Member Avatar for vivosmith

Hi,

I tried to get this code to work, and the gist is I am trying to allow the user to edit their inputs by allowsing them to edit past submissions. But even after I put "<?php echo ?>" tags in there, it still does not work. It worked perfectly fine on a previous script, but this one does not seem to want to work. I tried making sure it was not the variable, but the variable itself was passed.

 <?php
include('mysqli_connect.php');
echo"Success";
echo '<a href="?logout"> Logout? </a>';
if(isset($_GET['logout']))
{
header ("Location: enter_passcode.html");
}
if(isset($_GET['pass']))
{
$pass=$_GET['pass'];
echo 'pass is set';
$set="SELECT title, ad_body, contact, zip_code, price, email FROM ads WHERE password=SHA1('$pass')"; 
$gets=mysqli_query($dbc,$set);
$results=mysqli_fetch_array($gets,MYSQLI_NUM);
$contact=$results[2];
$ad_body=$results[1];
$zip_code=$results[3];
$price=$results[4];
$email=$results[5];
$title=$results[0];
echo 'GET is set';
}else{ echo 'Get is not set';}
?>
<html>
<form method="post" action="post.php">
Title:
<input type="text"  name="title" value="<?php echo $title; ?>" size="30" /><p>

<textarea name="ad" rows="10" cols="40" size="150">

</textarea><p>

Passcode:<input type="password" name="passcode" size=12 />
Contact:<input type="text" name="contact" value="Enter a website,email, phone number, or other contact detail customers can use to contact you. " size=120/>
<p>Price:<input type="text" name="price" value="<?php echo $price; ?> " size=50/>
Email:<input type="text" name="email" size=50/>
<input type="submit" name="Submit" />
<input type="hidden" name="submitted"/>

</form>

</html>

Any ideas?

  • 3 Contributors
  • 3 Replies
  • 404 Views
  • 4 Hours Discussion Span
  • Latest Post Latest Post by vivosmith

Dani AI

Generated

A few targeted checks will usually find the cause here. already notes the SQL results are null — that almost always means the SELECT returned no rows or the query failed. Common reasons: the GET value used in the WHERE clause doesn’t match the stored hash (extra whitespace, different hashing, URL-encoding), the query has an error, or the variables simply aren’t set before the HTML is emitted. ’s suggestion to inspect the generated HTML is correct; ’s comment about $_POST applies to the later submission handler (post.php) and won’t populate the initial form.

Quick, practical debugging steps:

  • Confirm the URL contains ?pass=… (view the full URL or var_dump($_GET)).
  • Immediately after the query, check for errors and row count so failures are explicit. For example:
if ($gets === false) { die('SQL error: ' . mysqli_error($dbc)); }
if (mysqli_num_rows($gets) === 0) { die('No matching row — check the stored hash and the GET value.'); }
$results = mysqli_fetch_assoc($gets);
var_dump($results);

If the row exists, the next step is safe output into the form and avoiding attribute-breaking characters. Prefer prepared statements and escape output:

$stmt = $dbc->prepare("SELECT title, ad_body, contact, zip_code, price, email FROM ads WHERE password = SHA1(?)");
$stmt->bind_param('s', $pass);
$stmt->execute();
$stmt->bind_result($title, $ad_body, $contact, $zip_code, $price, $email);
$stmt->fetch();
$stmt->close();

Then put values into the form using htmlspecialchars (attributes use ENT_QUOTES; textarea content should be escaped but placed between the tags).

Other short tips: initialize variables to empty strings to avoid notices; enable errors while debugging (ini_set('display_errors',1); error_reporting(E_ALL);); ensure the GET value is URL-encoded if it contains special characters; and avoid sending output before a header() redirect. As a security note, avoid SHA1 for account passwords in new code — use password_hash()/password_verify() instead.

Recommended Answers

All 3 Replies

Member Avatar for jkon

What do you mean ' it still does not work' ? Do you see the page but there isn't any value in those fields ? Viewing the HTML code is there empty where values should be in form ? What do you mean by 'I tried making sure it was not the variable, but the variable itself was passed' ? . Did you inspect in a way (echo it , debug , write in a file or what ever) the variables you want to insert to the form as values before inserting them ?

Member Avatar for jstfsklh211

i dont see anywhere in your code where you get the posted variables
ie $price = $_POST['price']

Member Avatar for vivosmith

I see the forms, but the variable is not entered as the value, thus they are empty. I was passing a variable from before via GET. That would then be how I get the password variable, but the variables that come from the SQL query are NULL, so I am wondering even though the password is right, it could be formatting of the input.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.