PHP - Validating User Input

Hi,
I'm using the form data type 'date', and trying to verify it. It seems a little too complicated to check that it's in the correct format (with "/" between day/month/year), unless I use regular expression, which I don't know much about and seems feels like there's an alternate solution or it's not necessary. Currently, the script accepts DD*MM*YYYY, where * is any character, since it just strips the 3rd and 6th character and checks the day/month/year using checkdate().
I'm not even sure if this is a problem. I am giving the user a "verify" page, where I could put it in the correct format (DD/MM/YYYY), but is that enough?
Feel like I'm missing something here, so any feedback would be great

OK so i have a textfield and i have everything going to the database and then displaying on the page.
Now is there a way to display code on the page but disable it from executing?
There are some break tags in there so i would still like them to be executed on the page.

The code below is a function that checks to see if an email address exists in a database, if so it alerts the user. The db has one table and one field. It works fine when there is ONE record! However, if there are > 1 it doesn't work. How can I step through each record and compare it to what the user entered? Of course,  $_POST is the user's value and the db record is the $myAddy value.

<?php
function emailLookup()
{
include ('file:///Library/WebServer/Documents/re_connect_scripts/emailLookup.php');
while ($row = mysqli_fetch_array($result))
{
extract ($row);
$myAddy = $addy;
}
if ($_POST["add_email"] == $myAddy)
{
global $lookupError;
$lookupError = 'This email address is already on the list.';
global $counter;
$counter++;
}
else
{
return;
}
}
?>

I have a page that has roughly 100 text input fields.  Once the user is done, I need to put the data in my mysql db.  How do I get the data from the user input page to the php page that will process the data (e.g. process.php)?

I've done some searching and found a few possibilities use a ajax style call back to load a seperate asp page (e.g. createsession.asp) and that page set session variables that can then be read by process.php write everything to a cookie using some sort of a delimiter so that it can handle multiple variables (e.g. cookie data => var1/var2/var3/var4... write all the data to a text file and then have process.php load that file
Which should I pursue?  Is there a better option?

I have a form a user may submit which has a text area.

If the user enters "Today
is
the
first
day
of

the

week"

it will be stored in the database like that (note the carriage returns etc).

If I then get that data from the table and echo it, it will print as 'Today is the first day of the week'.

How can I print it so that it will retain the user's input formatting/the formatting shown stored in the table?

Well this may sound confusing. I tried to findways to allow users to input an integer value and then assign it to a variable called $quantity, but all I could find from the internet was the usage of forms. Do I have to use forms, or can I just try this this simple syntax:


$quantity = "<input name='quantity' type='text' id='quantity' size='3' maxlength='3'>";


If I do have to use forms, then how can I ever assign user's input value to a variable? Please help.

hello all, i have a php form with multiple submits (one calculates price, one checks date and one submits the form and the data to mysql database)
when i hit calculate price, for example, the function works fine but all the fields are cleared and i would like for all the input to remain as the user sent.
here is part of the code (the form):
Code: [Select]
<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">

<fieldset>
<legend ><span><a>video</span></a></legend>
<ol>
<li>
<label for="hover_camera">hover camera</label>
<input id="hover_camera" type="radio" name="hover_camera" value="yes" /><b>yes</b>
<input id="hover_camera" type="radio" name="hover_camera" value="no"  /><b>no</b>
</li>
<li>
<label for="video_photographers">video photographers</label>
<input id="video_photographers" type="text" name="video_photographers" maxlength="1" size="1"/>
</li>
<li>
<label for="video_edit">video edit</label>
<input id="video_edit" type="radio" name="video_edit" value="short" /><b>short</b>
<input id="video_edit" type="radio" name="video_edit" value="long" /><b>long</b>
</li>
<li>
<label for="video_clip">video clip</label>
     <select name="video_clip">
         <option value="no">no</option>
         <option value="regular">regular</option>
<option value="staged">staged</option>
      </select>
</li>
</ol>
</fieldset><br />

<fieldset align="right"> 
    <legend><span><a>stills</span></a></legend>
<ol>
<li>
<label for="stills">stills</label>
<input id="stills" type="text" name="stills" maxlength="1" size="1"  />
</li>
<li>
<label for="increase">increase amount</label>
<input id="increase" type="text" name="increase" maxlength="4" size="1" />
</li>
<li>
<label for="magnets">magnets</label>
<input id="magnets" type="text" name="magnets" maxlength="4" size="1" />
</ol>
</fieldset><br />

<fieldset align="right"> 
    <legend><span><a>albums</span></a></legend>
<ol>
<li>
<label for="digital_album">digital album</label>
<input id="digital_album" type="radio" name="digital_album" value="yes" /><b>yes</b>
<input id="digital_album" type="radio" name="digital_album" value="no" /><b>no</b>
</li>
<li>
<label for="photo_album">photo album</label>
<input id="photo_album" type="radio" name="photo_album" value="yes" /><b>yes</b>
<input id="photo_album" type="radio" name="photo_album" value="no" /><b>no</b>
</li>
<li>
<label for="small_digital_album">small digital album</label>
<input id="small_digital_album" type="radio" name="small_digital_album" value="yes" /><b>yes</b>
<input id="small_digital_album" type="radio" name="small_digital_album" value="no" /><b>no</b>
</li>
</ol>
</fieldset><br />

<fieldset align="right">
<ol>
<li>
<label for="comments">comments</label>
<textarea id="comments" name="comments"></textarea><br /><br />
</li>
<li>
<label for="price">price</label>
<td><input type="submit" id = "price" name="price" value="calculate price" /></td>
</li>
</ol>
</fieldset><br />


<fieldset align="right"> 
    <legend><span><a>choose date</span></a></legend>
<ol>
<li>



      <input type="submit" id="isavailable" name="isavailable" value="isavailable"  />
  </li>
  </ol>
  </fieldset>
 
  <fieldset class="submit">
<ol>
<li>
<input class="submit" type="submit" id="submit" name="submit" value="done!" />&nbsp;&nbsp;&nbsp; <input class="submit" type="reset" id="reset" name="reset" value="reset" />
</li>
</ol>
</fieldset> 
 
</form>
thanks for the help

I have a family site with a member list and a forum that both run on MySql.
One of the items in the member list is the birthday.

What I like to achieve is that a day or 2 before a member's birthday, a post wil be automaticly inserted in the forum, (a post that contains that this persons birthday is comming up in a few days) without any user input.
I like to have this done automaticly because I don't feel like setting up a cron job for every member seperatly. There are just too many members.
What I need is a script that will create a cron job or something simular the moment a new member registers and updates his profile and sets his birthday.

Hello,

I'm creating an application where a user can input there own CSS. The problem I'm having is understanding if this will open security holes if...

1. Users input is saved to a file called style.css

2. Each user is on their own a sub-domain from my reseller hosting plan.

3. The style.css file will be included in the page code like so:
Code: [Select]
<link type='text/css' rel='stylesheet' href='style.css' />

Any advice?

I manage a simple website for a small business - nothin fancy. I'm interested using some php to enhance the site a bit. I'm looking to accept some user input and put it into a database then display it back to them on another page. What php functions would be best to use to accomplish this?

Thanks for the input!

Ok so I got BB Code working. Now I want to prevent Users from inserting HTML into Posts. I have the following:


    $PostText = mysql_escape_string($_POST['replytext']);
    $Replace = Array ('/(<)(.+)(>)/','/(<\/)(.+)(>)/');
    $ReplaceWith = Array ('&LT;\\2&GT;','&LT;/\\2&GT;');
    $PostText = preg_replace($Replace, $ReplaceWith, $PostText);


Now If I were to input
Code: [Select]
<a href=http://phpfreaks.net>Php Freaks</a>Into a forum reply it would return:
Code: [Select]
<a href=http://phpfreaks.net>Php Freaks

When Checking the database it has:
Code: [Select]
&LT;a href=http://phpfreaks.net>Php Freaks</a&GT;

Any help on solving this?

Hi,

How do I generate a Google Map from user registration form?  For example, user enters username, password, and address.  I want to show the username, address + corresponding map on following confirmation page. 

I have already used static API to render the map as an image, but this is hard-coded.  I don't know how to pass the address into the address param. 

Any help would be much appreciated.  Thanks!

Set up:
    * XAMPP 1.7.3
    * Apache 2.2.14 (IPv6 enabled) + OpenSSL 0.9.8l
    * MySQL 5.1.41 + PBXT engine
    * PHP 5.3.1
    * phpMyAdmin 3.2.4
    * Perl 5.10.1
    * FileZilla FTP Server 0.9.33
    * Mercury Mail Transport System 4.72

I'm trying to set up a multipage registration script. It's tuff! I've set up some basic scripts to distribute variables into the correct tables from previous forms using a session. But I want the script to check the input from form one is valid before it moves on to form 2.

Here are my scripts:
form 1:

<html>
 <head>
  <title>Register</title>
  <style type="text/css">
   td { vertical-align: top; }
  </style>
 </head>
 <body>
  <form action="form2.php" method="post">
   <table>
    <tr>
     <td><label for="name">Username:</label></td>
     <td><input type="text" name="name" id="name" size="20"
       maxlength="20" value=""/></td>
    </tr><tr>
     <td><label for="password">Password:</label></td>
     <td><input type="password" name="password" id="password" size="20"
       maxlength="20" value=""/></td>
    </tr><tr>    
     <td><label for="first_name">First name:</label></td>
     <td><input type="text" name="first_name" id="first_name" size="20"
       maxlength="20" value=""/></td>
    </tr><tr>
     <td><label for="last_name">Last name:</label></td>
     <td><input type="text" name="last_name" id="last_name" size="20"
       maxlength="20" value=""/></td>
    </tr><tr>
     <td><label for="email">Email:</label></td>
     <td><input type="text" name="email" id="email" size="20" maxlength="50"
       value=""/></td>
    </tr><tr>
     <td><label for="address">Address:</label></td>
     <td><input type="text" name="address" id="address" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
     <td><label for="city">City/Town:</label></td>
     <td><input type="text" name="city" id="city" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
 <td><label for="county">County:</label></td>
     <td><input type="text" name="county" id="county" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
 <td><label for="post">Postcode:</label></td>
     <td><input type="text" name="post" id="post" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
 <td><label for="home">Home Number:</label></td>
     <td><input type="text" name="home" id="home" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
 <td><label for="mobile">Mobile:</label></td>
     <td><input type="text" name="mobile" id="mobile" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
     <td> </td>
     <td><input type="submit" name="submit" value="Sumbit"/></td>
    </tr>
   </table>
  </form>
 </body>
</html>


Form 2:

<?php

//let's start the session
session_start();

//now, let's register our session variables
session_register('name');
session_register('password');
session_register('first_name');
session_register('last_name');
session_register('email');
session_register('address');
session_register('city');
session_register('county');
session_register('post');
session_register('home');
session_register('mobile');

//finally, let's store our posted values in the session variables
$_SESSION['name'] = $_POST['name'];
$_SESSION['password'] = $_POST['password'];
$_SESSION['first_name'] = $_POST['first_name'];
$_SESSION['last_name'] = $_POST['last_name'];
$_SESSION['email'] = $_POST['email'];
$_SESSION['address'] = $_POST['address'];
$_SESSION['city'] = $_POST['city'];
$_SESSION['county'] = $_POST['county'];
$_SESSION['post'] = $_POST['post'];
$_SESSION['home'] = $_POST['home'];
$_SESSION['mobile'] = $_POST['mobile'];

?>

<html>
 <head>
  <title>Register</title>
  <style type="text/css">
   td { vertical-align: top; }
  </style>
 </head>
 <body>
  <form action="form3.php" method="post">
   <table>
    <tr>
     <td><label for="bio">Biography:</label></td>
     <td><input type="text" name="bio" id="bio" size="400"
       maxlength="500" value=""/></td>
    </tr><tr>    
     <td> </td>
     <td><input type="submit" name="submit" value="Sumbit"/></td>
    </tr>
   </table>
  </form>
 </body>
</html>



I've also got form3.php and process_forms.php(that's where I mysql_real_escape_string and input the data) but that's probably not relevant. How would I get this to work? Are there any sites I should look at that you'd recommend? Any help appreciated.

Hey guys and gals!

This is my first post here and needing a bit of help with my php code! So here is the deal, i have 3 tables in ms sql 2000 which i will be using on this project.

i have an employee table that has the regular information such as:

TABLE employee( uniqueid, employee_number, lastname, firstname, dob, address, city, state, zip )

TABLE employee_docs( uniqueid, employee_number, doc_type int, date_received, date_issued, date_expired )

TABLE doc_type(uniqueid, description, valid_month)


so basically from the employee_doc table, the doc_type column is an int and will have the description of the document as well as valid month column which will tell you how long the document type is valid until. the Description gives a brief description of what the product is. The uniqueid is used as what ever number is chose from the employee_docs table will represent the document type from table doc_type.

ok so now that i gave a brief explanation of the tables i am working with, I can tell you what i need.

i need a php page that will display:

employee number, lastname, firstname, doc_type, date_received, date_issued, date_expired.

Code: [Select]
select pn.empnum as employeeid, (pn.lastname + ', ' +  pn.firstname)as [Full Name],
dt.description as doc_type,
formatDate(pd.received) as [Date Received],
formatDate(pd.expired)as [Date Expired],
formatDate(pd.issued) as [Date In Service]

from personnel_document pd
left join document_types dt on (dt.uniqueid = pd.doc_type)
left join personnel pn on (pd.empnum = pn.empnum)

where pd.empnum = '$EmpNum'
now, I went ahead and did this for the html part:
 
Code: [Select]
<table border=0>
           
            <tr>
                    <td height=20px weight=1px valign=bottom><span class=underline>DESCRIPTION</span></td>
                            <td height=20px weight=1px valign=bottom><span class=underline>DATE RECEIVED</span></td>
                            <td height=20px weight=1px valign=bottom><span class=underline>LICENSE NUMBER</span></td>
                    <td height=20px weight=1px valign=bottom><span class=underline>DATE IN SERVICE</span></td>
                            <td height=20px weight=1px valign=bottom><span class=underline>DATE EXPIRED</span></td>
                    </tr>
                    <tr>
                    </tr>
                    <tr>
                            <td height=20px valign=bottom><span class=label_text>PHYSICAL EXAM</span></td>
                            <td valign=top><input class=demog_box type=text size=10 name= phexam_dr id=phexam_dr onBlur= 'formatDate(this)' value='<?php echo $phexam_dr;  ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= phexam_ln id=phexam_ln onBlur='formatDate(this)' value='<?php echo $phexam_ln;                              ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= phexam_is id=phexam_is onBlur= 'formatDate(this)' value='<?php echo $phexam_is;                            ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= phexam_ex id=phexam_ex onBlur='formatDate(this)' value='<?php echo $phexam_ex;                             ?>'>&nbsp;</td>
                    </tr>
                    <tr>
                    </tr>
                    <tr>
                            <td height=20px valign=bottom><span class=label_text>PROFESSIONAL LICENSE</span></td>
                            <td valign=top><input class=demog_box type=text size=10 name= prolic_dr id=prolic_dr onBlur='formatDate(this)' value='<?php echo $prolic_dr;                            ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= prolic_ln id=prolic_ln onBlur='formatDate(this)' value='<?php echo $prolic_ln;                            ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= prolic_is id=prolic_is onBlur='formatDate(this)' value='<?php echo $prolic_is;                            ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= prolic_ex id=prolic_ex onBlur='formatDate(this)' value='<?php echo $prolic_ex;                              ?>'>&nbsp;</td>
                    </tr>
                    <tr>
                    </tr>
                    <tr>
                            <td height=20px valign=bottom><span class=label_text>PROFESSIONAL INSURANCE</span></td>
                            <td valign=top><input class=demog_box type=text size=10 name= proins_dr id=proins_dr onBlur='formatDate(this)' value='<?php echo $proins_dr;                            ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= proins_ln id=proins_ln onBlur='formatDate(this)' value='<?php echo $proins_ln;      ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= proins_is id=proins_is onBlur='formatDate(this)' value='<?php echo $proins_is;   ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= proins_ex id=proins_ex onBlur='formatDate(this)' value='<?php echo $proins_ex;   ?>'>&nbsp;</td>
                    </tr>
                    <tr>
                    </tr>
                    <tr>
                            <td height=20px valign=bottom><span class=label_text>DRIVER'S LICENSE</span></td>
                            <td valign=top><input class=demog_box type=text size=10 name=dl_dr id=dl_dr onBlur='formatDate(this)' value='<?php echo $dl_dr; ?>'>&nbsp;
                            </td>
                            <td valign=top><input class=demog_box type=text size=10 name=dl_ln id=dl_ln onBlur='formatDate(this)' value='<?php echo $dl_ln; ?>'>&nbsp;
                            </td>
                            <td valign=top><input class=demog_box type=text size=10 name=dl_is id=dl_is onBlur='formatDate(this)' value='<?php echo $dl_is; ?>'>&nbsp;
                            </td>
                            <td valign=top><input class=demog_box type=text size=10 name=dl_ex id=dl_ex onBlur='formatDate(this)' value='<?php echo $dl_ex; ?>'>&nbsp;
                            </td>
    </tr>
                    <tr>
                    </tr>
                    <tr>

</table>

I am now doing the the sql statement to insert into my db but i am stuck.
i basically want to get the information that the user enters for each field and save it on the employees profile.

$querydoc = "update    personnel_document
                      set empnum = '$EmpNum' , doc_type = ???, date_received = ????, date_expired = ????, date issued = ???
         where empnum = '$EmpNum' ";

The problem is that since each description has a different variable im not sure how to update it.... would I have to create a new update for each description? also I hard coded the name of each description but i believe it is better if i echo the description name from the db as i cant use taht as the doc_type... i am pretty confused, if anyone has a better way of doing this i would really appreciate it!

eventually i also want to make sure that the description is expired to to with the fields I have there and promp the user of something that is expired. Once again, any help given is much appreciated!!!