[RESOLVED] yet another "undefined variable" woe

kires

I'm just (re)learning php, and one particular issue is bitch-slapping my form right into the error logs. Here's the code of the never-to-be-sufficiently-damned form:

<html>
<body>
<?php


if ($_POST) {

  // process form

  $link = mysql_connect('localhost', 'bmccollam', 'biteme');

  mysql_select_db("abusedb",$link);

  $sql = "INSERT INTO sc_alert (ip) VALUES ('$ip')";

  $result = mysql_query($sql);

  echo "Thank you! Information entered.\n";

} else{



  // display form



  ?>



  <form method="POST" action="<?php echo $_SERVER['PHP_SELF'];?>">

  Address:
    <input name="address" type="text" id="ip">
    <br>


  <br>

  <input type="submit" name="submit" value="Enter information">

  </form>



  <?php



} // end if



?>
  </p>
</div>
</body>
</html>

and the error:

Undefined variable: ip in /var/www/html/submit.php on line 14, referrer: http://sandy/submit.php

I've managed to get this far through trial and terror, but I've been stuck at this point for a while now. I've googled the hell out of the error and searched through this forum and I've found a few possible solutions, none of which have worked so far. I'm pretty sure that the cause is some "devil in the details" error on my part, but I'm having no luck nailing it down enough to bring joy to the form. Anyone here care to enlighten me, or point me in the right direction? Than-q.

ragedigital

To access a POSTed variable you need to do this:

$_POST['ip']

$_REQUEST['ip']

$sql = "INSERT INTO sc_alert (ip) VALUES ('".$_POST['ip']."')";

NogDog

Never count on register_globals being set:

  $sql = "INSERT INTO sc_alert (ip) VALUES ('{$_POST['ip']}')";

bradgrafelman

Also, never count on user-submitted data to be safe nor magic_quotes_gpc to be enabled:

if(!get_magic_quotes_gpc())
    $ip = mysql_real_escape_string($_POST['ip']);
else
    $ip = mysql_real_escape_string( stripslashes($_POST['ip']) );

$sql = "INSERT INTO .. VALUES ('$ip')";

(Some will argue that [man]mysql_real_escape_string/man isn't needed over [man]addslahes/man, but... shrug just a habit of mine)

kires

First, than-q for the responses. They were quite helpful. The good news is that I'm not getting the same error anymore. The bad news is that now I'm getting a new error:

Undefined index: ip in /var/www/html/submit.php on line 14, referrer: http://sandy/submit.php

I tried all three ideas, with the same result. Here's the code of the form, as it is currently:

<html>
<body>
<?php


if ($_POST) {

  // process form

  $link = mysql_connect('localhost', 'bmccollam', 'biteme');

  mysql_select_db("abusedb",$link);
if(!get_magic_quotes_gpc())
    $ip = mysql_real_escape_string($_POST['ip']);
else
    $ip = mysql_real_escape_string( stripslashes($_POST['ip']) );

//  $sql = "INSERT INTO sc_alert (ip)  VALUES ('$ip')"; 
//  $sql = "INSERT INTO sc_alert (ip) VALUES ('{$_POST['ip']}')";
//  $sql = "INSERT INTO sc_alert (ip) VALUES ('$ip')";
//  $sql = "INSERT INTO sc_alert (ip) VALUES ('".$_REQUEST['ip']."')";

  $result = mysql_query($sql);

  echo "Thank you! Information entered.\n";

} else{



  // display form



  ?>



  <form method="POST" action="<?php echo $_SERVER['PHP_SELF'];?>">

  Address:
    <input name="address" type="text" id="ip">
    <br>


  <br>

  <input type="submit" name="submit" value="Enter information">

  </form>



  <?php



} // end if



?>
  </p>
</div>
</body>
</html>

The fact that it's a new error means that it's that much closer to cool. Any suggestions on how to squash the undefined index complaint?
For the record, register_globals is off, as is magic_quotes_gpc. Would that be the cause of this new issue? I can enable it, if needs be. The test box (sandy) is a vmware install on the workstation I'm using, so I can change anything I need to on it.

bradgrafelman

Found the problem - you don't submit any elements with a name of "ip".

Also, if you wanted to shorten up the code a bit:

$ip = mysql_real_escape_string( (get_magic_quotes_gpc() ? stripslashes(@$_POST['ip']) : @$_POST['ip']) );

(That also suppresses errors of undefined indeces - remove the @'s when debugging the code).

As I said, however, you don't submit any form elements with a name of "ip"...

ragedigital

Not to simplify it too much, but you wrote:

<input name="address" type="text" id="ip">

and the variable name being passed is "address", not "ip".

So, your script should include $POST['address'] not $POST['ip']...

$ip = mysql_real_escape_string($_POST['address']);

Brad already said it, but sometimes it not always obvious.

Good luck!

kires

That solved the problem. I had a feeling it was something stupid I'd done. So now, the form is working. Unfortunately, the data doesn't seem to be making it to the database, according to phpMyAdmin. Odd. I'm going to root around, and see if I can find the right bit of code to have the form respond with the errors or response it gets from mysql when it tries to add the data. Then, I guess I'll take it from there. Thanks again.