Validation

[Cappymoo]

I'm hoping someone can help me here.

I'm trying to make a validation if when a youth member signs up (youth table), it checks the regular members (regular members table) to see if their first and last name exist, if it does, then execute the rest of the script, if not, then display a message saying they need to be a regular member first.

Here is my code, when I try and add in a name that I know exists in the regular members table it still displays the error message. (You do not have a regular membership..... )

Sorry for the long code, but this is what I got. ( I have taken out some code as it was too long to post)

Can anyone see what I have done wrong?

<?php
 session_start();session_destroy();
 session_start();
if($_POST["lastname1"] )
{
	include('connect-db.php');
	$result = mysql_query("SELECT lastname1, firstname1 FROM users") 
                or die(mysql_error());  

	while($row = mysql_fetch_array( $result )) {	
	$lastnameREG = 	$row[lastname1];
	$firstnameREG = $row[firstname1];	
	// print "$row[lastname1] - $row[firstname1] ";
	}
	if($_POST["lastname1"] == $lastnameREG && $_POST["firstname1"] == $firstnameREG )
	{
	$servername="localhost";
    $username="root";
    $password="root";
    $conn=  mysql_connect($servername,$username,$password)or die(mysql_error());
    mysql_select_db("test",$conn);
    $sql="insert into youth (registerBiathlon1,lastname1,firstname1,email,address1,city1,zipcode1,age1,birthdate1,gender1,school1,height1,weight1,beginner1,intermediate1,experienced1,medicalconditions1,medications1,registerBiathlon2,lastname2,firstname2,address2,city2,zipcode2,age2,birthdate2,gender2,school2,height2,weight2,beginner2,intermediate2,experienced2,medicalconditions2,medications2,registerBiathlon3,lastname3,firstname3,address3,city3,zipcode3,age3,birthdate3,gender3,school3,height3,weight3,beginner3,intermediate3,experienced3,medicalconditions3,medications3,parentname1,homephone1,cellphone1,workphone1,email1,parentname2,homephone2,cellphone2,workphone2,email2,volunteerRegistration,volunteerIndoorHelp,volunteerOutdoorHelp,volunteerSkiEquipmentWolrk,lessonsNumber,lessonsTotal,ttamembership_iscurrent,ttamembershipStudentNumber,ttamembershipAdultNumber,ttamembershipFamilyNumber,ttamembershipTotal,skirentalSkisNumber,skirentalPolesNumber,skirentalTotal,skipurchaseNumber,skipurchaseTotal,laserbiathlonNumber,laserbiathlonTotal,skirentalextensionNumber,skirentalextensionTotal,nonvolunteercontributionTotal,latefeeTotal,grandtotal,skiersnames,parentrelease,signature1,date1,membertype)values
	('$_POST[registerBiathlon1]','$_POST[lastname1]','$_POST[firstname1]','$_POST[email]','$_POST[address1]','$_POST[city1]','$_POST[zipcode1]','$_POST[age1]','$_POST[birthdate1]','$_POST[gender1]','$_POST[school1]','$_POST[height1]','$_POST[weight1]','$_POST[beginner1]','$_POST[intermediate1]','$_POST[experienced1]','$_POST[medicalconditions1]','$_POST[medications1]','$_POST[registerBiathlon2]','$_POST[lastname2]','$_POST[firstname2]','$_POST[address2]','$_POST[city2]','$_POST[zipcode2]','$_POST[age2]','$_POST[birthdate2]','$_POST[gender2]','$_POST[school2]','$_POST[height2]','$_POST[weight2]','$_POST[beginner2]','$_POST[intermediate2]','$_POST[experienced2]','$_POST[medicalconditions2]','$_POST[medications2]','$_POST[registerBiathlon3]','$_POST[lastname3]','$_POST[firstname3]','$_POST[address3]','$_POST[city3]','$_POST[zipcode3]','$_POST[age3]','$_POST[birthdate3]','$_POST[gender3]','$_POST[school3]','$_POST[height3]','$_POST[weight3]','$_POST[beginner3]','$_POST[intermediate3]','$_POST[experienced3]','$_POST[medicalconditions3]','$_POST[medications3]','$_POST[parentname1]','$_POST[homephone1]','$_POST[cellphone1]','$_POST[workphone1]','$_POST[email1]','$_POST[parentname2]','$_POST[homephone2]','$_POST[cellphone2]','$_POST[workphone2]','$_POST[email2]','$_POST[volunteerRegistration]','$_POST[volunteerIndoorHelp]','$_POST[volunteerOutdoorHelp]','$_POST[volunteerSkiEquipmentWolrk]','$_POST[lessonsNumber]','$_POST[lessonsTotal]','$_POST[ttamembership_iscurrent]','$_POST[ttamembershipStudentNumber]','$_POST[ttamembershipAdultNumber]','$_POST[ttamembershipFamilyNumber]','$_POST[ttamembershipTotal]','$_POST[skirentalSkisNumber]','$_POST[skirentalPolesNumber]','$_POST[skirentalTotal]','$_POST[skipurchaseNumber]','$_POST[skipurchaseTotal]','$_POST[laserbiathlonNumber]','$_POST[laserbiathlonTotal]','$_POST[skirentalextensionNumber]','$_POST[skirentalextensionTotal]','$_POST[nonvolunteercontributionTotal]','$_POST[latefeeTotal]','$_POST[grandtotal]','$_POST[skiersnames]','$_POST[parentrelease]','$_POST[signature1]','$_POST[date1]','$_POST[membertype]')";
    $result=mysql_query($sql,$conn) or die(mysql_error());		
    print "<h1>You have added your Youth Membership sucessfully</h1>";
	print "<br />";

print "<table border=\"0\" cellpadding=\"5\" cellspacing=\"5\">
<tr>
<td colspan=\"2\"><strong>Skier #1 Information:</strong></td>
<td align=\"right\" style=\"color: red\">$_POST[registerBiathlon1]</td>
<td colspan=\"5\">Check if also Registering for Laser Biathlon</td>
</tr>
<tr>
<td>Last Name</td><td colspan=\"2\" style=\"color: red\">$_POST[lastname1] - $lastnameREG</td>
<td>First Name</td><td colspan=\"4\" style=\"color: red\">$_POST[firstname1]</td>
</tr>
<tr>
<td>Mailing Address:</td>
<td style=\"color: red\">$_POST[address1]</td>
<td>City</td>
<td style=\"color: red\">$_POST[city1]</td>

<td colspan=\"2\" align=\"right\">Zipcode</td>
<td colspan=\"2\" style=\"color: red\">$_POST[zipcode1]</td>

</tr>
<tr>
<td>Age:</td>
<td style=\"color: red\">$_POST[age1]</td>
<td>Birthdate</td>
<td style=\"color: red\">$_POST[birthdate1]</td>
<td>Gender</td>
<td style=\"color: red\">$_POST[gender1]</td>
<td>School</td>
<td style=\"color: red\">$_POST[school1]</td>


</tr>
<tr>


<td colspan=\"1\">Height</td>
<td colspan=\"2\" style=\"color: red\">$_POST[height1]</td>
<td colspan=\"1\" align=\"right\">Weight</td>
<td colspan=\"2\" style=\"color: red\">$_POST[weight1]</td>
<td colspan=\"2\">needed for ski rental or purchase</td>

</tr>
<tr>


<td colspan=\"1\">Level of Experience</td>
<td colspan=\"1\" style=\"color: red\" align=\"right\">$_POST[beginner1] </td><td>Beginner</td>
<td colspan=\"1\" style=\"color: red\" align=\"right\">$_POST[intermediate1] </td><td>Intermediate</td>
<td colspan=\"1\" style=\"color: red\" align=\"right\">$_POST[experienced1] </td><td>Experienced</td>

</tr>
<tr>

<td colspan=\"1\">Medical conditions*</td><td colspan=\"2\" style=\"color: red\">$_POST[medicalconditions1]</td>

<td colspan=\"1\" align=\"right\">Medications</td><td colspan=\"2\" style=\"color: red\">$_POST[medications1]</td>

</tr>
</table>
	";


}
else print "You do not have a regular membership. Please sign up here prior to registering for the Youth Program";
}
else print"invaild input data";


 $to = $_REQUEST['email1'] ; 
 $from = "[e-mail]" ; 
 $name = $_REQUEST['lastname1'] ; 
 $headers = "From: $from"; 
 $subject = "T Youth Membership Form Sumbission"; 

 $fields = array(); 
$fields{"registerBiathlon1"} = "Register for Biathlon"; 
 $fields{"lastname1"} = "Last Name 1"; 
 $fields{"firstname1"} = "First Name 1"; 
  $fields{"email"} = "Email";
 $fields{"address1"} = "Address 1"; 
 $fields{"city1"} = "City 1"; 
 $fields{"zipcode1"} = "Zipcode 1";
 $fields{"age1"} = "Age 1"; 
 $fields{"birthdate1"} = "Birthdate 1"; 	
 $fields{"gender1"} = "Gender 1"; 
 $fields{"school1"} = "School 1"; 	
 $fields{"height1"} = "Height 1"; 
 $fields{"weight1"} = "Weight 1"; 	
 $fields{"beginner1"} = "Beginner 1"; 
 $fields{"intermediate1"} = "Intermediate 1"; 	
 $fields{"experienced1"} = "Experienced 1"; 
 $fields{"medicalconditions1"} = "Medical Conditions 1";
 $fields{"medications1"} = "Medications 1"; 

 $body = "We have received the following information:\n\n"; foreach($fields as $a => $b){ 	$body .= sprintf("%20s: %s\n",$b,$_REQUEST[$a]); } 

 $headers2 = "From: [e-mail]"; 
 $subject2 = "Thank you for contacting us"; 
 $autoreply = "Thank you for contacting us. Somebody will get back to you as soon as possible, usualy within 48 hours. If you have any more questions, please consult our website at www.xxxxxxx.org";

 if($from == '') {print "You have not entered an email, please go back and try again";} 
 else { 
 if($name == '') {print "You have not entered a name, please go back and try again";} 
 else { 
 $send = mail($from, $subject, $body); 
 $send2 = mail($to, $subject2, $autoreply, $body); 
 if($send) 
 {print "<div align=\"center\"><FORM><INPUT TYPE=\"button\" onClick=\"window.print()\" value=\"Print Registration Form\"></FORM></div>";} 

 else 
 {print "We encountered an error sending your mail, please notify [e-mail]"; } 
 }
}
?>

[Emma]

Do a print_r($POST); to see what is actually being posted back, you'll probably find your answer their. if (isset($POST["lastname1"])) would also help but its best to check all your posts anyway.

P.S. Obligatory warning: NEVER put user input into a database without sanitizing it first. Especially as you're asking for very personal data, this is extremely serious.

[Cappymoo]

I'm not sure what happened between yesterday and today, but the script works now and I didn't change a thing. The only thing I did was reboot my computer.

Thanks for your help though.

I'm unsure on how to sanitize user input. I'm new to PHP and haven't a clue on most things yet.

[Emma]

Well I'm glad it's working. Without wishing be disrespectful if you're new to PHP and security should you be dealing with a form that requires such personal information? This has to very secure before you put it live.

Just to prove a point about being careful with data: I can already tell who your client is, not the company you work for (that's obvious), but company who runs the ski trails. I'm not saying this to scare-monger but to remind you that others may look to exploit weaknesses they find.

[Cappymoo]

I am really unsure how you can tell who my client is with the information provided......care to share which part of the code gives it away?

[Emma]

Sent you a PM

[Bonesnap]

Cappymoo;10990041 wrote:

I'm unsure on how to sanitize user input. I'm new to PHP and haven't a clue on most things yet.

Use the mysql_real_escape_string() function to sanitize user input into the database.

[Weedpacket]

Emma wrote:

Just to prove a point about being careful with data: I can already tell who your client is,

Oh, yes; now that I look I see what you mean.

One of the general recommendations we make to people wanting to post is that they first try and cut their problematic code down to the smallest chunk that continues to display the problem and then post that. This tactic has multiple benefits, not least of which is that if you do go ahead and post, you've gone a long way towards mitigating this very risk.

[Cappymoo]

So if I'm reading the documentation correctly... if I add in the folllowing

$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);

and/or

  foreach ($_POST as $key => $value) {
    $_POST[$key] = mysql_real_escape_string($value);
  }

  foreach ($_GET as $key => $value) {
    $_GET[$key] = mysql_real_escape_string($value);
  }

That should work?

[Bonesnap]

That should be fine, but don't put the password through it. Passwords should never be stored in plain text. Instead put your password through a hashing algorithm such as sha1() or md5().

[bradgrafelman]

Also note that [man]mysql_real_escape_string/man is only appropriate for sanitizing string data (hence the word appearing in the very name of the function). In other words, things like this:

  foreach ($_POST as $key => $value) {
    $_POST[$key] = mysql_real_escape_string($value);
  }

  foreach ($_GET as $key => $value) {
    $_GET[$key] = mysql_real_escape_string($value);
  }

are bad in that they assume everything is a string (which isn't always the case), not to mention the fact that you're destroying data integrity (you've modified the only readily available copy of the data the user supplied; if you echo their name now, you'll be greeting someone named "O\'Connor" rather than Mr. O'Connor himself). Plus, it would've been more efficient/compact to use [man]array_map/man instead.

For more information on sanitizing data for SQL queries and/or SQL injections, you might take a look at the relevant page in the PHP manual: [man]security.database.sql-injection[/man].

[Cappymoo]

So it's best to use
$fieldname = mysql_real_escape_string($fieldname);
for every input item in the form?

[bradgrafelman]

Cappymoo;10990102 wrote:

So it's best to use
$fieldname = mysql_real_escape_string($fieldname);
for every input item in the form?

No... it's best to sanitize every form input before using it in a SQL query. Whether you store that sanitized value in a variable is up to you (I personally rarely do, if ever). And again, not every input is always treated as a string.

[Weedpacket]

Personally I think it's best to fold the job of escaping query input data into the database driver itself so that I don't have to worry about it all the time 🙂

[Cappymoo]

Ok, so if I put this into my script

<?php  

    if (isset($_POST['lastname1'])) {  

        echo filter_var($_POST['lastname1'], FILTER_SANITIZE_STRING);  

        echo "<br/><br/>";  

    }  

if (isset($_POST['firstname1'])) {  
    echo filter_var($_POST['firstname1'], FILTER_SANITIZE_STRING);  
    echo "<br/><br/>";  
}  

.....continue with rest of fields

?>  

would that work to sanitize the code? And should it be put right after the session start or within the if statement?

Sorry, I'm a total noob when it comes to this and I just don't understand what I need to do.

[Cappymoo]

After looking what I posted last it really doesn't make sense to me even more as that script is not posting it to the database, it's just echo'ing it to the screen.