check3.php ???

dan231

I have taken over as an impromptu web developer for my company and I am trying to make sense of some code written by the last person.

Here is some background on what I am really trying to do:
I want to create a class registration form that will either enter data to a database or email me the data. I want to do this securely as the form may contain credit card info. There is already an HR form online that we can enter job info and it saves to a mySQL db and then posts to our web in a job openings section. This form is username/password protected.

I am trying to read the php code in order to follow what is being done so I can replicate this into my new form. I ran across a check3.php page, which I don't know what it does. None of the other pages seem to reference this page.

So, my question is: What is the check3.php page and how should I go about my form to make sure it is secure? My initial thought is to make this form email me w/o the credit info, but then we'll have to call the person for that info. But that is not really a bad thing as then we can follow up to verify class registration.

Horizon88

Perhaps you could post the check3.php file, so we can see what it contains? How else could we tell you what it is?
:S

dan231

I took out the db name, username and passwords

<HTML>
<HEAD>
 <TITLE>: Create/Edit/Delete Job Openings</TITLE>
</HEAD>
<BODY>

			<h1>For Internal Use Only</h1>
			<?php



if ($DeleteEntry)
{

   // process form
   $id=$_POST['choice'];
  // Make a MySQL Connection
  mysql_connect("localhost", "", "") or die(mysql_error());
  //echo "Connected to MySQL<br>";
  mysql_select_db("") or die(mysql_error());
  // echo "Connected to Database";
  // echo $id;
  mysql_query("DELETE
  FROM current_openings
  WHERE co_autonum=$id");
  mysql_close();
  echo 'file deleted';
}

elseif ($UpdateEntry)
{
 // process form
  $id=$_POST['choice'];
  // Make a MySQL Connection
  mysql_connect("localhost", "", "") or die(mysql_error());
  //echo "Connected to MySQL<br>";
  mysql_select_db("") or die(mysql_error());
  // echo "Connected to Database";
  // echo $id;
  $result2 = mysql_query("SELECT *
  FROM current_openings
  WHERE co_autonum=$id");
  while ($row2=mysql_fetch_assoc($result2))
        {
        ?>
        <form action="FormUpdate.php" method="post">
        <table width="100%" cellpadding="0" cellspacing="0">
        <tr><td><b>Job #: <?php echo $row2[co_autonum]; ?></b><input type="hidden" name="id" value="<?php echo $row2[co_autonum]; ?>"></td></tr>
        <tr height=20><td colpsan="2">&npsp;</td></tr>
        <tr height=20><td colpsan="2">&npsp;</td></tr>
        <tr>
        <td width="20%"><b>Job Title:</b></td>
        <td><input type="text" name="jobtitle" value="<?php echo $row2[co_position]; ?>" size="30"></td>
        </tr>
        <tr><td colspan="2"><i>50 characters Max.</i></td></tr>
        <tr height=20><td colpsan="2">&npsp;</td></tr>
        <tr>
        <td valign="top"><b>Tech/NonTech:</b></td>
        <td>
        <input type="radio" name="type" value="t" <?php if ($row2[co_type]=="t") {echo "checked";} ?>> Tech<br>
        <input type="radio" name="type" value="n" <?php if ($row2[co_type]=="n") {echo "checked";} ?>> NonTech<br>
        </td>
        </tr>
        <tr height=20><td colpsan="2">&npsp;</td></tr>
        <tr>
		<td valign="top"><b>Full or Part Time:</b></td>
        <td>
        <input type="radio" name="full" value="a" <?php if ($row2[co_full]=='a') echo "checked"; ?> > Full Time<br>
        <input type="radio" name="full" value="b" <?php if ($row2[co_full]=='b') echo "checked"; ?> > Part Time<br>
        <input type="radio" name="full" value="c" <?php if ($row2[co_full]=='c') echo "checked"; ?> > Full/Part Time<br>
        </td>
		</tr>
        <tr height=20><td colpsan="2">&npsp;</td></tr>
        <tr>
		<td valign="top"><b>Posted Date:</b></td>
        <td><input type="Text" name="post_date" value="<?php echo $row2[co_posted]; ?>" ></td>
		</tr>
        <tr height=20><td colpsan="2">&npsp;</td></tr>
        <tr>
		<td valign="top"><b>Application Deadline:</b></td>
        <td><input type="Text" name="app_dead" value="<?php echo $row2[co_deadline]; ?>"></td>
		</tr>
        <tr height=20><td colpsan="2">&npsp;</td></tr><tr height=20><td colpsan="2">&npsp;</td></tr>
        <tr>
		<td colspan="2"><b>Job Description</b><br>
        </tr>
        <tr>
        <td colspan="2">
        <texarea name="descript" rows="4" cols="50"><?php echo $row2[co_descript]; ?></texarea>
        </td>
		</tr>
		<tr height=20><td colpsan="2">&npsp;</td></tr>
        <tr>
		<td colspan="2"><input type="submit" value="UpDate Entry"></td>
        </tr>
        </table>
		</form>
<?php
       }
mysql_close();
}

else

{
 // display form
 // Make a MySQL Connection
 mysql_connect("localhost", "", "") or die(mysql_error());
 // echo "Connected to MySQL<br>";
 mysql_select_db("") or die(mysql_error());
 // echo "Connected to Database";
 // Retrieve the data from table
 $result1 = mysql_query("SELECT co_autonum, co_position, co_full, co_posted, co_deadline FROM current_openings")
 ?>
   <h2>Job Openings</h2>
   <form method="post" action="<?php echo $PHP_SELF?>">
   <table border="1">
   <tr>
   <td> &npsp; </td>
   <td>Position</td>
   <td>Full/Part Time</td>
   <td>Date Posted</td>
   <td>Application Deadline</td>
   </tr>

<?php
while($row1 = mysql_fetch_array($result1))
            {
            // Print out the contents of each row into a table
            echo '<tr>';
            echo '<td><input type="radio" name="choice" value="' . $row1['co_autonum'] . '"></td>';
            echo '<td>' . $row1['co_position'] . '</td>';
            echo '<td>' . $row1['co_full'] . '</td>';
            echo '<td>' . $row1['co_posted'] . '</td>';
            echo '<td>' . $row1['co_deadline'] . '</td>';
            echo '</tr>';
            }
?>
<tr><td colspan=3><input type="Submit" name="DeleteEntry" value="Delete Entry"></td>
<td colspan=2> <input type="Submit" name="UpdateEntry" value="Update Entry"></td>
</tr>  </table>
</form>
<?php mysql_close();
               <h3>Create A New Job Opening</h3>
				<form action="FormReq.php" method="post" name="jobs">
				<table width="100%" cellpadding="0" cellspacing="0">
 					<tr>
						<td width="20%"><b>Job Title:</b></td>
						<td><input type="text" name="jobtitle" size="30"></td>
					</tr>
                    <tr><td colspan="2"><i>50 characters Max.</i></td></tr>
                    <tr height=20><td colpsan="2">&npsp;</td></tr>


                    <tr>
						<td valign="top"><b>Tech/NonTech:</b></td>
						<td>
                        <input type="radio" name="type" value="t"> Tech<br>
                        <input type="radio" name="type" value="n"> NonTech<br>
                       </td>
					</tr>
                     <tr height=20><td colpsan="2">&npsp;</td></tr>


  						<tr>
							<td valign="top"><b>Full or Part Time:</b></td>
						<td>
                        <input type="radio" name="full" value="a"> Full Time<br>
                        <input type="radio" name="full" value="b"> Part Time<br>
                        <input type="radio" name="full" value="c"> Full/Part Time<br>
                        </td>
						</tr>
                     <tr height=20><td colpsan="2">&npsp;</td></tr>

					<tr>
						<td valign="top"><b>Posted Date:</b></td>

 		<td><input type="Text" name="post_date" value="YYYY-MM-DD"> </td>
					</tr>
                  <tr height=20><td colpsan="2">&npsp;</td></tr>


					<tr>
						<td valign="top"><b>Application Deadline:</b></td>

 		<td><input type="Text" name="app_dead" value="YYYY-MM-DD"></td>
					</tr>
<tr><td colspan="2"><i>If Application Deadline is "open," leave blank.</i></td></tr>
                         <tr height=20><td colpsan="2">&npsp;</td></tr>                         <tr height=20><td colpsan="2">&npsp;</td></tr>

					<tr>
						<td colspan="2"><b>Job Description</b><br>
                        </tr>
                        <tr><td colspan="2"><texarea name="descript" rows="4" cols="50">You may copy and paste the job description from a Word or Text file. Enter the characters <p> before each paragraph.
						</texarea></td>
					</tr>
					                        <tr height=20><td colpsan="2">&npsp;</td></tr>



					<tr>
						<td colspan="2"><input type="submit" value="add job"></td>
					</tr>
				</table>
				</form>}
?>

</BODY>
</HTML>

bradgrafelman

I edited your code and added a closing " for the password value of the mysql_connect() function - I think you accidentally removed it when posting your code.

First thing I notice... where is $DeleteEntry ever defined? Or $UpdateEntry?

Also, towards the end of the script, you have a bunch of HTML within <?php ?> tags... that'll definitely result in parse errors.