Simple form driving me crazy

zTagged

I'm trying to create a simple form, in this example a simple phonebook. Here's where my problem starts..
I cannot get any part of the script to work. At all. I can get the form to send the data to the script, but the script won't work..

I'm following this very easy-cheesy tutorial: http://www.help.thinkhost.com/web-development/databases/php-mysql-insert_360.html

So, here's the process. Form is created, and will be my 'contact inserter'.

<html>
<head>
</head>
<center>
<form method="post" action="script.php">
<input type="hidden" name="id" value="null">
<table>
<tr><td align="left">Name</td>
<td><input type="text" name="name"></td>
</tr>
<tr><td align="left">Telephone</td>
<td><input type="text" name="telephone" size="20"></td>
</tr>
<tr><td align="left">Birthday</td>
<td><input type="text" name="birthday" size="20"></td>
</tr>
<tr><td colspan="2">
<p align="center">
<input type="submit" value="Enter record">
</td>
</tr>
</table>
</form>
</center>
</html>

So there's the form itself. Everything looks alright.

Process:

<?
$DBhost = "example.com";
$DBuser = "example";
$DBpass = "example";
$DBName = "example";
$table = "test";
mysql_connect($DBhost,$DBuser,$DBpass) or die("Unable to connect to database");

@mysql_select_db("$DBName") or die("Unable to select database $DBName");

$sqlquery = "INSERT INTO $table VALUES('$id','$name','$telephone','$birthday')";

$results = mysql_query($sqlquery);

mysql_close();

print "<html><body><center>";
print "<p>You have just entered this record<p>";
print "Name : $name<br>";
print "Telephone : $telephone<br>";
print "Birthday :$birthday";
print "</body></html>";
?>

When I try to insert, I get:
1) A blank row. It gives the automated ID, but that's it. Nothing else.
2) A blank echo. I see exactly this:
You have just entered this record

Name :
Telephone :
Birthday :

Nothing else. I've looked a bunch of examples/tutorials, and normally I see something along the lines of..

$name=$_POST['name'];

And this script has none of that. I don't know if it's just not needed, or what. 😕

I'll give a cookie to the first person who can point out my obviously silly mistake.

Piranha

$name=$_POST['name'];

The above is needed. All post varibles are stored in an array named $POST. So if you have a variable name you should use $POST['name'] to catch it. It is possibly (or at least it was with old versions of PHP) to set it so $name would work, but it is bad coding and should never be used.

zTagged

Okay, so I at least got the generic basic form going. It's adding data as it should. It did require the $_GET lines. :evilgrin:

zTagged

Piranha wrote:
$name=$_POST['name'];

The above is needed. All post varibles are stored in an array named $POST. So if you have a variable name you should use $POST['name'] to catch it. It is possibly (or at least it was with old versions of PHP) to set it so $name would work, but it is bad coding and should never be used.

I'm guessing I should use the $POST function in the INSERT INTO $table command? IE: INSERT INTO $table VALUES('$POST['banana']') instead of simply $banana ?

Allow me to revisit this quickly. :quiet:

I have another form, with the (almost) exact same process, the only thing I did was add more options (Form has 2 drop-down boxes, and a radiobutton set, values Y and N during choice.)

It won't process data, and I'm using the EXACT same layout. I've double-checked the form names, and it's only echoing the selected data, but not pushing it through to the database.

WHY? :glare:

rincewind456

I'm guessing I should use the $POST function in the INSERT INTO $table command? IE: INSERT INTO $table VALUES('$POST['banana']') instead of simply $banana ?

You're guessing wrong, you should Never enter user data into a database without first cleaning it up, look at [man]mysql_real_escape-string/man for examples.

to help debug your code and to get an idea of what data is being passed via $POST or $GET then put this

print '<pre>';
print_r($_POST); // or $_GET etc
print '<pre>';'

at the head of your processing script.

You should then see what, if any data is being sent from the form to the processing script.

zTagged

rincewind456 wrote:
print '<pre>';
print_r($_POST); // or $_GET etc
print '<pre>';'
at the head of your processing script.

You should then see what, if any data is being sent from the form to the processing script.

Alright, once I put that in I get: Parse error: syntax error, unexpected T_STRING .. line 17...

Line 17 is the start of the $name=$_POST['name']; series of lines. 😕 If I try to take out any $ lines, or all of them, it tells me 'unexpected $end'.
Somedays I just hate (not knowing) PHP.. :glare:

Since I know I'm doing something wrong (Or, all of it wrong), I'll post the code that I'm happily using.

form:

<html>

<head>
<meta http-equiv="Content-Language" content="en-us">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Welcome to PIP Virtual Airlines</title>
</head>

<body>
<table border="0" width="100%" id="table1">
	<tr>
		<td><?php
include 'header.inc';?></td>
	</tr>
</table>

<form method="post" action="processing.php">
<input type="hidden" name="pilot_id" value="NULL">
<input type="hidden" name="status" value="P5">
	<p align="center">Welcome to PIP Virtual Airlines. Before we begin your 
	application, have you had a chance to look over our manual? If not, you'd 
	better do that!</p>

<div align="center">

<table border="0" width="67%" id="table2" bordercolorlight="#000000" bordercolordark="#000000" style="border-collapse: collapse">
	<tr>
		<td align="left">
		<p align="center">Let's start with the basics: </td>
	</tr>
	<tr>
		<td align="left">
		<p align="center">&nbsp;</td>
	</tr>
	<tr>
		<td align="left">What's your name?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
		<!--webbot bot="Validation" b-value-required="TRUE" -->
		<input type="text" name="name" size="34"></td>
	</tr>
	<tr>
		<td align="left">And how about your email address?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
		<!--webbot bot="Validation" b-value-required="TRUE" -->
		<input type="text" name="email" size="34" value="EX: Bob@Network.com"></td>
	</tr>
	<tr>
		<td>
		<p align="left">This is important: Are you <b>at least</b> 13 years of 
		age? <input type="radio" value="y" checked name="age"> I sure am!&nbsp;
		<input type="radio" name="age" value="n"> I am not.&nbsp; </td>
	</tr>
	<tr>
		<td>
		<p align="left"><font face="Arial">What version of Microsoft Flight 
		Simulator are you using?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
		<!--webbot bot="Validation" b-value-required="TRUE" b-disallow-first-item="TRUE" -->
		<select size="1" name="version">
		<option selected>Choose..</option>
		<option>2002</option>
		<option>2004 (FS9)</option>
		<option>FSX</option>
		<option>X-Plane</option>
		<option>Fly! / Fly II!</option>
		<option>Other / Not Listed / I just don't know!</option>
		</select></font></td>
	</tr>
	<tr>
		<td>
		<p align="center"><font face="Arial">Have you read the PIP Pilot 
		Information and Regulation Handbook, and swear to abide by it?<br>
		&nbsp;<!--webbot bot="Validation" s-display-name="You MUST agree to the terms and conditions." b-value-required="TRUE" --><input type="radio" value="y" name="abide"> Yes, I do.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
		<input type="radio" value="n" name="abide" checked> No, I do not.</font></td>
	</tr>
	<tr>
		<td><font face="Arial">If you're picked, which Hub System would you like 
		to enroll in?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
		<!--webbot bot="Validation" b-value-required="TRUE" b-disallow-first-item="TRUE" --> <select size="1" name="hub">
		<option selected>Choose..</option>
		<option>Asia/Pacific</option>
		<option>North America</option>
		<option>Europe</option>
		</select></font></td>
	</tr>
	<tr>
		<td>&nbsp;</td>
	</tr>
	<tr>
		<td>
		<p align="center">Now, about you.. Tell us something about yourself! I 
		know you've got a lot to share, but limit yourself to 500 characters 
		including spaces.<br>
&nbsp;<!--webbot bot="Validation" b-value-required="TRUE" i-maximum-length="600" --><textarea rows="2" name="about" cols="49">EG: I have three cats and play golf.
</textarea></td>
	</tr>
	<tr>
		<td>&nbsp;</td>
	</tr>
	<tr>
		<td>
		<p align="center"><input type="reset" value="Cancel IFR" name="B2">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
		<input type="submit" value="Clear for takeoff" name="B1"></td>
	</tr>
</table>
	</div>
</form>
</body>

</html>

process:

<?


$DBhost = "host";
$DBuser = "user";
$DBpass = "pass";
$DBName = "name";
$table = "table";
mysql_connect($DBhost,$DBuser,$DBpass) or die("Unable to connect to database");

@mysql_select_db("$DBName") or die("Unable to select database $DBName");


$name=$_POST['name'];
$email=$_POST['email'];
$age=$_POST['age']; 
$version=$_POST['version'];
$hub=$_POST['hub'];
$flown=$_POST['flown'];
$about=$_POST['about']; 
$status=$_POST['status']; 



$sqlquery = "INSERT INTO $table VALUES('$id','$name','$email','$age','$version','$hub','$flown','$about','$status')";

$results = mysql_query(mysql_query);


mysql_close();

print "<html><body><center>";
print "Hey, $name ! Thanks for applying.<br>";
print " We will be contacting you at $email , so keep your eyes open! Thanks again for applying with us. Good luck!";
print "</body></html>";
?>

Going from the example I posted before, everything is the same. The only thing to change are the added style/amount of form fields processed.

If I add the

print '<pre>';
print_r($_POST); // or $_GET etc
print '<pre>';'

code, I get the parse error. :queasy:

zTagged

I went back to the sample form I started with, and tried something weird. I added a MySQL column (called x), and now the table won't add a row unless x is getting data.
I'm going back through the other one, but the data is all going to the right place.. Each column is getting data for the 'main' form, unless for some reason the non-text formfields aren't reporting the data.. 😕

zTagged

I went back through, and made sure no null values were being written to the script by the form (Meaning: Each column should have a form field writing to it). For some reason, it's still not hitting the database.

So, I've come to the conclusion that I'm doing something wrong with the non-textbox form fields. Can anyone offer their assistance in this one? 😕

future448

In your last version of code you are using you are not using $sqlquery in your mysql_query.

Change:

$sqlquery = "INSERT INTO $table VALUES('$id','$name','$email','$age','$version','$hub','$flown','$about','$status')"; 

$results = mysql_query(mysql_query);

To:

$sqlquery = "INSERT INTO $table VALUES('$id','$name','$email','$age','$version','$hub','$flown','$about','$status')"; 

$results = mysql_query($sqlquery) or die(mysql_error());

If that doesn't insert the record it should give you an error giving more idea as to the reason why.

zTagged

future448 wrote:
In your last version of code you are using you are not using $sqlquery in your mysql_query.

Change:
$sqlquery = "INSERT INTO $table VALUES('$id','$name','$email','$age','$version','$hub','$flown','$about','$status')"; 

$results = mysql_query(mysql_query);
To:
$sqlquery = "INSERT INTO $table VALUES('$id','$name','$email','$age','$version','$hub','$flown','$about','$status')"; 

$results = mysql_query($sqlquery) or die(mysql_error());
If that doesn't insert the record it should give you an error giving more idea as to the reason why.

Y'know, I triple-checked the code against the example and for some reason completely missed that. :rolleyes:

Everything's A-OK, now I just need to create a form that will allow modification/deletion of specific rows.. Better get tylenol. 😃

Piranha

Now when you got it working would be the time to worry about sql injection. Basically sql injection is a way for a user to be able to view/change/delete more than they should be able to. Look at [man]mysql_real_escape_string[/man] to see how to solve this problem.

zTagged

Piranha wrote:
Now when you got it working would be the time to worry about sql injection. Basically sql injection is a way for a user to be able to view/change/delete more than they should be able to. Look at [man]mysql_real_escape_string[/man] to see how to solve this problem.

Check! 😃 Protection added.

Now, I bring you a new problem. I created the deletion/edit form, and the delete part isn't working.

<?php
connection info

mysql_connect($DBhost,$DBuser,$DBpass) or die("There was a connection error and I am unable to continue");

@mysql_select_db("$DBName") or die("I was not able to connect to the database");


if($_GET['delete']){
$item = $_GET['delete'];
mysql_query("DELETE FROM $table WHERE pilot_id='$id'") or die(mysql_error());
}

// Get all the data from the "example" table
$result = mysql_query("SELECT * FROM $table WHERE status='P5' ORDER BY pilot_id")
or die(mysql_error());

echo "<table width='100%' border='0'>";
echo "<tr> <td class='heading' width='15'><span style='font-size:8px';>Edit</span></td> <td class='heading' width='25'><span style='font-size:8px';>Delete</span></td> <td class='heading' width='25'>ID</td> <td class='heading' width='200'>Name</td> <td class='heading' width='100'>Hub</td> <td class='heading'>Email</td>";
// keeps getting the next row until there are no more to get
while($row = mysql_fetch_array( $result )) {
// Print out the contents of each row into a table
echo "<tr><td style='font-size:8px'>";
echo "Edit";
echo "</td><td style='font-size:8px'>";
echo '<a href="?delete='.$row['pilot_id'].'">Delete</a>';
echo "</td><td>";
echo $row['pilot_id'];
echo "</td><td>";
echo $row['name'];
echo "</td><td>";
echo $row['hub'];
echo "</td><td>";
echo $row['email'];
echo "</td><td>";
}

echo "</table>";
?>

I can't see where I went wrong 😕

Piranha

To make it easier to debu always make the query in one row and execute it in another. That way you can always echo the query and see if something is wrong with it.

$sql = "select * from table where column = $variable";
echo $sql;
$mysql_query($sql);

By the way, you don't have any security in that page.

zTagged

Piranha wrote:
To make it easier to debu always make the query in one row and execute it in another. That way you can always echo the query and see if something is wrong with it.
$sql = "select * from table where column = $variable";
echo $sql;
$mysql_query($sql);
By the way, you don't have any security in that page.

😃 It's security-free until it's finalized, that way I can make sure it works first on a clean sheet. Then I can add the security and fix that without screwing everything up.

I'm not understanding your debugging advice, though.. I have two different commands, one being the query to display the selected users, and the delete command. 😕

future448

A bit of a guess here but shouldn't:

mysql_query("DELETE FROM $table WHERE pilot_id='$id'") or die(mysql_error());

Be:

mysql_query("DELETE FROM $table WHERE pilot_id='$item'") or die(mysql_error());

And what Piranha means is that if you echo the sql statement to the screen while debugging you will see the actual query, which means you can easily see if the problem is with your php or mysql.

So for debugging purposes:

if($_GET['delete']){ 
$item = $_GET['delete']; 

$sql = "DELETE FROM $table WHERE pilot_id='$item'";

echo $sql . '<br />'; //get rid of this when you know its working

mysql_query($sql) or die(mysql_error()); 
}

Piranha

Exactly future.

It's security-free until it's finalized, that way I can make sure it works first on a clean sheet. Then I can add the security and fix that without screwing everything up.

That is a bad way of doing it. What if you forget to add the security? What if you miss one variable? Do it at once, then you don't have to worry about it.

zTagged

future448 wrote:
A bit of a guess here but shouldn't:
mysql_query("DELETE FROM $table WHERE pilot_id='$id'") or die(mysql_error());
Be:
mysql_query("DELETE FROM $table WHERE pilot_id='$item'") or die(mysql_error());
And what Piranha means is that if you echo the sql statement to the screen while debugging you will see the actual query, which means you can easily see if the problem is with your php or mysql.

So for debugging purposes:
if($_GET['delete']){ 
$item = $_GET['delete']; 

$sql = "DELETE FROM $table WHERE pilot_id='$item'";

echo $sql . '<br />'; //get rid of this when you know its working

mysql_query($sql) or die(mysql_error()); 
}

You and Piranha are my PHP saviors. -BOW BOW BOW- 😃
That fixed the delete process, and now I just need to create the approval script..

On that line, if I wanted to change it to not delete, but change the status column to another value, plus make a directory, would it be something along the lines of..

if($_GET['approve']){
$item = $_GET['approve'];
mysql_query("UPDATE $table SET status='value' WHERE pilot_id='$item'") or die(mysql_error());
mkdir("../pathname/PIP$item", 0700);}

Or am I completely off?

zTagged

Piranha wrote:
Exactly future.

That is a bad way of doing it. What if you forget to add the security? What if you miss one variable? Do it at once, then you don't have to worry about it.

... Touche. :p

zTagged

So I set up a (temporary, Piranha :p) approval script..

if($_GET['approve']){
$item = $_GET['approve'];
mysql_query("UPDATE $table SET status='PA' pilot_num='PIP$item' WHERE pilot_id='$item'") or die(mysql_error());
mkdir("../../ACARS/logs/PIP$item", 0777);}

and I get:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'pilot_num='PIP113' WHERE pilot_id='113'' at line 1

Error in my syntax.. Does that mean I can't use there 'WHERE' clause, or is it simply out of order? :bemused:

zTagged

So I went back, used the debugging line, and everything looks okay..

UPDATE pilots SET status='PA' pilot_num='PIP115' WHERE pilot_id='115'

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'pilot_num='PIP115' WHERE pilot_id='115'' at line 1

That's what I get. It's supposed to be doing what I want it to (Setting the column STATUS to PA, setting the column pilot_num to PIP$item when the column pilot_id is $item), but it seems to not want to do that.

:queasy:

Edit: That was an easy fix. Forgot the "AND" operator between status and num. Now it's working PARTIALLY. It A) Still won't update the number column, and 😎 is writing a zero to the status column. :queasy: