PHP fill in form help
 

Hey!

so, i have a website thats all coded with html, except for the fill-in form (order form) thats coded with PHP.


i have three issues with my PHP code. :-/
1) i've uploaded my code onto my website but when i go there i get this message:
Parse error: parse error, unexpected $ in /home/content/l/e/o/leopoldine/html/order.php on line 1008
but the issue is that there are only 1007 lines in my whole code!

2) when you hit submit, i receive an email telling me what the person filled in. But once you hit submit, the thanks-for-your-order page doesn't show up.

3) i have PHP Editor 2.22 and when i open my code in it, this "window" thingy is highlighted in red and underlined:
<script language="JavaScript" type="text/JavaScript">
<window.location.href = "http://www.mywebsite.com/ordersent.php";>
</script>

could someone please help me?

1) Paste your script
2)

is more correctly written like so

As it stands, I am not sure whether else if() is allowed. PHP usually copes well with just elseif. JavaScript on the other hands, uses else if instead of elseif. :) I think your first problem might be there.

As Enfernikus also told you, NEVER and I mean NEVER use unregular experessions in your script (javascript). < and > are operators, which are not to be used outside a compareson of sorts. This includes if, else, for, try, catch and so forth.

More to the point, I think your problem lies with the else if.

the IF:
isn't properly closed.

A few things about your code.

Try to format it better, one line IF's can harm readability if they are large in length, and also statements need to be properly indented.
Try to control the amount of white space used to separate different sections and your comments, whilst informative are very bulky and cloud the code, reducing them to one liners and removing comments from obvious code will help.

This excellent post by VillageIdiot will give you more information about formatting code.
http://www.talkphp.com/tips-tricks/1...lean-code.html

Also using preg_match instead of eregi is faster:
note i had to add the two expression delimeters '/' to the start and finish of the expression.

XSS/SQL INJECTION, the addslashes isn't going to be enough to protect against XSS, and also if the data is going to be inputted into a database it also wont protect against SQL injection.

Remember: FIEO (Filter Input Escape Output)

Using mysql_real_escape_string will protect you from SQL injection, whilst using something like htmlentities to convert the special html tags to their entity codes would be a start, it would make this malicious code fail:

would be converted to:
And not executed by the browser.

Although its not fool proof by any means, its a start.

More info: Chris Shiflett: Foiling Cross-Site Attacks

But to answer you question fully, there is a missing '}'.

Eeeeep!
i'm sooo lost! someone made this code for me so i have no clue whats happening or what to do! >.<

I think this is what the code should be like (minus the html):
That will now run, however the script doesnt seem to do anything apart from send an email saying 'an order was placed'

If you are going to use POST variables inside an email, you will have to be careful of mail injection, much like sql injection extra code can be injected into the script. This is usually a favourate exploit of spammers, who can use your form to spam. Usually the way to combat this is to check for any new lines and carrage returns from user input (\n\r).
Should work (im not the best at regex so there are probably ways around it).