how to fix this bug

barnes

<?php
$con=mysql_connect("localhost","root","");
mysql_select_db("user",$con);
  $username = mysql_real_escape_string($_POST['username']);
  $password = mysql_real_escape_string($_POST['password']);
  $email = mysql_real_escape_string($_POST['email']);
  $add = mysql_real_escape_string($_POST['address']);
  $contry=mysql_real_escape_string($_POST['country']);
  $area=mysql_real_escape_string($_POST['area']);
  $pin=mysql_real_escape_string($_POST['pin']);
  $countrycode=mysql_real_escape_string($_POST['countrycode']);
  $phoneno=mysql_real_escape_string($_POST['phoneno']);
  $file=mysql_real_escape_string($_POST['file']);
  $qry="INSERT INTO user1 (username,password,email,address,country,area,pincode,countrycode,phoneno,file) VALUES ('$username','$password','$email','$add','$contry','$area','$pin','$countrycode','$phoneno','$file')";
  mysql_query($qry,$con);
  mysql_close($con);
  ?>

i am getting following errors:

Notice: Undefined index: password in c:\easyphp1-8\www\register.php on line 11

Notice: Undefined index: area in c:\easyphp1-8\www\register.php on line 15

Notice: Undefined index: file in c:\easyphp1-8\www\register.php on line 19

edsdesigns

<?php 
$con=mysql_connect("localhost","root",""); 
mysql_select_db("user",$con); 
$qry="INSERT INTO user1 (username,password,email,address,country,area,pincode,countrycode,phoneno,file) VALUES 
('".$_POST['username']."','".$_POST['password']."','".$_POST['email']."','".$_POST['address']."','".$_POST['country']."','".$_POST['area']."','".$_POST['pin']."','".$_POST['countrycode']."','".$_POST['phoneno']."','".$_POST['file']."')"; 
mysql_query($qry,$con); 
mysql_close($con); 
?>

barnes

i modified both files ..still bugs are exist..how to reslove this bugs..

<body>
<form action="register.php" method="post" enctype="multipart/form-data" name="form1" id="form1">
  <table width="410" border="0" align="center" bordercolor="#99FFFF">
    <tr align="center" valign="middle">
      <td colspan="3"> <span class="style1">User Registration</span> </td>
    </tr>
    <tr>
      <td width="156" align="left"><div align="right" class="style4">UserName</div></td>
      <td width="22">:</td>
      <td width="218"><div align="left">
        <input name="username" type="text" />
      </div></td>
    </tr>
    <tr>
      <td><div align="right" class="style4">Password</div></td>
      <td>:</td>
      <td><label>
        <div align="left">
          <input name="password" type="password"/>
        </div>
      </label></td>
    </tr>
    <tr>
      <td><div align="right" class="style4">E mail</div></td>
      <td>:</td>
      <td><label>
        <div align="left">
          <input type="text" name="email" />
          </div>
      </label></td>
    </tr>
    <tr>
      <td><div align="right" class="style4">Address</div></td>
      <td>:</td>
      <td><label>
        <div align="left">
          <textarea name="address"></textarea>
          </div>
      </label></td>
    </tr>
    <tr>
      <td><div align="right" class="style4">Country</div></td>
      <td>:</td>
      <td><label>
        <div align="left">
          <select name="country">
            <option>india</option>
            <option>usa</option>
            <option>pak</option>
            <option>england</option>
            <option>aus</option>
            <option>newzeland</option>
            <option>rsa</option>
            <option>srilanka</option>
            <option>west indies</option>
                                        </select>
        </div>
      </label></td>
    </tr>
    <tr>
      <td><div align="right" class="style4">City/Area</div></td>
      <td>:</td>
      <td><label>
        <div align="left">
          <select name="area" size="1" multiple="multiple" id="area">
          </select>
          </div>
      </label></td>
    </tr>
    <tr>
      <td><div align="right" class="style4">Pin Code </div></td>
      <td>:</td>
      <td><label>
        <div align="left">
          <input name="pin" type="text" id="pin" />
          </div>
      </label></td>
    </tr>
    <tr>
      <td><div align="right" class="style4">Phone Number </div></td>
      <td>:</td>
      <td><label>
        <div align="left">
          <input name="countrycode" type="text" id="counrtycode" size="3" maxlength="3" />
          <input name="phoneno" type="text" id="phoneno" />
        </div>
      </label></td>
    </tr>
    <tr>
      <td><div align="left" class="style4">
        <div align="right">Upload Your Photo </div>
      </div></td>
      <td><div align="left">:</div></td>
      <td><label>

    <div align="left">
      <input type="file" name="file" />
    </div>
  </label></td>
</tr>
<tr>
  <td colspan="3"><label>
    <div align="center">
      <input type="submit" name="Submit" value="Submit" />
      </div>
  </label></td>
</tr>
  </table>
</form>
</body>

<?php
 $con=mysql_connect("localhost","root","");
 mysql_select_db("user",$con);
  $username = mysql_real_escape_string($_POST['username']);
  $password = mysql_real_escape_string($_POST['password']);
  $email = mysql_real_escape_string($_POST['email']);
  $add = mysql_real_escape_string($_POST['address']);
  $contry=mysql_real_escape_string($_POST['country']);
  $area=mysql_real_escape_string($_POST['area']);
  $pin=mysql_real_escape_string($_POST['pin']);
  $countrycode=mysql_real_escape_string($_POST['countrycode']);
  $phoneno=mysql_real_escape_string($_POST['phoneno']);
  $file=mysql_real_escape_string($_POST['file']);
  $qry="INSERT INTO user1 (username,password,email,address,country,area,pincode,countrycode,phoneno,file) VALUES ('{$username}','{$password}','{$email}','{$add}','{$contry}','{$area}','{$pin}','{$countrycode}','{$phoneno}','{$file}')";
  mysql_query($qry,$con);
  mysql_close($con);
  ?>

laserlight

Warning: edsdesigns does not know what he/she is talking about here. You are doing the right thing by using mysql_real_escape_string(), removing it will not help and will instead make your script more vulnerable to SQL injection.

In this case, one possibility is that the form from which this script receives information does not have fields named password, area and file. Before using incoming variables, you should check that they exist by using either [man]isset[/man], [man]empty[/man] or [man]array_key_exists/man on (in this case) the $_POST array. You could choose to treat missing form information as an error and report it to the user to correct, or if the missing form information is unimportant you could send it as a blank.

NogDog

The errors are telling you that you did not receive post data from form elements with those names. Most likely, there is a disconnect between the value that was used for the name attribute in those three elements on the form that calls this script and what you are expecting in the code. Make sure that the names that were used in the form have the same exact same spelling (including upper- and lower-case letters) as the indexes you are using in the $_POST array.

barnes

All form element names matched with php file.that's what i am posting rergister.html
once see register.html.
sql field names also fine..

laserlight

Do a print_r($_POST) in register.php to check.

barnes

Array ( [username] => barnes529 [passwrod] => ffdrfgdrt [email] => ftgfgf [address] => gffggfggg [country] => india [pin] => 5676879 [countrycode] => 65 [phoneno] => 5464454 [Submit] => Submit ) .
yes all values are getting..

barnes

thank you laserlight.vales are getting from form elements.i unable to find the problem,onemore thing if we select a perticular country from list box,automatically change the city/area vales.how to change this cities depending on country.

laserlight

It looks like "password" has become "passwrod", and you need to provide options for area so that you can select at least one to test. Did you try choosing a file?

Back to the problem: have you used isset or empty to check that the incoming variables exist before using them? Have you reverted to your original code with mysql_real_escape_string()?

barnes

where u see "passwrod"..

laserlight

In your print_r output.

rowanparker

In the print_r you sent.

The $_POST variable being set is 'passwrod' not 'password'.

barnes

now password is okay.but how to get are/city names dynamically after selecting country.and one more thing is how can i store this uploading file in database.

laserlight

how to get are/city names dynamically after selecting country

That would require some clientside scripting.

how can i store this uploading file in database

You might store it in a BLOB field, though my personal preference is to upload it to the server filesystem and record its path in the database. In any case, this deserves a thread on its own.

barnes

many thanks laserlight..do u have any javascript to get are/city names dynamically after selecting country..plz give small hint..atleast few lines of code..

barnes

laserlight , i am begineer of php..please any suggestion to learn more things..

laserlight

That is also a separate question that should be asked in the ClientSide Technologies forum.

barnes

that's okay..when i selecting multiple cities..how to store multiple cities values database..

laserlight

From your description, there is a many-many relationship between cities and people, so for each city selected you would insert a new row into the third table that connects cities and people.