PHP_SELF takes me to Unauthorised Page

[jmshillito]

I am a newcomer to PHP, and have cobbled together with help from your forums a MYSQL database of students at school. We want to use a web interface to issue merits to students - it works, except for the final page, where the teacher must check merits issued and delete errors. On my local machine (laptop) the code works using Apache server. On the Win2000 server, I'm running PHP over IIS.

Here's the code:

<?php
session_start();
if(!$SESSION['loggedin'] || !isset($SESSION['loggedin']))
{echo 'Sorry, you do not have access to this page. <a href="mer_index.php">Home page</a>';die();};
?>

<form action="<?PHP echo $SERVER["PHP_SELF"]; ?>" method="POST">
<?php
$back = '<a href="javascript:history.go(-4)">Add another</a>';
$login = '<a href="mer_index">Log out</a>';
$tname= $SESSION['teachername']; //issuing teacher
print "<b> $tname </b>";
print "</tr><br />\n";
require 'mer_connect.php';
$sql = mysql_query("select * from mer_merits where teachername = '$tname' and prt='1'") or die(mysql_error());
while ($row = mysql_fetch_assoc($sql)) {
print "<tr>\n";
print "\t<td><input type=\"checkbox\" name=\"delete[]\" value='" . $row['mID'] . "' /></td>\n";

echo $row["studentname"], chr(32);
echo $row["Tutgroup"], chr(32);
echo $row["meritdescription"], chr(32);

print "</tr><br />\n";
}
?>
<tr><td>&nbsp;</td><td><input name="deleteit" type="submit" value="Delete"></td></tr>
</form>
<?php
if (isset($POST ['deleteit'])) {
if (is_array($POST['delete'])) {
foreach ($_POST ['delete'] as $value) {
$del = "DELETE FROM mer_merits WHERE mID = '".$value."'";
mysql_query($del) or die('SQL error: '.mysql_error());
header("Location: ".$PHP_SELF);
}
} else {
echo "invalid data";
}
} else {
echo "Select a record and click delete, ";
}
echo " ".$back, " or ".$login;
?>

When I hit the DELETE button, instead of refreshing the page and showing the updated list (in mer_review.php), I get the following HTTP error - 403 You are not authorised to view this page. The URL has changed to http://localhost/merits/ (instead of http://localhost/merits/mer_review.php)
If I hit refresh in the browser, it displays the updated info;

Any ideas? Many thanks in advance

John

[matto]

call the page and view the source code. is the "action" attribute in the <form> tag empty? if so, perhaps the PHP version running on the server does not know $_SERVER['PHP_SELF'], try to use $PHP_SELF there.

[jmshillito]

When I choose the page where all students are listed, with a checkbox to delete (mer_review.php), this is the source code that appears:

<form action="/merits/mer_review.php" method="POST">
<b> John Shillito </b></tr><br />
<tr>
<td><input type="checkbox" name="delete[]" value='43' /></td>
Alecia Lumsden
11MJ 3 demonstrations of initiative exceeding expectations </tr><br />
<tr><td>&nbsp;</td><td><input name="deleteit" type="submit" value="Delete"></td></tr>
</form>
Select a record and click delete, <a href="javascript:history.go(-4)">Add another</a> or <a href="mer_index">Log out</a>

When I click DELETE, I go straight to the HTTP error page.

[jmshillito]

Rather than not finding SELF - could it be that the user (Teacher who is logged into session) is not being ercognised when the page refreshes?

if(!$SESSION['loggedin'] || !isset($SESSION['loggedin']))
{echo 'Sorry, you do not have access to this page. <a href="mer_index.php">Home page</a>';die();};
?>

I am not getting the above error, but when I tried to amend the code to add this:
<meta http-equiv=\"refresh\" content=\"1; URL=http://localhost/">

I DID get the "You do not have access" error.

Do I need to somehow refresh the user credentials when it goes back to SELF - and if so, how?

Thanks

John