';
	 echo "<br><br>";
	 	  echo "Instructions:  To complete your order please print this order form and mail it with check or money order to:<br><br> <b>Regrowth, LLC<br> 7049 Greenleaf Ave.<br> Whittier, CA 90602</b><br><br><br>";

			   echo "------------------Your Order------------------<br><br><br>";		   

			   		while ($arow = pg_fetch_array($aresult)){
  						  echo "Product Name: " . $arow['itemname'] . "<br>";
  					echo "Product Price: " . $row['itemprice'] . "<br>";
  			  echo "Quantity: " . $arow['qty'] . "<br><br>";
  		}
		echo $_SESSION['regORrec'] . $_SESSION['rORrPrice'] . $_SESSION['ifbr'];
if ($_SESSION['irowrate'] != ""){
echo "Insurance: $" . $_SESSION['irowrate'] . "<br>";
}

echo "Shipping: $" . $_SESSION['shipping'] . "<br>";

  echo "<b>TOTAL: $" . $_SESSION['fintotal'] . "</b><br>";

  $killsess = GetCartId();
$sql = "DELETE FROM cart WHERE cookieid='" . $killsess . "'";
$kresult = pg_query($sql);
$_SESSION = array();
session_unset();
session_destroy();
	  }
}

?>

tbach2

FWIW, the way I would do it involves rethinking the big picture.

cleanse variables
test conditions and take actions
default output (form)

your function for cleansing variables, checkFieldAlpha(), could accept another boolean parameter, "$required field". That way if a variable is empty, it can set global $formComplete to false.

In step 2, check for what kind of submission it is, check your required variable flag, and take appropriate action. If you don't want the default output, just die; at the end of the condition.

pseudocode:

// init global variables
$formComplete = true;

// cleanse all user inputed variables
// assume that  checkField...() sets $formComplete to false if no var value

checkFieldAlpha($_POST['usrfname'],true);

// woops, not sure how these fit in...
$_SESSION['cartid'] = GetCartId();
$_SESSION['table'] = $_GET['table'];  // looks like a security issue...
$_SESSION['country'] = $_GET['country'];

// etc.

// now test results of user submission
// I'm assuming the actions are exclusive.

if($_POST['ordtype'] == "cc" && $formComplete){ 
     // [cc action/output]
     die;
}

if($_POST['ordtype'] == "phone" && $formComplete){ 
     // [phone action/output]
     die;
}

if($_POST['ordtype'] == "mail" && $formComplete){
     // [mail action/output]
     die;
}


// end of submission possibilities; display default form
?>
[form]

HTH

n00854180t

Thanks! I just wasn't really sure how to go about the whole thing.

The table thing might be a security issue, but the only other table they will ever see is the other product list (USA and Foreign) so I am not too concerned. If they substitute one for the other they will just get a different list. The other tables in my db are never displayed. I think I will md5() it anyway though.