Securing a form

[bengt]

Hello it's me again...

I have this form, with a subform.
The information in the subform can be stored without storing the main form. My problem is that I havent completely managed to foolproof the use of the form.

There must be at least 1 entry in the subform before the mainform is stored. This entry can be stored along with the mainform.

And I'm stuck... My coding is poor, as the noob I am. So any help would be appreciated.

[bengt]

Here the checkin should be done when storing the mainform

if (isset($_POST['submit'])) { 
    // user has finished, do whatever you want with the 
    // submitted data 

//Sjekker skiftdata
$fra = $fraar.$framnd.$fradag.$fratime.$framin."00";
$til = $tilar.$tilmnd.$tildag.$tiltime.$tilmin."00";

if (!$fradag or !$framnd or !$fraar or !$fratime or !$framin or !$tildag or !$tilmnd or !$tilar or !$tiltime or !$tilmin OR !$antmannsk) {
	$ikkenyttskift = 1;
}
if ((!$fradag or !$framnd or !$fraar or !$fratime or !$framin or !$tildag or !$tilmnd or !$tilar or !$tiltime or !$tilmin) AND !$ikkenyttskift) {
	echo "<p class=error>Dato/klokkeslett for fra og til må fylles ut</p>";
	$error = 1;
}
if ( $fra > $til AND !$ikkenyttskift ) {
	echo "<p class=error>Fra dato/kl må være <b><i>før</i></b> Til dato/kl</p>";
	$error = 1;
}
if (!$antmannsk AND !$ikkenyttskift) {
	echo "<p class=error>Antall mannskaper må fylles ut.</p>";
	$error = 1;
}

//Skjekker vaktdata
if (!$arrangement or !$typeid or !$stedid) {
	echo "<p class=error>Arrangement, type og sted må fylles ut.</p>";
	$error = 1;
}


//Legger inn vaktdata og evt siste skift...
if (!$error) {
	if (!$ikkenyttskift) {
		$sql = "/*Storing*/";
		$result = mysql_query($sql);
	} else {
		$til = $tiltmp;
	}

	if (!$fratmp) {
		$fratmp = $fra;
	} else {
		$fratmp = $fratmp;
	}

	$sql = "/*Storing*/)";
	$result = mysql_query($sql) or die(mysql_error());
	echo "vakt er lagret.";
}

[bengt]

The form

If (isset($_POST['add']) or !$trac or $error) {
	echo "<form method=post>";
	if ($fratmp) {
		echo "<input type=hidden name=fratmp value=\"".$fratmp."\">";
	}
	echo "<input type=hidden name=tiltmp value=\"".$til."\">";
	if (!$tmpvaktid) {
		echo "<input type=hidden name=tmpvaktid VALUE=\"".$vid."\">";
	} else {
		echo "<input type=hidden name=tmpvaktid VALUE=\"".$tmpvaktid."\">";
	}
	echo "<input type=hidden name=lagid VALUE=\"".$lagid."\"><input type=hidden name=trac VALUE=\"1\">";
	echo "<table width=500 align=center>";
	echo "<tr><td colspan=2><font color=red><b>*</b></font> - MÅ fylles ut.</td></tr>";
	echo "<tr class=formhead><td colspan=2 align=center>Generelle opplysninger</td></tr>";
	echo "<tr class=form2><td align=right>Arrangement: <font color=red><b>*</b></font> </td><td><input type=text name=arrangement value=\"".$arrangement."\"></td></tr>";
	echo "<tr class=form><td align=right>Type vakt: <font color=red><b>*</b></font></td><td>";
	$sql = "SELECT * FROM type WHERE lagid = '".$lagid."'";
	$result = mysql_query($sql);
	echo "<select name=typeid><option>Velg type vakt</option>";
	while ($type = mysql_fetch_array($result)) {
		echo "<option value=\"".$type[id]."\"";
		if ($typeid == $type[id]) { echo " SELECTED"; }
		echo ">".$type[type]."</option>";
	}
	echo "</select></td></tr>";
	echo "<tr class=form2><td align=right>Sted: <font color=red><b>*</b></font></td><td>";
	$sql = "SELECT * FROM sted WHERE lagid = '".$lagid."'";
	$result = mysql_query($sql);
	echo "<select name=stedid><option>Velg sted</option>";
	while ($type = mysql_fetch_array($result)) {
		echo "<option value=\"".$type[id]."\"";
		if ($stedid == $type[id]) { echo " SELECTED"; }
		echo ">".$type[sted]."</option>";
	}
	echo "</select></td></tr>";
	echo "<tr class=form><td align=right valign=top>Info: </td><td><textarea cols=30 rows=5 name=info>".$info."</textarea></td></tr>";
	echo "<tr class=form><td align=right>Ansvarlig hos kunde:</td><td><input type=text name=ansvkunde value=\"".$ansvkunde."\"></td></tr>";
	echo "<tr class=form2><td align=right>Rapport:</td><td><input type=checkbox name=rapport value=1 class=blank";
	if ($rapport) { echo " checked=checked"; }
	echo "> <img src=\"images/hjelp.gif\" alt=\"Hjelp\" onclick=\"javascript:open_new_window('hjelp.htm#rapport');\" style=\"cursor: hand\"></td></tr>";
	echo "<tr class=form><td align=right>Sanitetsvakt:</td><td><input type=checkbox name=sanitet value=1 class=blank";
	if ($sanitet) { echo " checked=checked"; }
	echo "> <img src=\"images/hjelp.gif\" alt=\"Hjelp\" onclick=\"javascript:open_new_window('hjelp.htm#sanitet');\" style=\"cursor: hand\"></td></tr>";
	echo "<tr class=form2><td align=right>Vakt lagt inn av:</td><td><input type=hidden name=authorid value=\"".$u[id]."\">".$u[etternavn].", ".$u[fornavn]."</td></tr>";
	echo "<tr class=form><td align=right>Vakt lagt inn den:</td><td><input type=hidden name=dato value=\"".str_pad($curryear,4,0,STR_PAD_LEFT).str_pad($currmonth,2,0,STR_PAD_LEFT).str_pad($currday,2,0,STR_PAD_LEFT).str_pad($currhour,2,0,STR_PAD_LEFT).str_pad($currmin,2,0,STR_PAD_LEFT)."00\">".$currday."/".$currmonth."-".$curryear." kl. ".str_pad($currhour,2,0,STR_PAD_LEFT).":".str_pad($currmin,2,0,STR_PAD_LEFT)."</td></tr>";



echo "<tr class=formhead><td colspan=2 align=center>Skift/tidspunkter/ressursbehov  <img src=\"images/hjelp.gif\" alt=\"Hjelp\" onclick=\"javascript:open_new_window('hjelp.htm#skift');\" style=\"cursor: hand\"></td></tr>";
	if ($tmpvaktid) {
	echo "<tr><td colspan=2>
	<table width=100%>
		<tr class=formhead>
		<td>ID</td>
		<td width=120>Fra</td>
		<td width=120>Til</td>
		<td>Mannskap</td>
		<td>Hospitant</td>
		<td>Biler</td>
		</tr>";
	$skiftsql = "SELECT *,DATE_FORMAT(fra, '%d/%m-%Y %H:%i')as dfra,DATE_FORMAT(til, '%d/%m-%Y %H:%i')as dtil FROM skift WHERE vaktid = '".$tmpvaktid."' ORDER BY id ASC";
	$skiftresult = mysql_query($skiftsql);
	while ($skiftdata = mysql_fetch_array($skiftresult)) {
		echo "
		<tr class=form>
		<td>$skiftdata[id]</td>
		<td width=120>$skiftdata[dfra]</td> 
		<td width=120>$skiftdata[dtil]</td>
		<td>$skiftdata[antmannsk]</td>
		<td>$skiftdata[hospitanter]</td>
		<td>$skiftdata[antbiler]</td>
		</tr>";
	}


	echo "</table></td></tr>";
}
echo "<tr class=form2><td align=right>Fra dato/kl: <font color=red><b>*</b></font></td><td>";
echo "<select name=fradag><option value=0>Dag</option>";
$maned = array(1 => 'januar', 'februar', 'mars', 'april', 'mai', 'juni', 'juli', 'august', 'september', 'oktober', 'november', 'desember');
for($i=1;$i<32;$i++) { 
	$i = $i;
	echo "<option value=\"".str_pad(($i),2,0,STR_PAD_LEFT)."\""; 
	if($fradag == str_pad(($i),2,0,STR_PAD_LEFT)) { 
	echo(" selected"); 
	} 
	echo(">".str_pad(($i),2,0,STR_PAD_LEFT)); 
}
echo "</select>";
echo " <select name=framnd><option value=0>Måned</option>";
for($i=1;$i<13;$i++) { 
	$i = $i;
	echo "<option value=\"".str_pad(($i),2,0,STR_PAD_LEFT)."\""; 
	if($framnd == str_pad(($i),2,0,STR_PAD_LEFT)) { 
	echo(" selected"); 
	} 
	echo(">".$maned[$i]); 
}
echo "</select>";

echo " <Select name=fraar><option value=0>År</option>";
for($i=2004;$i<2010;$i++) { 
	$i = $i;
	echo "<option value=\"".$i."\""; 
	if($fraar == $i) { 
	echo(" selected"); 
	} 
	echo(">".$i); 
}
echo "</select> - ";
echo " <Select name=fratime><option value=0>Time</option>";
for($i=1;$i<25;$i++) { 
	$i = $i;
	echo "<option value=\"".str_pad(($i),2,0,STR_PAD_LEFT)."\""; 
	if($fratime == str_pad(($i),2,0,STR_PAD_LEFT)) { 
	echo(" selected"); 
	} 
	echo(">".str_pad(($i),2,0,STR_PAD_LEFT)); 
}
echo "</select> ";
echo " <Select name=framin><option>Min</option>";
for($i=0;$i<60;$i++) { 
	$i = $i;
	echo "<option value=\"".str_pad(($i),2,0,STR_PAD_LEFT)."\""; 
	if($framin == str_pad(($i),2,0,STR_PAD_LEFT)) { 
	echo(" selected"); 
	} 
	echo(">".str_pad(($i),2,0,STR_PAD_LEFT)); 
}
echo "</select></td></tr>";
echo "<tr class=form><td align=right>Til dato/kl: <font color=red><b>*</b></font></td><td>";
echo "<select name=tildag><option value=0>Dag</option>";
$maned = array(1 => 'januar', 'februar', 'mars', 'april', 'mai', 'juni', 'juli', 'august', 'september', 'oktober', 'november', 'desember');
for($i=1;$i<32;$i++) { 
	$i = $i;
	echo "<option value=\"".str_pad(($i),2,0,STR_PAD_LEFT)."\""; 
	if($tildag == str_pad(($i),2,0,STR_PAD_LEFT)) { 
	echo(" selected"); 
	} 
	echo(">".str_pad(($i),2,0,STR_PAD_LEFT)); 
}
echo "</select>";
echo " <select name=tilmnd><option value=0>Måned</option>";
for($i=1;$i<13;$i++) { 
	$i = $i;
	echo "<option value=\"".str_pad(($i),2,0,STR_PAD_LEFT)."\""; 
	if($tilmnd == str_pad(($i),2,0,STR_PAD_LEFT)) { 
	echo(" selected"); 
	} 
	echo(">".$maned[$i]); 
}
echo "</select>";

echo " <Select name=tilar><option value=0>År</option>";
for($i=2004;$i<2010;$i++) { 
	$i = $i;
	echo "<option value=\"".$i."\""; 
	if($tilar == $i) { 
	echo(" selected"); 
	} 
	echo(">".$i); 
}
echo "</select> - ";
echo " <Select name=tiltime><option value=0>Time</option>";
for($i=1;$i<25;$i++) { 
	$i = $i;
	echo "<option value=\"".str_pad(($i),2,0,STR_PAD_LEFT)."\""; 
	if($tiltime == str_pad(($i),2,0,STR_PAD_LEFT)) { 
	echo(" selected"); 
	} 
	echo(">".str_pad(($i),2,0,STR_PAD_LEFT)); 
}
echo "</select> ";
echo " <Select name=tilmin><option value=0>Min</option>";
for($i=0;$i<60;$i++) { 
	$i = $i;
	echo "<option value=\"".str_pad(($i),2,0,STR_PAD_LEFT)."\""; 
	if($tilmin == str_pad(($i),2,0,STR_PAD_LEFT)) { 
	echo(" selected"); 
	} 
	echo(">".str_pad(($i),2,0,STR_PAD_LEFT)); 
}
echo "</select></td></tr>";
echo "<tr class=form2><td align=right>Antall mannskaper: <font color=red><b>*</b></font> </td><td><input type=text name=antmannsk value=\"".$antmannsk."\"> <img src=\"images/hjelp.gif\" alt=\"Hjelp\" onclick=\"javascript:open_new_window('hjelp.htm#antmannsk');\" style=\"cursor: hand\"></td></tr>";
echo "<tr class=form><td align=right>Antall hospitanter:</td><td><input type=text name=hospitanter value=\"".$hospitanter."\"> <img src=\"images/hjelp.gif\" alt=\"Hjelp\" onclick=\"javascript:open_new_window('hjelp.htm#hospitanter');\" style=\"cursor: hand\"></td></tr>";
echo "<tr class=form2><td align=right>Antall biler:</td><td><input type=text name=antbiler value=\"".$antbiler."\"> <img src=\"images/hjelp.gif\" alt=\"Hjelp\" onclick=\"javascript:open_new_window('hjelp.htm#antbiler');\" style=\"cursor: hand\"></td></tr>";
echo "<tr><td colspan=2 align=center><input type=submit name=add class=button value=\"Legg til nytt skift\"> <input type=submit name=submit class=button value=\"Lagre, og avslutt\"></td></tr>";
echo "</table></form>";



}

[BSTRhino]

bengt, you would get more help if your question was more specific.