Restrictions?

Question

shielaolid -3 Light Poster

14 Years Ago

Hello there, can anyone help me?

i want to put a restrictions in my application form.
for example, "Please complete all the fields"

and here's my code:

<?php
		
		$posapp = $_POST['txtapplied']; 
		$fname = $_POST['txtfname']; 
		$mname = $_POST['txtmname']; 
		$lname = $_POST['txtlname']; 
		$month=$_POST['txtmonth'];
		$day=$_POST['txtday'];
		$year=$_POST['txtyear'];
		$age=$_POST['txtage'];
		$eadd=$_POST['txtemail'];
		$homenumber=$_POST['txthnum'];
		$cpnumber=$_POST['txtcpnumber'];
		$address=$_POST['txtaddress'];
		$religion=$_POST['txtreligion'];
		$birthplace=$_POST['txtbplace'];
		$height=$_POST['txtheight'];
		$weight=$_POST['txtweight'];
		$civilstatus=$_POST['txtcstatus'];
		$college=$_POST['txtcollege'];
		$course=$_POST['txtcourse'];
		$yeargrad=$_POST['txtyeargrad'];
		
		$db=mysql_connect('localhost','root','') or die ('Cannot connect to MYSQL!');
		@mysql_select_db('dbriomra') or die('Cannot connect to database');

		
		$query="INSERT INTO onlineapplication (positionapplied, firstname, middlename, lastname, month, day, year, age, emailaddress, homenumber, cellphone, address, religion, birthplace, height, weight, civilstatus, college, course, yeargrad) VALUES ('$posapp', '$fname', '$mname', '$lname', '$month', '$day', '$year', '$age', '$eadd', '$homenumber', '$cpnumber', '$address', '$religion', '$birthplace', '$height', '$weight', '$civilstatus', '$college', '$course', '$yeargrad')";

       
  //$result = mysql_query($query); 
  
  if(mysql_query($query))
        {
         header('Location: oapp_finished.php');
        }
        else
        {
         echo "<br> Problem Loading";
        }
     
       mysql_close($db);
?>

Thanks

mysql php

4 Contributors
9 Replies
134 Views
8 Hours Discussion Span
Latest Post 14 Years Ago Latest Post by mikulucky

Dani AI

Generated 9 Months Ago

The INSERT is happening before any validation runs, which is why empty rows are being added. Validation and sanitization must be performed first; only when all checks pass should the script write to the database and redirect. was on the right track about checking fields, and and were right to remind you that client-side checks help UX — but they do not replace server-side validation.

Below is a compact server-side pattern to follow (use this as a workflow; the exact names/types depend on your form):

<?php
if ($_SERVER['REQUEST_METHOD'] !== 'POST') exit;

// collect + trim posted values into $data[], build $errors[]
// e.g. check required fields, use filter_var() for email, ctype_digit() for numeric values

if (!empty($errors)) {
    // show errors and do NOT run any DB code
    foreach ($errors as $e) echo $e.'<br>';
    exit;
}

// use PDO or mysqli prepared statements (do not use deprecated mysql_*)
// prepare, bind and execute; check the execute result before redirecting
header('Location: oapp_finished.php');
exit;
?>

Quick checklist and troubleshooting steps:

Validate BEFORE you build/run the INSERT. Move all checks above the database code.
Confirm the form uses method="post" and each input name exactly matches the server keys.
Use filter_var() for emails and ctype_digit() or filter_var(..., FILTER_VALIDATE_INT) for numeric fields.
Switch from mysql_* to PDO or mysqli prepared statements to avoid SQL injection and to get reliable error reporting.
Add DB constraints (NOT NULL, correct column types) so the database refuses invalid rows as a last line of defense.
During development enable error reporting and dump $_POST to see what is actually submitted.

Useful docs: filter_var() manual, PDO prepared statements, and HTML5 required for client-side hints (MDN).

All 9 Replies

phorce 131 Posting Whiz in Training

14 Years Ago

You could..

if(!isset($_POST['txtapplied']))
{
    echo 'You have not completed this field';
}else{
  $posapp = $_POST['txtapplied']; 
}

Do it for all of them =)

Member #120589

14 Years Ago

I'd suggest you use client-side (js) validation - see jQuery validation for info (http://bassistance.de/jquery-plugins/jquery-plugin-validation/)

You will however have to have server-side validation.

Check to see all required fields are filled and are of the correct data type / witihin acceptable range etc.

A few ideas here:

phorce 131 Posting Whiz in Training

14 Years Ago

Like this:

<?php
 
if(!isset($_POST['txtapplied']))
{
    echo 'You have not completed this field';
}else{
  $posapp = $_POST['txtapplied']; 
}

if(!isset($_POST['txtfname']))
{
  echo 'You have not entered your first name';
}else{
  $fname = $_POST['txtfname'];
}
// etc
		$mname = $_POST['txtmname']; 
		$lname = $_POST['txtlname']; 
		$month=$_POST['txtmonth'];
		$day=$_POST['txtday'];
		$year=$_POST['txtyear'];
		$age=$_POST['txtage'];
		$eadd=$_POST['txtemail'];
		$homenumber=$_POST['txthnum'];
		$cpnumber=$_POST['txtcpnumber'];
		$address=$_POST['txtaddress'];
		$religion=$_POST['txtreligion'];
		$birthplace=$_POST['txtbplace'];
		$height=$_POST['txtheight'];
		$weight=$_POST['txtweight'];
		$civilstatus=$_POST['txtcstatus'];
		$college=$_POST['txtcollege'];
		$course=$_POST['txtcourse'];
		$yeargrad=$_POST['txtyeargrad'];
 
		$db=mysql_connect('localhost','root','') or die ('Cannot connect to MYSQL!');
		@mysql_select_db('dbriomra') or die('Cannot connect to database');
 
 
		$query="INSERT INTO onlineapplication (positionapplied, firstname, middlename, lastname, month, day, year, age, emailaddress, homenumber, cellphone, address, religion, birthplace, height, weight, civilstatus, college, course, yeargrad) VALUES ('$posapp', '$fname', '$mname', '$lname', '$month', '$day', '$year', '$age', '$eadd', '$homenumber', '$cpnumber', '$address', '$religion', '$birthplace', '$height', '$weight', '$civilstatus', '$college', '$course', '$yeargrad')";
 
 
  //$result = mysql_query($query); 
 
  if(mysql_query($query))
        {
         header('Location: oapp_finished.php');
        }
        else
        {
         echo "<br> Problem Loading";
        }
 
       mysql_close($db);
?>

I'd also do further checks, this is just an example =)

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

shielaolid -3 Light Poster · Answer 1 · 2012-01-06T03:37:44+00:00

<?php
 
		$posapp = $_POST['txtapplied']; 
		$fname = $_POST['txtfname']; 
		$mname = $_POST['txtmname']; 
		$lname = $_POST['txtlname']; 
		$month=$_POST['txtmonth'];
		$day=$_POST['txtday'];
		$year=$_POST['txtyear'];
		$age=$_POST['txtage'];
		$eadd=$_POST['txtemail'];
		$homenumber=$_POST['txthnum'];
		$cpnumber=$_POST['txtcpnumber'];
		$address=$_POST['txtaddress'];
		$religion=$_POST['txtreligion'];
		$birthplace=$_POST['txtbplace'];
		$height=$_POST['txtheight'];
		$weight=$_POST['txtweight'];
		$civilstatus=$_POST['txtcstatus'];
		$college=$_POST['txtcollege'];
		$course=$_POST['txtcourse'];
		$yeargrad=$_POST['txtyeargrad'];
 
		$db=mysql_connect('localhost','root','') or die ('Cannot connect to MYSQL!');
		@mysql_select_db('dbriomra') or die('Cannot connect to database');
 
 
		$query="INSERT INTO onlineapplication (positionapplied, firstname, middlename, lastname, month, day, year, age, emailaddress, homenumber, cellphone, address, religion, birthplace, height, weight, civilstatus, college, course, yeargrad) VALUES ('$posapp', '$fname', '$mname', '$lname', '$month', '$day', '$year', '$age', '$eadd', '$homenumber', '$cpnumber', '$address', '$religion', '$birthplace', '$height', '$weight', '$civilstatus', '$college', '$course', '$yeargrad')";
 
 
  //$result = mysql_query($query); 
 
  if(mysql_query($query))
        {
         header('Location: oapp_finished.php');
        }
        else
        {
         echo "<br> Problem Loading";
        }
 
       mysql_close($db);

if(!isset($_POST['txtapplied']))
{
    echo 'You have not completed this field';
}else{
  $posapp = $_POST['txtapplied']; 
}
?>

like this?

Member #120589 · Answer 2 · 2012-01-06T03:39:19+00:00

like this?

No

You need to test before running any code not after. That's like lifting your petticoat after you've pissed.

Member #120589 · Answer 3 · 2012-01-06T03:50:30+00:00

A nice-looking PHP validation library here:

http://www.benjaminkeen.com/software/php_validation/

It may be overkill and I haven't tried it, but it resembles a js validation library that I used to use a while ago. May be worth a look - especially if you have a large number of fields to check. Creating a custom test for every single field is tiresome.

shielaolid -3 Light Poster · Answer 4 · 2012-01-06T03:51:30+00:00

Phorce, i tried it, but it's not working, but it is still adding in the database even if its null.

shielaolid -3 Light Poster · Answer 5 · 2012-01-06T03:54:42+00:00

A nice-looking PHP validation library here:
http://www.benjaminkeen.com/software/php_validation/
It may be overkill and I haven't tried it, but it resembles a js validation library that I used to use a while ago. May be worth a look - especially if you have a large number of fields to check. Creating a custom test for every single field is tiresome.

Well thanks ardav, i will check it :)

mikulucky 25 Junior Poster in Training · Answer 6 · 2012-01-06T05:34:06+00:00

I think you would be better off using JQuery to check the form before you pass it to the PHP script. It is better design, easier coding and generally better all round.

Restrictions?

Dani AI

Recommended Answers Collapse Answers

All 9 Replies

Recommended Answers