checking to see if a checkbox is checked

[skdzines]

I have the following code to check to see if a checkbox has been checked and if so delete the following record from the database. However if any checkbox has been checked it deletes all records under it. Meaning if I have 3 records and I want to delete only record 2, i check that box and hit submit, it updates the first record but then deletes record 2 and 3 instead of only record 2

if($form == "edit"){
$locID = $_GET['locID'];
	for ($i=0; $i < $num; $i++){
		if(isset($delete[$i])){
			$sql = "Select pic From locPhotos Where id = '$id[$i]'";
			$selectPic = mysql_query($sql);
			$currentPic = mysql_fetch_object($selectPic);

		if($currentPic){
			$delete = "$myServerPath/locationImages/".$currentPic->pic."";
				if(is_file($delete)){
					unlink($delete);
				} 
		}

		$sql = "Delete From locPhotos Where id = '$id[$i]'";
		$del = mysql_query($sql) or die ('Could not delete location because: ' . mysql_error());
	}else{
		$sql = "Update locPhotos Set locID = '".$locID."', description = '".$desc[$i]."' Where id = '$id[$i]'"; 
		$result = mysql_query($sql) or die ('Could not update database because: ' . mysql_error());
		$form = "";
		$success = true;
	}
}
}

Here is the form that is generated with the checkboxes

echo"
			<form action='$path/admin/editLocPhotos.php?locID=".$locID."' method='post' name='addPhotos' enctype='multipart/form-data'>
			<input type='hidden' name='MAX_FILE_SIZE' value='307200' />
			<table width='100%' border='0' cellspacing='0' cellpadding='3' summary='This table is for display only.'>";
			$sql = "Select * From locPhotos Where locID = '".$locID."' Order By id ASC";
			$query = mysql_query($sql);
			$i = 0;
			while($result = mysql_fetch_array($query)){
			echo"<tr valign='top'>
					<td><strong>Description ".($i + 1)."</strong></td>
					<td><strong>Current Image</strong></td>
					<td>&nbsp;</td>
				</tr>
				<tr valign='top'>
					<input type='hidden' name='id[$i]' value='".$result['id']."' />
					<td><textarea class='textBoxStyle' cols='40' rows='2' name='desc[$i]'>".$result['description']."</textarea></td>		
					<td><img src='../locationImages/".$result['pic']."' width='90' height='71' class='menuThumb' alt='location image' /></td>
					<td><strong>Delete</strong> <input type='checkbox' name='delete[$i]' value='delete[$i]'></td>
				</tr>";
				$i++;
			}
			echo"
				<tr>
					<td>&nbsp;</td>
					<td><input type='submit' name='upload' value='Submit' class='submitStyle' />
					<input type='hidden' name='form' value='edit'>
					<input type='hidden' name='num' value='$i'></td>
				</tr>
			</table>
			</form>";
		}

Can anyone help?

Thanks

[msk_1980]

One thing you can try changing is:

<td><strong>Delete</strong> <input type='checkbox' name='delete[$i]' value='delete[$i]'></td> </tr>"

to:

<td><strong>Delete</strong> <input type='checkbox' name=" . delete[ ] . " value=". $i . "></td>  </tr>"

the values passed if checked would be something like:
$delete[1], $delete[2] .... etc

and in the processing you should be able to use something like:

if ( isset[ $delete[$i] ] )
{

//do the processing here.
}

I might be a bit wrong with the syntax of double quotes or single quotes but it gives you an idea how to work it out.

[msk_1980]

try changing:

<td><strong>Delete</strong> <input type='checkbox' name='delete[$i]' value='delete[$i]'></td>   </tr>"; 

to:

<td><strong>Delete</strong> <input type='checkbox' name='. delete[ ].' value='.$i .'></td>  </tr>"; 

[skdzines]

Thanks msk_1980. I tried that but it still doesn't seem to work. I have changed it back to this

<input type='checkbox' name='delete[$i]' value='".$i."'>

I have 3 records and want to delete the 1st and 3rd record. I check them, hit submit and echo out the results. It tells me that record 1 and 3 were checked but it deletes all of them because the first one was checked so all records under it are getting deleted as well. I don't get it.

Any other suggestions?

[msk_1980]

try:

<td><strong>Delete</strong> <input type='checkbox' name='. delete[ ].' value='.$result['id'] .'></td>  </tr>"; 

in the processing try something like:

$delete_items = $_POST['delete'];
foreach ( $delete_items as $id )
 {
$sql = "Select pic From locPhotos Where id = '". $id. "' "; 
            $selectPic = mysql_query($sql); 
            $currentPic = mysql_fetch_object($selectPic); 

        if($currentPic){ 
            $delete = "$myServerPath/locationImages/".$currentPic->pic.""; 
                if(is_file($delete)){ 
                    unlink($delete); 
                } 
        } 

        $sql = "Delete From locPhotos Where id = '".$id."' "; 
        $del = mysql_query($sql) or die ('Could not delete location because: ' . mysql_error()); 
}

try this and if this delete the items properly, then you can use the other bit of code too.

[frost110]

I had this same problem a while back. I figured out that keep the name of the delete part the same. Just change the value. IE:

<td><strong>Delete</strong> <input type='checkbox' name=delete value='.$result['id'] .'></td>  </tr>"; 

That way when you access it via POST it is an array of values. Like said above do a foreach.

But instead of a foreach loop like that try this.

$delete_times = $_POST['delete'];
$i=1;
foreach ($delete_items as $key => $id){
      if($i == count($delete_items)) {
            $in_sql .= $id;
      }else {
           $in_sql .= $id . ",";
      }     

}

$sql = "select pic from locphotos where id in (".$in_sql.")";
$sqlQu = mysql_query($sql);
while ($row = mysql_fetch_assoc($sqlQu)) {
      unlink('pathopic/' . $row['pic']);
}

Hope this helps.

--FrosT

[skdzines]

Thanks guys. msk_1980, I used the second one you told me to try and it works. There is still one problem though, this is what I have now:

if($form == "edit"){
$locID = $_GET['locID'];
$delete_items = $_POST['delete'];
	foreach ($delete_items as $id){ 
			$sql = "Select pic From locPhotos Where id = '".$id."' "; 
			$selectPic = mysql_query($sql); 
            $currentPic = mysql_fetch_object($selectPic); 

        if($currentPic){ 
            $delete = "$myServerPath/locationImages/".$currentPic->pic.""; 
                if(is_file($delete)){ 
                    unlink($delete); 
                } 
        } 

        $sql = "Delete From locPhotos Where id = '".$id."' "; 
        $del = mysql_query($sql) or die ('Could not delete location because: ' . mysql_error()); 
}
for ($i=0; $i < $num; $i++){
	$sql = "Update locPhotos Set locID = '".$locID."', description = '".$desc[$i]."' Where id = '".$id[$i]."'"; 
	$result = mysql_query($sql) or die ('Could not update database because: ' . mysql_error());
	$form = "";
	$success = true;
}
}

Basically now, if I check a picture to delete but I also change the description of one of the pictures I want to keep, it only deletes the image selected and doesn't update the description. However if I don't ckeck any image to delete and change some of the descriptions, it does update them. Any suggestions on this?

I really appreciate all of your help.

[frost110]

Whoa dude, what are you trying to do?

You are using GET and POST in the same place. I can see that on a query string, but yea. This does not make any sense because of a few items.

1.) $id[$i] Does not make sense? No where do I see $id being an array. If it ever was an array, it would of been erased because of that foreach loop!

2.) Where is the $desc coming from? I do not see that anywhere?

Perhaps if you posted that FORM's code it would be easier to understand that mess.

--FrosT

[skdzines]

okay, this is what I'm doing and I dont' have the exact code in front of me because I'm at work right now, but here is the jist of it.

When the user comes to this page, the first thing the see is a drop down box with a store location, they select the location for the photos they wish to edit or delete, this sets the variable $locID which is the name of the menu and sets a variable called form to "continue". This now goes to the portion of the same page that says if($form == "continue"){ yada, yada, yada..

Once it gets to this section, the database is queried to get all images and descriptions based on the $locID. The following is the code and what is generated:

echo"
            <form action='$path/admin/editLocPhotos.php?locID=".$locID."' method='post' name='editPhotos' enctype='multipart/form-data'>
            <input type='hidden' name='MAX_FILE_SIZE' value='307200' />
            <table width='100%' border='0' cellspacing='0' cellpadding='3' summary='This table is for display only.'>";
            $sql = "Select * From locPhotos Where locID = '".$locID."' Order By id ASC";
            $query = mysql_query($sql);
            $i = 0;
            while($result = mysql_fetch_array($query)){
            echo"<tr valign='top'>
                    <td><strong>Description ".($i + 1)."</strong></td>
                    <td><strong>Current Image</strong></td>
                    <td>&nbsp;</td>
                </tr>
                <tr valign='top'>
                    <input type='hidden' name='id[$i]' value='".$result['id']."' />
                    <td><textarea class='textBoxStyle' cols='40' rows='2' name='desc[$i]'>".$result['description']."</textarea></td>        

                    <td><img src='../locationImages/".$result['pic']."' width='90' height='71' class='menuThumb' alt='location image' /></td>
                    <td><strong>Delete</strong> <input type='checkbox' name='delete[$i]' value='delete[$i]'></td>
                </tr>";
                $i++;
            }
            echo"
                <tr>
                    <td>&nbsp;</td>
                    <td><input type='submit' name='upload' value='Submit' class='submitStyle' />
                    <input type='hidden' name='form' value='edit'>
                    <input type='hidden' name='num' value='$i'></td>
                </tr>
            </table>
            </form>";
        } 

I am using $locID = $_GET['locID']; because I am grabbing it from the URL string. this is the only way I was able to get it otherwise that variable was lost if I didn't append it to the string and then grab it from there. Although, now that I think about it I could actually get rid of that variable at this point because it doesn't really need to be updated. I really just need it to get all images at first.

Anyway, I still don't really now where to go from here. Because I need to more or less do an "else" but I can't do that with a foreach loop. If the box is not checked or $delete_items as $id is not true for the next item in the list, I need it to be updated in the database in case they have changed anything.

Thanks again for your help.

[frost110]

Why are you grabbing locID from the url string?

<input type="hidden" name="locID" value="$locID">

Something like that passes locID to ya via POST so your not getting yourself mixed up with GET and POST.

Given the form code the reason you are not able to update stuff is like I said earlier the ID in the foreach loop. Change it to something different because it overrides the previous id. Especially with register_globals being on.

    foreach ($delete_items as $delID){
            $sql = "Select pic From locPhotos Where id = '".$delID."' ";
            $selectPic = mysql_query($sql);
            $currentPic = mysql_fetch_object($selectPic);

        if($currentPic){
            $delete = "$myServerPath/locationImages/".$currentPic->pic."";
                if(is_file($delete)){
                    unlink($delete);
                }
        }

        $sql = "Delete From locPhotos Where id = '".$delID."' ";
        $del = mysql_query($sql) or die ('Could not delete location because: ' . mysql_error());
}

Next a good habit to do is DECLARE all your variables to prevent exploits. Meaning ineasted of calling $id first do this...

    $id = $_POST['id'];
    $desc = $_POST[['desc'];
    for ($i=0; $i < $num; $i++){
        $sql = "Update locPhotos Set locID = '".$locID."', description = '".$desc[$i]."' Where id = '".$id[$i]."'";
        $result = mysql_query($sql) or die ('Could not update database because: ' . mysql_error());
        $form = "";
        $success = true;
    }

That will help prevent people being able to change data on you by posting GET values. How it was I could of just went like this and exploited it.

yoururl.com/yourscript.php?id[0]=1&id[1]=2&form=edit&desc[0]=SCREW THIS&desc[1]=HAHAHAHAHA

Just something to think about. I would also make your $form defined by POST too IE: $form = $_POST['form']; if $form blah blah blah

Just for security reasons.

Questions let me know.

--FrosT

[skdzines]

thanks frost110. I don't really know why I was posting it to the url string. I guess I just didn't think about putting in a hidden input instead. I will give the other a try when I get home. Although you are correct about being able to exploit my data and change it by using get values, however I am protecting against this sort of thing in a way by having the entire admin area I'm building be password protected and setting session vars. If you simply were to type that url string in it would just redirect you to the login screen because you have not successfully logged in and created a session. So before it ever gets to anything else it checks to make sure you are logged in first.

I realize as well that there are probably other ways around it that if someone really wants to screw with my data they could.

Thanks again

[frost110]

Yea I understand about the admin section. Just good coding standards so your application can work on multiple servers no matter what settings they have on. If register_globals is off (which is defaulted by php for security reasons) than this whole script will not work on that server.

I made this mistake and had to re-code an entire application. Not fun!

--FrosT