Bueller Bueller Anyone ...

zooropa

After posting on the General board and getting a vague reply - "Your Form is Wrong" I thought that maybe i should have posted on the coding forum instead.

Please bear with me as i'm fairly new to PHP

I have a simple mysql table tbl_friends consisting of two fields: friends_id (an autonumber primary key) and first_name (varchar)

The following is my attempt at trying to get a checkbox array consisting of 3 names Tom, Dick and Harry to INSERT into the table.

So if the user checks Tom and Harry say, these names will be inserted into the first_name field. When I click the Submit button, the values aren't being inserted into the first_name field. I'd greatly appreciate any help - ideally if you could load up the code for my page checkbox.php (shown below) and try creating the simple table i mention.

I've read so many posts on this and other forums - been trying for 3 days now - I'm tired and I need to complete this for a work-based project!

p.s. I know that i'm connecting to the database ok as i'm able to insert from a text box into a column on another table

<?php

require_once('mysqli_connect.php');

$fn=trim($_POST['first_name']);

foreach($_POST['first_name'] as $fn) { 

$q1="INSERT INTO tbl_friends (first_name) VALUES ('$fn')";     

 mysqli_query($dbc,$q1);

}

?>



<html>

<body>

<form method="post" action="checkbox.php">

<input type="checkbox" name="first_name[]" value="Tom"> Tom <br />

<input type="checkbox" name="first_name[]" value="Dick"> Dick <br />

<input type="checkbox" name="first_name[]" value="Harry"> Harry <br />

<input type="submit" name="submit" value="submit">

</form>

</body>

</html>

mrbaseball34

Your problem lies in the $fn=trim($_POST['first_name']); line.
Remove it and it works fine...I think this is what you want

  foreach($_POST['first_name'] as $fn) {
    $q1="INSERT INTO tbl_friends (first_name) VALUES ('".trim($fn)."')";
    echo "<br>".$q1;
    // mysqli_query($dbc,$q1);
  }

zooropa

Thanks MrBaseball34,

I managed to solve my problem: Code as follows:

<html>
<body>

<form id="form1" name="form1" method="post" action="checkbox.php">

<label>
<input type="checkbox" name="first_name[]" value="Tom" id="test_0" />
Tom</label>

<br />

<label>
<input type="checkbox" name="first_name[]" value="Dick" id="test_1" />
Dick</label>

<br />

<label>
<input type="checkbox" name="first_name[]" value="Harry" id="test_2" />
Harry</label>

<br />

<input type="submit" name="button" id="button" value="Submit" />
</form>
</body>
</html>


<?php
require_once('mysqli_connect2.php');
foreach($_POST['first_name'] as $index => $val){
$q1="INSERT INTO tbl_friends (first_name) VALUES('$val')";
$r = mysqli_query($dbc,$q1);
}
?>

and the contents of mysqli_connect2.php (for a mysql user = mark with password=sprite)are

<?php 

DEFINE ('DB_USER','mark');
DEFINE ('DB_PASSWORD','sprite');
DEFINE ('DB_HOST','localhost');
DEFINE ('DB_NAME','sitename');

$dbc=@mysqli_connect(DB_HOST,DB_USER,DB_PASSWORD,DB_NAME) OR die ('Could not connect to MySQL:'.mysqli_connect_error());

?>

bradgrafelman

Few things:

When posting PHP code, please use the board's [noparse]
```
..
```
[/noparse] bbcode tags as they make your code much easier to read and analyze.

Note that your SQL code being executed in a loop (always a red flag!) could be better optimized. For example, you could insert all of the values in a single query (reducing overhead) like so:

if(!empty($_POST['first_name']) && is_array($_POST['first_name'])) {
    $sql = 'INSERT INTO tbl_friends (first_name) VALUES(';

foreach($_POST['first_name'] as $fn)
    $sql .= "'" . mysqli_real_escape_string($dbc, $fn) . "'), (";

$sql = rtrim($sql, '(, ');

mysqli_query($dbc,$sql);
}

User-supplied data should never be placed directly into a SQL query string. Otherwise, your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize it with a function such as [man]mysqli_real_escape_string/man (for string data) or use prepared statements.

EDIT: Also... don't forget to mark this thread resolved (if it is) using the link on the Thread Tools menu above.

zooropa

Thanks Brad, I just tested out your optimised version (including mysqli_real_escape_function) and it works just great. Thanks for the heads up on putting tags around PHP scripts which i have attempted to do below - hopefully i've got it right!

   

<html>
<body>

<form id="form1" name="form1" method="post" action="checkbox.php">

<label>
<input type="checkbox" name="first_name[]" value="Tom" />
Tom</label>

<br />

<label>
<input type="checkbox" name="first_name[]" value="Dick" />
Dick</label>

<br />

<label>
<input type="checkbox" name="first_name[]" value="Harry" />
Harry</label>

<br />

<input type="submit" name="button" id="button" value="Submit" />
</form>
</body>
</html>

 
<?php
require_once('mysqli_connect2.php');
if(!empty($_POST['first_name']) && is_array($_POST['first_name'])) { 
$q1 = 'INSERT INTO tbl_friends (first_name) VALUES('; 

foreach($_POST['first_name'] as $fn) 
$q1 .= "'" . mysqli_real_escape_string($dbc, $fn) . "'), ("; 

$q1 = rtrim($sql, '(, '); 

mysqli_query($dbc,$q1); 
} 

?>