HTML/PHP array problem

EcceVery

I have a piece of code generating a FORM in a web shop. This code fetches order data from a database and outputs each order line. The idea was to have three arrays that I want to use later on, but only one of them works and I cannot figure out why.

<?php

# Fetch product ID and count
$mysqli = new mysqli('localhost', 'user', 'pass', 'db');
$stmt = $mysqli->prepare("SELECT pid, count FROM orders_row WHERE oid = ?");
$stmt->bind_param("i", $_GET['oid']);
$stmt->bind_result($pid, $count);
$stmt->execute();

while($stmt->fetch())
{
	# Fetch more info about each product
	$mysqli2 = new mysqli('localhost', 'user', 'pass', 'db');
	$stmt2 = $mysqli2->prepare("SELECT price, stock, title, orginal_no FROM product_products WHERE pid = ?");
	$stmt2->bind_param("i", $pid);
	$stmt2->bind_result($price, $stock, $title, $orginal_no);
	$stmt2->execute();
	$stmt2->fetch();
	$stmt2->close();
	$mysqli2->close();

# We will need pid[] later...
echo "<input type=\"hidden\" name=\"pid[]\" value=\"".$pid."\" />";

echo "<tr>";
echo "<td><input type=\"checkbox\" name=\"checkboxpid[]\" value=\"".$pid."\"/></td>";
echo "<td>".$pid."</td>";
echo "<td>".$orginal_no."</td>";
echo "<td>".$title."</td>";
echo "<td><input type=\"text\" name=\"count[]\" value=\"".$count."\" style=\"width: 2em\"/></td>";
echo "<td>".$stock."</td>";
echo "<td><input type=\"text\" name=\"price[]\" value=\"".addVAT($price)."\" style=\"width: 5em\"/></td>";
echo "<td>".(addVAT($price)*$count)."</td>";
echo "</tr>";

$total_price += addVAT($price)*$count;
}

$stmt->close();
$mysqli->close();


?>

The three arrays, as you can see, are pid[], count[] and price[]. They all look fine in the HTML code, they have the "[]" in the names and correct values. But when I post the form I get this:

Array
(
    [oid] => 8
    [pid] => 1
    [count] => 1
    [price] => Array
        (
            [0] => 570
            [1] => 482
            [2] => 455
        )

)

Price is the only array. WHY?! 🙂

Weedpacket

Before I address the problem you report, I can point out another problem you can have if you continue with what you're doing: there's nothing that relates the different elements in the different arrays with each other. For example, checkboxes that are not checked are not submitted, so you'll need to do extra work to match up checkbox fields with the others.

To fix that, give all the related fields the same index - the PID would I guess be a good choice (then as a bonus you don't need the hidden field).

echo "<td><input type=\"text\" name=\"count[".$pid."]\" value=\"".$count."\" style=\"width: 2em\"/></td>";
echo "<td>".$stock."</td>";
echo "<td><input type=\"text\" name=\"price[".$pid."]\" value=\"".addVAT($price)."\" style=\"width: 5em\"/></td>";

I can't off-hand see why the posted results would be broken, but this isn't the whole form.
Are there 'pid' and 'count' fields elsewhere (alongside the 'oid' field, perhaps)? That said, as far as I can see, $count will be the same for all rows anyway....

EcceVery

there's nothing that relates the different elements in the different arrays with each other.

I guess you mean that if the order of the elements in the array gets mixed up the whole thing falls apart? I thought about that for a while, but I can't see how that could actually happen unless the browser itself is poorly coded. I'll look into it though, a fair bit of security depends on the order of the elements, does not feel like the best solution...

The checkboxes is used for delete only, does not affect the count/price arrays.

Btw I found the problem with the arrays, a piece of code before the code I posted messed upp some variables. I really HATE spending hours debugging really simple stuff. Took me hours to find and seconds to fix 🙂

bradgrafelman

EcceVery wrote:
I thought about that for a while, but I can't see how that could actually happen unless the browser itself is poorly coded.

If by 'poorly' you actually mean 'properly,' then it is likely to happen. Unchecked checkboxes aren't included in form submissions - they're not supposed to, as per W3C specifications. As such, if you display 5 checkboxes (with related fields), and the user checks 3 of them (in any order), you only get 3 values submitted. Which 3 values? Without Weedpacket's suggestion, there's no way to tell (they'll be numbered as 0, 1, and 2 which could be the first three boxes on the page, the last three, the first and the last two, ... etc.).

EcceVery

No, with poorly I didn't refered to the checkboxes. It doesn't show in the code I posted, but the form has several submit buttons (add, delete, update etc...). The checkboxes are only processed if a row in the form is to be deleted, and in that case none of the other arrays are of importance. I've tested the form in every way possible, checked, changed, added etc and it works flawlessly as far as I can see.

Lets just exclude the checkboxes for now and pretend the only arrays that exists in the HTML form is the pid, count and the price arrays. They are outputted by the script from top to bottom, and therefore they should be postback'ed in that order. This is where my consideration of poorly coded browser thoughts poped up: What if these arrays are not postback'ed in order? Then things would really be messed up.

bradgrafelman

They should be posted back in order, but why not go with Weedpacket's suggestion anyway? It has the added benefit of removing an entire INPUT element form your form anyway.

Weedpacket

You could go further and name the fields item[$pid][price] and item[$pid][count] (and item[$pid][checked]). Then $POST['item'] will be an array of all of the items keyed by pid, and with 'price' and 'count' fields (and a 'checked' if it was indeed checked).

foreach($_POST['item'] as $pid=>$item)
{
   if(isset($item['checked']))
   {
       // do stuff with $pid, $item['price'] and $item['count'];
   }
}