[Resolved] BEST PRACTICE for inserting data with a form??

ludachris

Ok - thanks to Paulnaj I have been coding my heart out and want to make some what of a 'control center' to view, sort, update, delete, etc. I have come to learn that some of these tutorials you read are in fact inproper or sometimes WRONG. I have done plent of searching and came across two different methods that seemed to be the most popular.

Which of these would be the better way to insert data? If neither of them is correct, can anyone point me in the direction of a 'proper' tutorial/manual.

Thanks in advance!
Chris Mace

http://ludachris.org/getadd.php

<?
if(isset($_GET['lo']))
{ 
echo('Your submission was successful.');
include("dbinf.inc.php");

mysql_connect($sqladdress,$username,$password) or die(mysql_error());
@mysql_select_db($database) or die(mysql_error());
$result=mysql_query('INSERT INTO los (los_id,fname,lname,branches_id,cel,email)' . 'VALUES ("'.$_GET['los_id'].'", "'.$_GET['fname'].'", "'.$_GET['lname'].'", "'.$_GET['branch'].'", "'.$_GET['cel'].'", "'.$_GET['email'].'")') or die(mysql_error());
}
else
{

?>
<form method='get' action='<? $PHP_SELF ?>'>
<TABLE>
<TR>
   <TD>LO#:</TD>
   <TD><INPUT TYPE='TEXT' NAME='los_id' VALUE='' size=60></TD>
</TR>
<TR>
   <TD>First Name:</TD>
   <TD><INPUT TYPE='TEXT' NAME='fname' VALUE='' size=60></TD>
</TR>
<TR>
   <TD>Last Name:</TD>
   <TD><INPUT TYPE='TEXT' NAME='lname' VALUE='' size=60>   </TD>
</TR>
<TR>
   <TD>Branch:</TD>
   <TD><INPUT TYPE='TEXT' NAME='branches_id' VALUE='' size=60>   </TD>
</TR>
<TR>
   <TD>Cel:</TD>
   <TD>
      <INPUT TYPE='TEXT' NAME='cel' VALUE='' size=60>
   </TD>
</TR>
<TR>
   <TD>E-Mail:</TD>
   <TD>
      <INPUT TYPE='TEXT' NAME='email' VALUE='' size=60>
   </TD>
</TR>
<TR>
   <TD><input type='hidden' name='lo' value='set'></TD><br>
   <TD><INPUT TYPE="submit" name="submit" value="submit"></TD> 
</TR>
</TABLE>
</form> 
<?
}
?>

http://ludachris.org/postadd.php

<?
if($_POST['submit'])
{
include("dbinf.inc.php");

mysql_connect($sqladdress,$username,$password) or die(mysql_error());
@mysql_select_db($database) or die(mysql_error());
$result=mysql_query('INSERT INTO los (los_id,fname,lname,branches_id,cel,email)' . 'VALUES ("'.$_POST['los_id'].'", "'.$_POST['fname'].'", "'.$_POST['lname'].'", "'.$_POST['branches_id'].'", "'.$_POST['cel'].'", "'.$_POST['email'].'")') or die(mysql_error());

mysql_close();

echo "Your submission was successful";
}
else
{
?>

<form method="post" action="<? $PHP_SELF ?>">
<TABLE>
<TR>
   <TD>LO#:</TD>
   <TD><INPUT TYPE='TEXT' NAME='los_id' VALUE='' size=60></TD>
</TR>
<TR>
   <TD>First Name:</TD>
   <TD><INPUT TYPE='TEXT' NAME='fname' VALUE='' size=60></TD>
</TR>
<TR>
   <TD>Last Name:</TD>
   <TD><INPUT TYPE='TEXT' NAME='lname' VALUE='' size=60>   </TD>
</TR>
<TR>
   <TD>Branch:</TD>
   <TD><INPUT TYPE='TEXT' NAME='branches_id' VALUE='' size=60>   </TD>
</TR>
<TR>
   <TD>Cel:</TD>
   <TD>
      <INPUT TYPE='TEXT' NAME='cel' VALUE='' size=60>
   </TD>
</TR>
<TR>
   <TD>E-Mail:</TD>
   <TD>
      <INPUT TYPE='TEXT' NAME='email' VALUE='' size=60>
   </TD>
</TR>
<TR>
   <TD></TD><br>
   <TD><INPUT TYPE="submit" name="submit" value="submit"></TD> 
</TR>
</TABLE>
</form>

<?
}
?>

lucasrd

I'd stick with the POST for any sensitive data....use the GET when you need to pass variables off of links, such as a record id or things of that nature...

paulnaj

Hi,

Just thought I'd poke in ... still be wary about POST variables for sensitive data ... they're just as accessible as GET variables, they just don't show in the address bar.

Also, validate the data. So if you expect a number for a particular field, then...

if(!is_numeric($GET['num_field'])){
die('['.$GET['num_field'].'] is not numeric!');
}

... or if you expect a definite range of values ...

if(!in_array($GET['choice_field']), $choices){
die('['.$GET['choice_field'].'] is not a valid choice!');
}

You should validate every field because of what are called 'SQL injection attacks', where nasty people send crafty SQL strings to mess up or steal your data. Have a look at this article for a very clear description of the issue.

Paul 🙂

leatherback

Paul:

Good link!

ludachris

Wow, good to know. I was going to use a javascript to validate the fields as I did HERE - would that be the same concept? I am still going to use the validation methods that you posted just for extra security as well. The javascript will be more for 'looks' for the user.

Also a plus - I am using 1and1.com and you cannot run any MySQL queries unless it is from within your domain. (doesnt really apply to this situation because they would be coming from my domain)

So in a nutshell; POST is the best way (with security precautions). Feel free to put up any other info 😃

Thanks again!!

lucasrd

Javascript is a good way to validate, but you should still do it on the server-side since there are browser settings that disable Javascript...

paulnaj

Hi Chris,

Glad to see you're getting along nicely!!

I was going to use a javascript to validate the fields as I did HERE - would that be the same concept?

... Same concept, but used for a different reason.

The javascript validation is good for the user ... he won't have to wait for a response from the server to know (s)he's made a mistake ... but this depends onthe user having javascript turned on (this has been an issue with some corporate clients of mine). This is optional.

But, the PHP validation is to stop malicious attacks and, as a bonus, can check the user's input at the same time. This is not optional.

Regards POST and GET ... remember, there is no difference, security-wise, between them.

Paul 🙂

ludachris

So far this community has been nothing but extremely helpful. I have said "thanks" more than anything, so....

Thanks again!!