Modifying data in address book with PHP and MySQL

joe7410

Hello All,

I'm working off a tutorial on building an address book with mysql and php. For a reference you can find it here:

http://php.about.com/od/finishedphp1/ss/address_book.htm

I'm having no problems with creating the database in sql, I've entered some sample data into the table with phpmyadmin, and the code below will correctly display the info on the page.

The problem I'm having is modifying the data. Whenever I click on the add contact, edit, or remove links, nothing happens. Sure, the url in the address bar will change from www.mysite.com/address.php to www.mysite.com/address.php?mode=add when I click on the add contact link, but no form appears so I can input data.

I've included my code below. Any help you could provide would be greatly appreciated.

<html>
<head>
<title>Address Book</title>
</head>
<body>

<?php
// Connect to  Database
mysql_connect("mysite.com", "xxxx", "xxxx") or die(mysql_error());
mysql_select_db("address") or die(mysql_error());

if ( $mode=="add")
{
Print '<h2>Add Contact</h2>
<p>
<form action=';
echo $PHP_SELF;
Print '
method=post>
<table>
<tr><td>Last Name:</td><td><input type="text" name="last" /></td></tr>
<tr><td>First Name:</td><td><input type="text" name="first" /></td></tr>
<tr><td>Mobile Phone:</td><td><input type="text" name="mobile" /></td></tr>
<tr><td>Direct Phone:</td><td><input type="text" name="direct" /></td></tr>
<tr><td colspan="2" align="center"><input type="submit" /></td></tr>
<input type=hidden name=mode value=added>
</table>
</form> <p>';
}

if ( $mode=="added")
{
mysql_query ("INSERT INTO address (last, first, mobile, direct) VALUES ('$last', '$first', '$mobile', '$direct')");
}

if ( $mode=="edit")
{
Print '<h2>Edit Contact</h2>
<p>
<form action=';
echo $PHP_SELF;
Print '
method=post>
<table>
<tr><td>Last Name:</td><td><input type="text" value="';
Print $last;
print '" name="last" /></td></tr>
<tr><td>First Name:</td><td><input type="text" value="';
Print $first;
print '" name="first" /></td></tr>
<tr><td>Mobile Phone:</td><td><input type="text" value="';
Print $mobile;
print '" name="mobile" /></td></tr>
<tr><td>Direct Phone:</td><td><input type="text" value="';
Print $direct;
print '" name="direct" /></td></tr>
<tr><td colspan="2" align="center"><input type="submit" /></td></tr>
<input type=hidden name=mode value=edited>
<input type=hidden name=id value=';
Print $id;
print '>
</table>
</form> <p>';
}

if ( $mode=="edited")
{
mysql_query ("UPDATE address SET last = '$last', first= '$first', mobile = '$mobile', direct = '$direct' WHERE id = $id");
Print "Data Updated!<p>";
}


if ( $mode=="remove")
{
mysql_query ("DELETE FROM address where id=$id");
Print "Entry has been removed <p>";
}

$data = mysql_query("SELECT * FROM address ORDER BY last ASC")
or die(mysql_error());
Print "<h2>Address Book</h2><p>";
Print "<table border cellpadding=3>";
Print "<tr><th width=100>Last Name</th><th width=100>First Name</th><th width=100>Mobile</th><th width=100>Direct</th><th width=100 colspan=2>Admin</th></tr>"; Print "<td colspan=6 align=right><a href=" .$_SERVER[PHP_SELF]. "?mode=add>Add Contact</a></td>";
while($info = mysql_fetch_array( $data ))
{
Print "<tr><td>".$info['last'] . "</td> ";
Print "<td>".$info['first'] . "</td> ";
Print "<td>".$info['mobile'] . "</td> ";
Print "<td>".$info['direct'] . "</td> ";
Print "<td><a href=" .$_SERVER[PHP_SELF]. "?id=" . $info['id'] ."&last=" . $info['last'] . "&mobile=" . $info['mobile'] ."&direct=" . $info['direct'] . "&mode=edit>Edit</a></td>";
Print "<td><a href=" .$_SERVER[PHP_SELF]. "?id=" . $info['id'] ."&mode=remove>Remove</a></td></tr>";
}
Print "</table>";
?>
</body>
</html>

Roger_Ramjet

That is because you are using an outdated tute that relies on register globals being ON. This is a security hole that has been closed in newer versions so you'll have to access the input via $_GET.

You'll also need to sanitise the user input so search for mysql_real_escape_string and/or 'sql injection attacks'.

joe7410

You are correct. I went into the php.ini file and set register_globals to On and the script works (well, I am able to add new contacts but not edit or remove contacts).

Being new to php I want to do this right and will work with register_globals off. Though I am a bit perplexed as to where I am supposed to use $GET. Should I not be using $SERVER[PHP_SELF]? Or am I missing something?

Also, thanks for the tip on sanitizing the user data. This script will be running on an intranet so I'm not too terribly worried about the data being displayed in the URL. But will research what you suggested.

Roger_Ramjet

if (isset($_GET['mode'])) 
   $mode = $_GET['mode'];
}

// OR more general purpose and elegant

if (isset($_GET['mode'])) {
   switch ($_GET['mode']) {
    case 'add':
       // your add code
      break;
   case 'edit':
     // your edit code
     break;
   case 'added':
     // your added code
    // ETC
  }
}

joe7410

Thanks for your help so far Roger.

I am now unable to add,edit, or remove anything from my sql database.

Most of the data appears fine on the page (except for edit mode, none of the form fields are filled with existing data).

Here is what I have so far.

<html>
<head>
<title>Address Book</title>
</head>
<body>

<?php
// Connect to the Database
mysql_connect("mysite.com", "xxxx", "xxxx") or die(mysql_error());
mysql_select_db("address") or die(mysql_error());

if (isset($_GET['mode'])) {
   switch ($_GET['mode']) {
    case 'add':
       {
       	Print '<h2>Add Contact</h2>
	   <p>';
	   Print '<form action="address.php" method="post">
	   <table>
	   <tr><td>Last Name:</td><td><input type="text" name="last" /></td></tr>
	   <tr><td>First Name:</td><td><input type="text" name="first" /></td></tr>
	   <tr><td>Mobile Phone:</td><td><input type="text" name="mobile" /></td></tr>
	   <tr><td>Direct Phone:</td><td><input type="text" name="direct" /></td></tr>
	   <tr><td colspan="2" align="center"><input type="submit" /></td></tr>
	   <input type=hidden name=mode value=added>
	   </table>
		</form> <p>';
      	break;
      	}

   case 'edit':
     Print '<h2>Edit Contact</h2>
	 <p>
	 <form action=';
	 echo $_SERVER[PHP_SELF];
	 Print '
	 method="post">
	 <table>
	 <tr><td>Last Name:</td><td><input type="text" value="';
	 echo $last;
	 print '" name="last" /></td></tr>
	 <tr><td>First Name:</td><td><input type="text" value="';
	 Print $first;
	 print '" name="first" /></td></tr>
	 <tr><td>Mobile Phone:</td><td><input type="text" value="';
	 Print $mobile;
	 print '" name="mobile" /></td></tr>
	 <tr><td>Direct Phone:</td><td><input type="text" value="';
	 Print $direct;
	 print '" name="direct" /></td></tr>
	 <tr><td colspan="2" align="center"><input type="submit" /></td></tr>
	 <input type=hidden name=mode value=edited>
	 <input type=hidden name=id value=';
	 Print $id;
	 print '>
	 </table>
	</form> <p>';
     break;

   case 'added':
    $last = $_POST['last'];
    $first = $_POST['first'];
    $mobile = $_POST['mobile'];
    $direct = $_POST['direct'];
    mysql_query ("INSERT INTO address (last, first, mobile, direct) VALUES ('$last', '$first', '$mobile', '$direct')");
    break;


   case 'edited':
       $last = $_POST['last'];
       $first = $_POST['first'];
       $mobile = $_POST['mobile'];
    $direct = $_POST['direct'];
   	mysql_query ("UPDATE address SET last = '$last', first= '$first', mobile = '$mobile', direct = '$direct' WHERE id = $id");
	Print "Data Updated!<p>";
    break;

   case 'remove':
    mysql_query ("DELETE FROM address where id=$id");
	Print "Entry has been removed <p>";
	break;

  }
}

$data = mysql_query("SELECT * FROM address ORDER BY last ASC")
or die(mysql_error());
Print "<h2>Address Book</h2><p>";
Print "<table border cellpadding=3>";
Print "<tr><th width=100>Last Name</th><th width=100>First Name</th><th width=100>Mobile</th><th width=100>Direct</th><th width=100 colspan=2>Admin</th></tr>"; Print "<td colspan=6 align=right><a href=" .$_SERVER[PHP_SELF]. "?mode=add>Add Contact</a></td>";
while($info = mysql_fetch_array( $data ))
{
Print "<tr><td>".$info['last'] . "</td> ";
Print "<td>".$info['first'] . "</td> ";
Print "<td>".$info['mobile'] . "</td> ";
Print "<td>".$info['direct'] . "</td> ";
Print "<td><a href=" .$_SERVER[PHP_SELF]. "?id=" . $info['id'] ."&last=" . $info['last'] . "&mobile=" . $info['mobile'] ."&direct=" . $info['direct'] . "&mode=edit>Edit</a></td>";
Print "<td><a href=" .$_SERVER[PHP_SELF]. "?id=" . $info['id'] ."&mode=remove>Remove</a></td></tr>";
}
Print "</table>";
?>
</body>
</html>