Forms and sessions

Tezread

Ive had a good look round the forum and the archives about multipage sessions and forms.

I now have a six part form with the following code on the top of each page:

<?php 
session_start(); 
foreach($_POST as $key => $val) 
{ 
$_SESSION[$key] = $val; 
} 
?>

Trouble is my database is not populated and im not getting and error message to help me out. Can anyone help me out?

Roger_Ramjet

You really need to show the code that adds, or tries to add, the data to the database.

While you are at it, that is a fairly normal and very vulnerable way to handle user input. READ THIS ON SQL INJECTION ATTACKS and then build the 'best practice' code into your current code

session_start(); 
foreach($_POST as $key => $val) 
{ 
$_SESSION[$key] = quote_smart($val);    

// quote_smart is the 'best practice' function you have to include, it is NOT built into php
}  

// now have a look at what is there

foreach($_SESSION as $key=>$val) {
   echo $key . ' = ' . $val . '<br />';
}

Tezread

Thx for the security tip. Here is the code for my form handler. At the moment part 1 is posted to part 2 of the form: e.g:

and so on till you get to the following form hander. not ive taken off some of the posts below because there were too many fields to fit ni this post!


<?php
error_reporting(E_ALL); 
ini_set('display_errors', '1'); 
$user = "mindseye";
$host = "cpp1.viper.enta.net";
$password = "qwerty11";
$connection = @mysql_connect($host, $user, $password)
or die ("Couldn't connect to server.");
$database = "mindseye";
$db = @mysql_select_db($database, $connection)
or die ("Couldn't select database.");

if (isset($_POST['Submit'])) {
//insert the values entered into the courseentry form into the database

$contact = $_POST['contact'];
$nameorg = $_POST['nameorg'];
$telephone = $_POST['telephone'];
$besttimecontact = $_POST['besttimecontact'];
$address1 = $_POST['address1'];
$address2 = $_POST['address2'];
$town = $_POST['town'];
$county = $_POST['county'];
$postcode = $_POST['postcode'];
$fax = $_POST['fax'];
$email = $_POST['email'];
$website = $_POST['website'];
$govoffreg = $_POST['govoffreg'];
$premises = $_POST['premises'];
$commitee = $_POST['commitee'];
$fundingsources = $_POST['fundingsources'];
$bmeorg = $_POST['bmeorg'];
$ethnictyusers = $_POST['ethnictyusers'];
$orgtype = $_POST['orgtype'];
$activities = $_POST['activities'];
$beneficiaries = $_POST['beneficiaries'];
$contactrole = $_POST['contactrole'];
$legalstatus = $_POST['legalstatus'];
$levelorg = $_POST['levelorg'];
$areaop = $_POST['areaop'];
$income = $_POST['income'];
$ft30plus = $_POST['ft30plus'];
$pt16hrs = $_POST['pt16hrs'];
$pt1630hrs = $_POST['pt1630hrs'];
$sessional = $_POST['sessional'];
$trainers = $_POST['trainers'];
$unclassified = $_POST['unclassified'];
$volunteer = $_POST['volunteer'];
$common_whatexpect = $_POST['common_whatexpect'];
$reliable = $_POST['reliable'];
$cheap = $_POST['cheap'];
$personalservice = $_POST['personalservice'];
$slow = $_POST['slow'];
$qualifiedstaff_people = $_POST['qualifiedstaff_people'];
$widechoice = $_POST['widechoice'];
$consistent = $_POST['consistent'];
$approachable = $_POST['approachable'];
$fitforpurpose = $_POST['fitforpurpose'];
$welleducated = $_POST['welleducated'];
$friendly = $_POST['friendly'];
$prompt = $_POST['prompt'];
$attentive = $_POST['attentive'];
$speedy = $_POST['speedy'];
$meetsneeds = $_POST['meetsneeds'];
$variable = $_POST['variable'];
$takeson = $_POST['takeson'];
$providesxtras = $_POST['providesxtras'];
$handson = $_POST['handson'];
$responsive = $_POST['responsive'];
$ltdselection = $_POST['ltdselection'];
$competent = $_POST['competent'];
$affordable = $_POST['affordable'];
$accessible = $_POST['accessible'];
$knowledgeable = $_POST['knowledgeable'];
$checkssatisfaction = $_POST['checkssatisfaction'];
$getsdetails = $_POST['getsdetails'];
$understands = $_POST['understands'];
$important1 = $_POST['important1'];
$important2 = $_POST['important2'];
$important3 = $_POST['important3'];
$important4 = $_POST['important4'];
$important5 = $_POST['important5'];
$nameofsystems = $_POST['nameofsystems'];
$not_adopting_sys_1 = $_POST['not_adopting_sys_1'];
$not_adopting_sys_2 = $_POST['not_adopting_sys_2'];
$not_adopting_sys_3 = $_POST['not_adopting_sys_3'];
$not_adopting_sys_4 = $_POST['not_adopting_sys_4'];
$not_adopting_sys_5 = $_POST['not_adopting_sys_5'];
$not_adopting_sys_6 = $_POST['not_adopting_sys_6'];
$not_adopting_sys_7 = $_POST['not_adopting_sys_7'];
$not_adopting_sys_8 = $_POST['not_adopting_sys_8'];




$sql = "INSERT INTO nottsvcs (contact, nameorg, telephone, besttimecontact,
,address1
,address2
,town
,county
,postcode
,fax
,email
,website
,govoffreg
,premises
,commitee
,fundingsources
,bmeorg
,ethnictyusers
,orgtype
,activities
,beneficiaries
,contactrole
,legalstatus
,levelorg
,areaop
,incomeft30plus
,pt16hrs
,pt1630hrs
,sessional
,trainers
,unclassified
,volunteer
,common_whatexpec
,reliable
,cheap
,personalservice
,slow
,qualifiedstaff_people
,widechoice
,consistent
,approachable
,fitforpurpose
,welleducated
,friendly
,prompt
,attentive
,speedy
,meetsneeds
,variable
,takeson
,providesxtras
,handson
,responsive
,ltdselection
,competent
,affordable
,accessible
,knowledgeable
,checkssatisfaction
,getsdetails
,understands
,important1
,important2
,important3
,important4
,important5
,nameofsystems
,'not_adopting_sys_1
,not_adopting_sys_2
,not_adopting_sys_3
,not_adopting_sys_4
,not_adopting_sys_5
,not_adopting_sys_6
,not_adopting_sys_7
,not_adopting_sys_8

)

VALUES ('$contact' 
,'$nameorg' 
,'$telephone' 
,'$besttimecontact'
,'$address1'
,'$address2'
,'$town'
,'$county'
,'$postcode'
,'$fax'
,'$email'
,'$website'
,'$govoffreg'
,'$premises'
,'$commitee'
,'$fundingsources'
,'$bmeorg'
,'$ethnictyusers'
,'$orgtype'
,'$activities'
,'$beneficiaries'
,'$contactrole'
,'$legalstatus'
,'$levelorg'
,'$areaop'
,'$income'
,'$ft30plus'
,'$pt16hrs'
,'$pt1630hrs'
,'$sessional'
,'$trainers'
,'$unclassified'
,'$volunteer'
,'$common_whatexpect'
,'$reliable'
,'$cheap'
,'$personalservice'
,'$slow'
,'$qualifiedstaff_people'
,'$widechoice'
,'$consistent'
,'$approachable'
,'$fitforpurpose'
,'$welleducated'
,'$friendly'
,'$prompt'
,'$attentive'
,'$speedy'
,'$meetsneeds'
,'$variable'
,'$takeson'
,'$providesxtras'
,'$handson'
,'$responsive'
,'$ltdselection'
,'$competent'
,'$affordable'
,'$accessible'
,'$knowledgeable'
,'$checkssatisfaction'
,'$getsdetails'
,'$understands'
,'$important1'
,'$important2'
,'$important3'
,'$important4'
,'$important5'
,'$nameofsystems'
,'$not_adopting_sys_1'
,'$not_adopting_sys_2'
,'$not_adopting_sys_3'
,'$not_adopting_sys_4'
,'$not_adopting_sys_5'
,'$not_adopting_sys_6'
,'$not_adopting_sys_7'
,'$not_adopting_sys_8'


)"
or die (mysql_error());

//execute query and store the result

$res = mysql_query($sql,$connection);
if ($res) {
echo "Your survey has been submitted - thankyou<BR /><BR />";
exit;
} else {
echo "There was a problem with your post - please click the back button and try again.<BR /><BR />";
}
}
?>

Roger_Ramjet

You post from page to page, storing input data in the session array untill all pages are finished. So why are you not then using that stored data as input to your db?

// store input from page to page
 session_start(); 
foreach($_POST as $key => $val) 
{ 
$_SESSION[$key] = quote_smart($val);    

}  

// do the same for the data posted to your form handler as well
 session_start(); 
foreach($_POST as $key => $val) 
{ 
$_SESSION[$key] = quote_smart($val);    

}  

error_reporting(E_ALL); 
ini_set('display_errors', '1'); 
$user = "mindseye";
$host = "cpp1.viper.enta.net";
$password = "qwerty11";
$connection = @mysql_connect($host, $user, $password)
or die ("Couldn't connect to server.");
$database = "mindseye";
$db = @mysql_select_db($database, $connection)
or die ("Couldn't select database.");

if (isset($_POST['Submit'])) { 
// then acess that stored data directly in your query string

$sql = "INSERT INTO nottsvcs (contact, nameorg, telephone, besttimecontact,
,address1
,address2
// etc, etc

)

VALUES ($_SESSION['$contact'],
$_SESSION['$nameorg'],
$_SESSION['$telephone'],
$_SESSION['$besttimecontact'],
$_SESSION['$address1'],
$_SESSION['$address2']
// etc, etc
)"

Should just about do it

Tezread

seems to make sense - I will give this a go- It will take a while as the form is huge!!- thx again