Verifying form entries

[gdogfunk]

Hello,

I have created a guestbook in PHP from scratch since the CGI version included with my web hosting package sucks. Everything works great, except that lately, people have been pressing the submit button without entering text in the text fields, thus emailing me a link to the page and there lies a blank entry. I'm getting tired of deleting the blanks and it dawned on me that there might be a way to require at least one field to have text or it won't popluate the database, but I don't have a clue how to do it. I have all of the fields NULL (except for the entry_ID), but I don't want the user to have to fill out every field either.

Can anyone tell me how to verify that at least one field has text or no submission?

Any help would be greatly appreciated!

Thanks!

Ryan

[Frederick]

Look here: empty()

Example

$name = $_POST["name"];
$email = $_POST["email"];
$contents = $_POST["contents"];
if (!get_magic_quotes_gpc()) {
	$contents = addslashes($contents);
} else {
	$contents = $contents;
}
if (empty($contents)) {
    // redirect if the person does not submit at least some content
    header("Location: postingpage.php");
} else {
    // process the submission here
}

[gdogfunk]

Thanks!

I looked into empty(), but I do not know enough about PHP to just throw it in there. Based on your example code, I'm a bit confused. Below is my code:

<?php 

mysql_connect ("xx.xxx.xx.xxx", "xxx", "xxx");

mysql_select_db (xxxxxxxxx);

$result = mysql_query ("SELECT * FROM agf_guestbook ORDER BY entry_id DESC

                     ");

if ($row = mysql_fetch_array($result)) {

do {
   print '<table border="0" cellspacing="5" cellpadding="0" style="color: #fff;">';

echo "<tr>\n";
echo "<td><b><font color='yellow'>Name: </b><a href='mailto:{$row ["email"]}'target='_blank'>{$row ["name"]}</a></font></td>\n";
echo "</tr>\n";
echo "<tr>\n";
                echo "<td><b><font color='yellow'>Location: </b></font><i>{$row ["location"]}</i></td>\n";
                echo "</tr>\n";
echo "<tr>\n";
echo "<td><b><font color='yellow'>URL: </b></font><a href='http://{$row ["site_url"]}'target='_blank'>{$row ["site_url"]}</a> </td>\n";
echo "</tr>\n";
echo "<tr>\n";
echo "<td><b><font color='yellow'>Comments: </b></font></td>\n";
                echo "</tr>\n";
echo "<tr>\n";
                echo "<td>{$row ["comments"]} </font></td>\n";
                echo "</tr>\n";
 echo "<tr>\n";
echo "<td><hr width='600'></td>\n";
echo "</tr>\n";


} while($row = mysql_fetch_array($result)); 

print "</table>";
} else {print "Not working...!";}

?>

In your code, what is get_magic_quotes_gpc()? What does the addslashes($contents); do? From your code it looks like it is just checking the "contents" field and not the others? I assume to verify all fields, I would just add a comma and then add the field name or variable name? I tried a couple of things, but I keep getting an error on line 56 indicating an unknown variable..which seems to be _POST. Any ideas?

Thanks again for your help!!

Ryan

[Frederick]

empty() checks if there are any values contained within the variables, does not check if the variable is present ( isset() ).
I will elaberate on my example:

$name = $_POST["name"]; 
$email = $_POST["email"]; 
$contents = $_POST["contents"];
// verify if any stated fields has empty values
if (empty($name) || empty($email) || empty($contents)) {
    // redirect to error message
} else {
    // check if magic_quote_gpc is On or Off
    if (!get_magic_quotes_gpc()) { 
        $contents = addslashes($contents); 
    } else { 
        $contents = $contents; 
    }
    // process the submission here
}

[gdogfunk]

Ok, it dawned on me that I should have the comments field as NOT NULL, therefore requireing a value. I thought might just do it, but nope. I still cannot figure out where to put your example. On the php document with the INSERT statement? If so, before, after? I've tried a few things, but keep getting parse errors: T_VARIABLE...

All I am trying to do is make sure someone has typed something in the "comments" field, otherwise refresh the page like nothing happened. If the comments field is required, but nothing else is, even if they fill everything else in except the comments field, then the page will just refresh like nothing happened.

I did some searching online and found a javascript example to check for empty fields before even calling the PHP, but that didn't seem to work either.

This seems like it should be easier that it is...or I just don't have a clue 🙂

Thanks!

Ryan

[gdogfunk]

Cool, I got it working with javascript before it touches the PHP! Thanks!

Ryan

[Frederick]

OK, 1 more time:

$name = $_POST["name"];  

$email = $_POST["email"];  

$contents = $_POST["contents"];

// verify if any stated fields has empty values 
if (empty($name) || empty($email) || empty($contents)) {

header("Location: error_page.php");

} else {

// check if magic_quotes_gpc is On or Off 
if (!get_magic_quotes_gpc()) {  
    $contents = addslashes($contents);  
} else {  
    $contents = $contents;  
}

// process the submission here
$sql = mysql_query("INSERT INTO table (name,email,contents) 
    VALUES ('$name','$email','$contents')
") or die (mysql_error());

header("Location: details_page.php");
}

[Frederick]

Problem is, if a person has java turned off, you will not get a verification on your fields.

[gdogfunk]

oh. Where exactly does your code get placed? The way I have it setup is that the post form calls a submit.php, which has the insert statement. Then the page says submission successful and refreshes the guestbook page showing the newest entry at the top of the page.

Can I use both the JS and your code or is that overkill?

Also, on a side note, the guestbook sends me an email with a notice of the new entry including a link to the page. I would like to go one step further and have it actually include the newest record entry. How might I go about that? I cannot seem to call the text of the new entry in the email.

Thanks

[Frederick]

<?php
$name = $_POST["name"];   

$email = $_POST["email"];   

$contents = $_POST["contents"]; 

// verify if any stated fields has empty values 
if (empty($name) || empty($email) || empty($contents)) { 

header("Location: error_page.php"); 

} else { 

// check if magic_quotes_gpc is On or Off 
if (!get_magic_quotes_gpc()) {   
	$contents = addslashes($contents);   
} else {   
	$contents = $contents;   
} 

// process the submission here 
$sql = mysql_query("INSERT INTO table (name,email,contents) 
	VALUES ('$name','$email','$contents') 
") or die (mysql_error());

// Grab last record input
$sql = mysql_query("SELECT * FROM table ORDER BY id DESC LIMIT 1") or die (mysql_error());
$row = mysql_fetch_array($sql);

## FORMAT EMAIL ##############################

// set email header
$header = "From: $name\n";
$header .= "MIME-Version: 1.0\n";
$header .= "Mailer: FCG Browser-Based Applications\n";
$header .= "Content-Type: text/plain; charset=\"iso-8859-1\"\n";

// set destination
$sendto = "$destination_address\n";

// set subject
$subject = "Enter and subject you want to display in subject area\n";

// build message
$message = "New guestbook posted on ".date("F j, Y")."\n";
$message .= "\n";
$message .= "http://domain.com/details_page.php?id=".$row["id"]."\n";

// send email
mail($sendto,$subject,$message,$header);

## END EMAIL ##################################
header("Location: details_page.php"); 
}
?>

[Roger_Ramjet]

Originally posted by gdogfunk

Can I use both the JS and your code or is that overkill?

Thanks

Definitely you can use both, and difintely you should. Using js on the page to check for required fields is a no-brainer: it saves server load processing faulty data and save users having to wait for a page load before being told to fill in the missing fields. Fredericks comment about having js turned off is valid, but far rarer then geeks tend to think. 98% of web users don't even know that js exists, let alone how to turn it off. And how exactly do you turn it off in IE, which 90%+ are still using? Javascript I mean not java machine.

That said, one should also ALWAYS validate user input on the target script. You need to worry about malicious content and sql injection attacks just as much as missing data.

So using both is the way to go always. Once you have a good js form validation function you will use it again and again so don't worry about the extra effort, it is well worth it. Likewise the php form validation that you need to be using.

[Roger_Ramjet]

Originally posted by gdogfunk

Also, on a side note, the guestbook sends me an email with a notice of the new entry including a link to the page. I would like to go one step further and have it actually include the newest record entry. How might I go about that? I cannot seem to call the text of the new entry in the email.

Thanks

I presume that you know how to get the entry from the form data, you must if you are doing a db insert. And I presume that you also know how to create the email headers etc and use the mail() function. What is probably messing you up is the need to rawurlencode the new entry data before adding it to the email body.

[gdogfunk]

Thanks for the reponse!

It's good to know that JS will work the majority of the time!

I have my entry form on the same page as the actual guestbook. On that page, I got the JS field verification to work on the "comments" field.

I tried using the code above on the guestbook page after the form (thinking that the $POST variables would be noticed on that page) but I keep getting errors... is something supposed to be in the code before the $name=$POST["name"];__I really am only trying to verify the "comments" field...so I removed the other verification fields.

I had this whole thing working fine, but the verification thing is throwing me. I had a simple email setup with a link back to the guestbook page, but the code above keeps getting errors right at the $name...line. So I don't even know how the rest of the code might perform.

Thanks for your help!

[Frederick]

Post the code you have for your submit page and the process page.

[gdogfunk]

I found another article online that was just a simple email feedback form, but it used _REQUEST to pass the variable to the other document, but did not involve posting data to a database. I thought I could get it working that way, but I couldn't get it. I assumed that if my form called the verify.php and then the verify.php called the guestbook_submt.php, I could get the verification...nope, at least not the way I was trying to do it.

Here's the entire page code for the guestbook and the process.

Thanks!

SUBMIT PAGE (guestbook.php)
<html>

<title>A Gruesome Find Guestbook</title>
<link href="../agf.css" rel="stylesheet" media="screen">
<script language="JavaScript" type="text/javascript">

// Javascript validation functions
// http://www.designplace.org/

//function to check empty fields

function isEmpty(strfield1, strfield2, strfield3) {

//change "field1, field2 and field3" to your field names
strfield1 = document.forms[0].comments.value

//comments field
if (strfield1 == "" || strfield1 == null || !isNaN(strfield1) || strfield1.charAt(0) == ' ')
{
alert("\"Comments\" is a mandatory field.\nPlease type something and try again.")
return false;
}

return true;

}

//function that performs all functions, defined in the onsubmit event handler

function check(form){
if (isEmpty(form.field1)){
return true;
}
return false;
}

</script>

<body bgcolor="black" alink="#f46088">
	<div align="center">
		<a name="top_anchor"></a><img src="/images/agf_fire_logo.jpg" alt="" height="213" width="313" border="0"><br>
		<br>
		<csobj occur="60" w="909" h="17" t="Component" csref="../../agf_minions_site.data/Components/agf_nav.html">
			<div align="center">
				<table width="657" border="0" cellspacing="0" cellpadding="0" cool gridx="16" gridy="16" height="17" showgridx showgridy usegridx usegridy>
					<tr height="16">
						<td cslocked content csheight="16" width="656" height="16" valign="top" xpos="0">
							<div align="center">
								<font color="white"><a href="../home.html">HOME</a> | <a href="../fire.html">FIRE</a> | <a href="../ravens.html">RAVENS</a> | <a href="news.php">NEWS</a> | <a href="reviews.php">REVIEWS</a> | <a href="interviews.php">INTERVIEWS</a> | <a href="../bios.html">BIOS</a> | <a href="links.php">LINKS</a> | <a href="shows.php">SHOWS</a> | <a href="http://agruesomefind.com/php/guestbook.php">GUESTBOOK</a> | <a href="../contact.html">CONTACT</a></font></div>
						</td>
						<td width="1" height="16"><spacer type="block" width="1" height="16"></td>
					</tr>
					<tr height="1" cntrlrow>
						<td width="656" height="1"><spacer type="block" width="656" height="1"></td>
						<td width="1" height="1"></td>
					</tr>
				</table>
			</div>
		</csobj><font face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular">
			<hr width="640">
		</font><font face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><br>
		</font></div>
	<div align="center">
		<table width="640" border="0" cellspacing="2" cellpadding="0">
			<tr>
				<td>
					<div align="center">
						<p><font size="1" color="yellow" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><b><u><i><a href="#entry_form">Sign Guestbook</a></i></u></b></font><font size="5" color="white" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><b><u><br>
									</u></b></font></p>
					</div>
					<table width="1%" border="0" cellspacing="0" cellpadding="0">
						<tr>
							<td colspan="3"><img src="../flame_top.jpg" alt="" width="640" height="118" border="0"></td>
						</tr>
						<tr>
			<td class="class_white_border_left" valign="top" width="15"><img src="../left_cell_10x1.gif" repeat-y alt="" width="10" height="1" border="0"></td>

			<td><?php 

mysql_connect ("xxxx", "xxxx", "xxxx");

mysql_select_db (xxxx);

$result = mysql_query ("SELECT * FROM agf_guestbook ORDER BY entry_id DESC

                     ");

if ($row = mysql_fetch_array($result)) {

do {
print '<table border="0" cellspacing="5" cellpadding="0" style="color: #fff;">';

echo "<tr>\n";
echo "<td><b><font color='yellow'>Name: </b><a href='mailto:{$row ["email"]}'target='blank'>{$row ["name"]}</a></font></td>\n";
echo "</tr>\n";
echo "<tr>\n";
echo "<td><b><font color='yellow'>Location: </b></font><i>{$row ["location"]}</i></td>\n";
echo "</tr>\n";
echo "<tr>\n";
echo "<td><b><font color='yellow'>URL: </b></font><a href='http://{$row ["site_url"]}'target='blank'>{$row ["site_url"]}</a> </td>\n";
echo "</tr>\n";
echo "<tr>\n";
echo "<td><b><font color='yellow'>Comments: </b></font></td>\n";
echo "</tr>\n";
echo "<tr>\n";
echo "<td>{$row ["comments"]} </font></td>\n";
echo "</tr>\n";
echo "<tr>\n";
echo "<td><hr width='600'></td>\n";
echo "</tr>\n";

} while($row = mysql_fetch_array($result));

print "</table>";
} else {print "Not working...";}

?></td>
<td class="class_white_border_right" repeat-y>
<div align="right">
<p><img src="../right_cell_10x1.gif" alt="" width="10" height="1" border="0"></p>
</div>
</td>
</tr>
<tr>
<td colspan="3"><img src="../flame_bottom.jpg" alt="" width="640" height="95" border="0"></td>
</tr>
</table>
</td>
</tr>
</table>
<table width="640" border="0" cellspacing="2" cellpadding="0">
<tr>
<td><a name="entry_form"></a>
<form action=http://www.agruesomefind.com/php/guestbook_submit.php method="post" name="theform" onSubmit="return check(this);">
<div align="center">
<table width="95%" border="0" cellspacing="2" cellpadding="0">
<tr>
<td class="sectionHeaderStyle" colspan="2"><font size="2" color="yellow" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><b><u><i>Guestbook Entry Form</i></u></b></font><font size="2" color="white" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><b><u><br>
<br>
</u></b></font></td>
</tr>
<tr>
<td class="tableRowHeaderStyle" colspan="1" width="150">
<div align="left">
<font size="2" color="white" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><b>Name</b></font></div>
</td>
<td class="tableRowStyle" colspan="1"><input type="text" name="name" size=30 maxlength=80> &nbsp;</td>
</tr>
<tr>
<td class="tableRowHeaderStyle" colspan="1" width="150">
<div align="left">
<font size="2" color="white" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><b>Email </b></font></div>
</td>
<td class="tableRowStyle" colspan="1"><input type="text" name="email" size=30 maxlength=80> &nbsp;</td>
</tr>
<tr>
<td class="tableRowHeaderStyle" colspan="1" width="150">
<div align="left">
<font size="2" color="white" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><b>Location </b></font></div>
</td>
<td class="tableRowStyle" colspan="1"><input type="text" name="location" size=30 maxlength=80> &nbsp;</td>
</tr>
<tr>
<td class="tableRowHeaderStyle" colspan="1" width="150">
<div align="left">
<font size="2" color="white" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><b>URL (no [url]http://[/url])</b></font></div>
</td>
<td class="tableRowStyle" colspan="1"><input type="text" name="site_url" size=30 maxlength=80></td>
</tr>
<tr>
<td class="tableRowHeaderStyle" colspan="1" valign="top" width="150">
<div align="left">
<font size="2" color="white" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><b>Comments</b></font></div>
</td>
<td class="tableRowStyle" colspan="1"><textarea name="comments" rows=6 cols=75 wrap="VIRTUAL"></textarea></td>
</tr>
</table>
<font size="2" color="white" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular"><b><br>
<input type=submit name="" value="Sign Guestbook"></b></font></div>
</form>
</td>
</tr>
</table>
<br>
<hr width="640">
<a href="#top_anchor">Back to Top</a></div>
</body>

</html>

PROCESS page (guestbook_submit.php)

<html>
<link href="../agf.css" rel="stylesheet" media="screen">
<head>
<meta http-equiv="refresh" content="0;URL=http://www.agruesomefind.com/php/guestbook.php">
</head>
<body bgcolor="#000011" text="white">
<div align="left">
<?php

mysql_connect ("xxxx", "xxxx", "xxxx");

mysql_select_db (xxxx);

$sql = mysql_query ("INSERT INTO agf_guestbook (name, email, location, site_url, comments)
VALUES ('$name', '$email', '$location', '$site_url', '$comments')
");

print ("Guestbook entry successful");

?><?php mail("[e-mail]", "Guestbook Addition", "There is a new guestbook entry! Go check it out! http://www.agruesomefind.com/php/guestbook.php"); ?></div>
</body>
</html>

[Frederick]

REQUEST is the same as GET and POST but works for both. When coding, it is better to not use REQUEST when posible because using GET and POST allows you to know where the values are coming from (source view wise).

POST are items coming from the browsers header (unseen).
GET are items coming from your address field of your browser.

[gdogfunk]

Ok, here's what I have done. I took your code from above and put my info in (below) and called it submit.php. From the guestbook.php, the form calls submit.php...it seems that everything should work well, but I keep getting this parse error:

Parse error: parse error, unexpected T_STRING in /hsphere/local/home/agfagf/agruesomefind.com/php/submit.php on line 10

Well, line 10 is if(empty($comments)){_

I can't figure out what's wrong. Do I need any other files to verify the contents? It seems that this should work going from guestbook.php to submit.php and if the comments field is empty, then go to error.php...any ideas?

Thanks!

<?php
$name = $POST['name'] ;
$email = $POST['email'] ;
$location = $POST['location'] ;
$site_url = $POST['site_url'] ;
$comments = $POST['comments'] ;

// verify if any stated fields has empty values
if(empty($comments)){_

___header("Location: error.php");

}else{_

_// check if magic_quotes_gpc is On or Off
if(!get_magic_quotes_gpc()){
___$comments=addslashes($comments);
_}else{
_____$comments=$comments;
___}

_// process the submission here
$sql=_mysql_connect ("xxx", "xxx", "xxx");

mysql_select_db (agfagf_vileart_distro);

$sql = mysql_query ("INSERT INTO agf_guestbook (name, email, location, site_url, comments)
VALUES ('$name', '$email', '$location', '$site_url', '$comments')
");

print ("Guestbook entry successful");

---

_// Grab last record input
$sql=mysql_query("SELECT * FROM agf_guestbook ORDER BY entry_id DESC LIMIT 1")or_die(mysql_error());
__$row=_mysql_fetch_array($sql);

---

____## FORMAT EMAIL ##############################

---

_// set email header
$header="From:$[e-mail]\n";
_$header.="MIME-Version: 1.0\n";
$header.="Mailer: FCG Browser-Based Applications\n";
__$header.=_"Content-Type: text/plain; charset=\"iso-8859-1\"\n";

---

_// set destination
$sendto=_"$[e-mail]\n";

---

_// set subject
$subject=_"Enter and subject you want to display in subject area\n";

---

_// build message
$message="New guestbook posted on ".date("F j, Y")."\n";
$message.="\n";
$message.=_"http://www.agruesomefind.com/php/guestbook.php?id=".$row["entry_id"]."\n";

---

_// send email
_mail($sendto,$subject,$message,$header);

---

_## END EMAIL ##################################
header("Location: guestbook.php");
}

?>