TalkPHP
 
 
Account Login
Latest Articles
» The basic usage of PHPTAL, a XML/XHTML template library for PHP
» Vulnerable methods and the areas they are commonly trusted in.
» Simple way to protect a form from bot
» The Basics On: How Session Stealing Works
» How to keep your forms from double posting data
IRC Channel
IRC Speech Bubble Join the friendly bunch on IRC...
(#TalkPHP on Freenode)

...Also available via a web interface.

See this thread for information on the TalkPHP Free Hugs Initiative™. Subject to availability.
Associates
Associates
CSS Tutorials
Reply
 
LinkBack Thread Tools Search this Thread Display Modes
Old 09-14-2007, 03:40 PM   #1 (permalink)
The Frequenter
Prolific Welcomer Upcoming Programmer 
 
Join Date: Sep 2007
Posts: 360
Thanks: 24
Haris is on a distinguished road
Default Confused within forms

PHP Code:
while($row mysql_fetch_array($sql)){
    
$qID $row['id'];
    echo 
"<b>Question ID#</b>".$row['id']." - ".$row['question']."?";
    echo 
"<br><b>1st Choice:</b> $row[choice_1]";
    echo 
" - <b>2nd Choice:</b> $row[choice_2]";
    echo 
" - <b>3rd Choice:</b> $row[choice_3]";
    echo 
" - Edit Choices:<input type=\"radio\" name=\"edit_choices\" value=\"".$qID."\"><br/>";
    echo 
"Delete:<input type=\"checkbox\" name=\"selected_question_array[]\" value=\"".$qID."\">";
    echo 
" - Edit:<input type=\"radio\" name=\"selected_edit_question\" value=\"".$qID."\"><br/>";
    echo 
"<br />";
}
echo 
"<input type=\"submit\" name=\"delete\" value=\"Delete Question\">";
echo 
"<input type=\"submit\" name=\"edit\" value=\"Edit Question\">";
echo 
"<input type=\"submit\" name=\"edit_choice\" value=\"Edit Choice\">";
echo 
"</form>"
The above form renders like:

Question ID#1 - Question here
1st Choice: For - 2nd Choice: Against - 3rd Choice: No choice - Edit Choices:radiobox

Question ID#2 - Question here
1st Choice: For - 2nd Choice: Against - 3rd Choice: No choice - Edit Choices:radiobox

Question ID#3 - Question here
1st Choice: For - 2nd Choice: Against - 3rd Choice: No choice - Edit Choices:radiobox
Delete: checkbox - Edit: radiobox

Delete Button Edit Button Edit Choices Button

The delete button works perfectly. However when an question or a question choices are selected to be edited from the radio boxes. It doesn't shows the results in the end.

delete_edit_questions.php file:

PHP Code:
<?php

// Last Modified 18th August 2007

ob_start();
session_start();

include(
'templates/header.php'); // Header template
include('../config/config.php'); // Includes configuration files
include('../lib/functions.php'); // Load all functions from Library

if(!session_is_registered("username")){
header('Location: index.php');
exit();
}
else {

$submit_delete $_POST['delete'];
if(isset(
$submit_delete)){

$sql mysql_query('SELECT * FROM questions') or die(mysql_error());

$selected_question $_POST['selected_question_array'];
foreach (
$selected_question as $qID){
    
mysql_query("DELETE FROM questions WHERE id='$qID'") or die(mysql_error());
    
mysql_query("DELETE FROM answers WHERE question_id='$qID'") or die(mysql_error());
    echo 
"Questions <b>".$qID."</b> deleted!<br/>";
}

}

elseif(isset(
$_POST['edit_choice'])){
    
$edit_choice_qID $_POST['edit_choices'];
    echo 
"<form method=\"POST\" name=\"choices\">";
    echo 
"First Choice(Positive): <input type=\"text\" name=\"choice_1\"><br>";
    echo 
"Second Choice(Negative): <input type=\"text\" name=\"choice_2\"><br>";
    echo 
"Third Choice(Any): <input type=\"text\" name=\"choice_3\"><br>";
    echo 
"<input type=\"hidden\" value=\"".$edit_choice_qID."\" name=\"edit_choices_qID\">";
    echo 
"<input type=\"submit\" name=\"submit_new_choices\" value=\"Edit\">";
    echo 
"</form>";
    if(isset(
$_POST['submit_new_choices'])){
        echo 
$_POST['choice_1'];
    }
}

elseif(isset(
$_POST['edit'])) {
    
$submit_edit $_POST['edit'];
    
$edit_qID $_POST['selected_edit_question'];
    echo 
"<form method=\"POST\" name=\"questions\">";
    echo 
"Enter new question: <input type=\"text\" name=\"new_question\">";
    echo 
"<input type=\"hidden\" value=\"".$edit_qID."\" name=\"selected_edit_q\">";
    echo 
"<input type=\"submit\" name=\"submit_new_question\" value=\"Edit\">";
    echo 
"</form>";
    
$submit_new_question $_POST['submit_new_question'];
    
$new_question $_POST['new_question'];
    
$edit_ID $_POST['selected_edit_q'];
    if(isset(
$submit_new_question)){
        
mysql_query("UPDATE questions SET question='$new_question' WHERE id='$edit_ID'") or die(mysql_error());
        echo 
"Question successfully changed to ".$new_question;
    }
}

include(
'templates/footer.php'); // Footer Template

}

?>
I think I'm lost between the forms, please help. I think I'm wrong with the elseif conditional statements.
Haris is offline  
Reply With Quote
Old 09-14-2007, 04:20 PM   #2 (permalink)
The Reckoner
Advanced Programmer Top Contributor 
 
Karl's Avatar
 
Join Date: Sep 2007
Posts: 437
Thanks: 22
Karl is on a distinguished road
Default

Could you be a bit more specific as to what isn't working? So for example, say I select a question and then select edit choices. Are you saying that it isn't showing the data for the choices? If so, then that will be cause you need to get that data from the database using the ID you've passed through $_POST['edit_choices'].

On another note, there are also a few variable assignments to $_POST variables that have not been validated. This is generally a bad idea, but for simplicity, you could just ignore the error using @. Here are the ones I noticed:

1 near the top:

$submit_delete = @$_POST['delete'];

and these 3 near the bottom:

$submit_new_question = @$_POST['submit_new_question'];
$new_question = @$_POST['new_question'];
$edit_ID = @$_POST['selected_edit_q'];
Karl is offline  
Reply With Quote
Old 09-14-2007, 04:55 PM   #3 (permalink)
The Frequenter
Prolific Welcomer Upcoming Programmer 
 
Join Date: Sep 2007
Posts: 360
Thanks: 24
Haris is on a distinguished road
Default

Quote:
Originally Posted by Karl View Post
Could you be a bit more specific as to what isn't working? So for example, say I select a question and then select edit choices. Are you saying that it isn't showing the data for the choices? If so, then that will be cause you need to get that data from the database using the ID you've passed through $_POST['edit_choices'].

On another note, there are also a few variable assignments to $_POST variables that have not been validated. This is generally a bad idea, but for simplicity, you could just ignore the error using @. Here are the ones I noticed:

1 near the top:

$submit_delete = @$_POST['delete'];

and these 3 near the bottom:

$submit_new_question = @$_POST['submit_new_question'];
$new_question = @$_POST['new_question'];
$edit_ID = @$_POST['selected_edit_q'];
Hmm, what I want to do is that when someone selects the checkbox to either edit the question or edit the choices for the question. The admin is redirected to edit questions or the choices.

In the delete_edit_questions.php, there are forms for both of the cases.

Edit_choice case

PHP Code:
elseif(isset($_POST['edit_choice'])){
    
$edit_choice_qID $_POST['edit_choices'];
    echo 
"<form method=\"POST\" name=\"choices\">";
    echo 
"First Choice(Positive): <input type=\"text\" name=\"choice_1\"><br>";
    echo 
"Second Choice(Negative): <input type=\"text\" name=\"choice_2\"><br>";
    echo 
"Third Choice(Any): <input type=\"text\" name=\"choice_3\"><br>";
    echo 
"<input type=\"hidden\" value=\"".$edit_choice_qID."\" name=\"edit_choices_qID\">";
    echo 
"<input type=\"submit\" name=\"submit_new_choices\" value=\"Edit\">";
    echo 
"</form>";
    if(isset(
$_POST['submit_new_choices'])){
        echo 
$_POST['choice_1'];
    }

Edit question case:

PHP Code:
elseif(isset($_POST['edit'])) {
    
$submit_edit $_POST['edit'];
    
$edit_qID $_POST['selected_edit_question'];
    echo 
"<form method=\"POST\" name=\"questions\">";
    echo 
"Enter new question: <input type=\"text\" name=\"new_question\">";
    echo 
"<input type=\"hidden\" value=\"".$edit_qID."\" name=\"selected_edit_q\">";
    echo 
"<input type=\"submit\" name=\"submit_new_question\" value=\"Edit\">";
    echo 
"</form>";
    
$submit_new_question $_POST['submit_new_question'];
    
$new_question $_POST['new_question'];
    
$edit_ID $_POST['selected_edit_q'];
    if(isset(
$submit_new_question)){
        
mysql_query("UPDATE questions SET question='$new_question' WHERE id='$edit_ID'") or die(mysql_error());
        echo 
"Question successfully changed to ".$new_question;
    }

Well, after they've entered the desired values in the text field to either edit the choices or the question, the values update the database and returns echo but it's not working. After submitting the form, nothing displays.
Haris is offline  
Reply With Quote
Old 09-14-2007, 05:08 PM   #4 (permalink)
The Reckoner
Advanced Programmer Top Contributor 
 
Karl's Avatar
 
Join Date: Sep 2007
Posts: 437
Thanks: 22
Karl is on a distinguished road
Default

Ok, seems like you've got yourself in a muddle, try the following:

Find the line:

PHP Code:
echo "<input type=\"hidden\" value=\"".$edit_choice_qID."\" name=\"edit_choices_qID\">"
and replace it with:

PHP Code:
echo "<input type=\"hidden\" name=\"edit_choice\">";
echo 
"<input type=\"hidden\" value=\"".$edit_choice_qID."\" name=\"edit_choices\">"
See if that fixes the edit choices part of the script.
Karl is offline  
Reply With Quote
Old 09-14-2007, 07:15 PM   #5 (permalink)
The Frequenter
Prolific Welcomer Upcoming Programmer 
 
Join Date: Sep 2007
Posts: 360
Thanks: 24
Haris is on a distinguished road
Default

Yeah, it fixed it. Why? :O
Haris is offline  
Reply With Quote
Old 09-14-2007, 07:44 PM   #6 (permalink)
The Reckoner
Advanced Programmer Top Contributor 
 
Karl's Avatar
 
Join Date: Sep 2007
Posts: 437
Thanks: 22
Karl is on a distinguished road
Default

The reason why is because when you first submit the form you send two specific POST vars along with it, edit_choices (containing the ID) and edit_choice, which you used to specify the action.

However, on the edit choice page you didn't resend the edit_choice or edit_choices when you resubmitted the form, therefor the following condition failed:

PHP Code:
elseif(isset($_POST['edit_choice'])){ 
So, what I did was resend edit_choice as a hidden var and changed edit_choices_qID to edit_choices - the second change fixed the following assignment:

PHP Code:
$edit_choice_qID $_POST['edit_choices']; 
You've also got similar problems with the edit questions part of the script. Try this fix:

Replace the following line:

PHP Code:
echo "<input type=\"hidden\" value=\"".$edit_qID."\" name=\"selected_edit_q\">"
with this line:

PHP Code:
echo "<input type=\"hidden\" value=\"".$edit_qID."\" name=\"selected_edit_question\">"
and then replace this line:

PHP Code:
$edit_ID = @$_POST['selected_edit_q']; 
with this line:

PHP Code:
$edit_ID $edit_qID
In reality that last replacement isn't needed, instead you should replace all occurences of $edit_ID with $edit_qID. However, either way will work.
Karl is offline  
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 08:43 PM.

 
     

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.1.0
Inactive Reminders By Icora Web Design