PHP - Getting Wrong $_post Value

ok am workin on this script its a points market for a text based game but my money is not taking the amount of the players i points on the market ... just say i post 10 points for $29.000.000 ... and when the player  buys the points it takes the money from that user and give the user points but .... when the user buy the points it dont give the user the money it give $290 ?? not sure is its my SQL av post that to


Code: [Select]
<?php
include 'header.php';

$_POST['buypoints'] =  abs(intval($_POST['buypoints']));{


$result = mysql_query("SELECT * FROM `pointsmarket` WHERE `id`='".$_POST['points_id']."'");
    $worked = mysql_fetch_array($result);
    $price = $worked['price'];
    $amount = $worked['amount'];
  $totalcost = $price * prettynum($_POST['amount']);
  $newpointsinmarket = $amount - prettynum($_POST['amount']);
  $user_points = new User($worked['owner']);

if ($worked['owner'] == $user_class->id) {
echo Message("You have taken ".$_POST['amount']." points off the market.");
$newpoints = $user_class->points + $_POST['amount'];;
$result = mysql_query("UPDATE `grpgusers` SET `points` = '".$newpoints."' WHERE `id`='".$user_class->id."'");
$user_class = new User($_SESSION['id']);
if ($newpointsinmarket == 0){
$result = mysql_query("DELETE FROM `pointsmarket` WHERE `id`='".$worked['id']."'");
} else {
$result = mysql_query("UPDATE `pointsmarket` SET `amount` = '".$newpointsinmarket."' WHERE `id`='".$worked['id']."'");
}
include 'footer.php';
die();
}
  $_POST['amount'] =  abs(intval($_POST['amount']));
$_POST['points_id'] = abs(intval($_POST['points_id']));{

}
$_POST['amount'] =  abs(intval($_POST['amount']));
$_POST['points_id'] = abs(intval($_POST['points_id']));{

}
if ($totalcost > prettynum($user_class->money)){
echo Message("You don't have enough money.");
}
if($_POST['amount'] >= 1 && $_POST['amount'] <= $amount && $totalcost <= $user_class->money){
echo Message("You have bought ".$_POST['amount']." points for $".$totalcost);
$newpoints = $user_class->points + $_POST['amount'];
$newmoney = $user_class->money - $totalcost;
$result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."', `points` = '".$newpoints."' WHERE `id`='".$user_class->id."'");
$newmoney = $user_points->money + $totalcost;
$result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."' WHERE `id`='".$user_points->id."'");
$user_class = new User($_SESSION['id']);
if ($newpointsinmarket == 0){
$result = mysql_query("DELETE FROM `pointsmarket` WHERE `id`='".$worked['id']."'");
} else {
$result = mysql_query("UPDATE `pointsmarket` SET `amount` = '".$newpointsinmarket."' WHERE `id`='".$worked['id']."'");
}
}
}

$_POST['addpoints'] =  abs(intval($_POST['addpoints']));
$_POST['id'] = abs(intval($_POST['id']));{

}
if($_POST['amount'] < 1){

}
if($_POST['price'] < 1){

}
if ($_POST['amount'] >= 1 && prettynum($_POST['amount']) <= $user_class->points && $_POST['price'] >= 1){
echo Message("You have added ".$_POST['amount']." points to the market a price of $".$_POST['price']." per point.");
$result= mysql_query("INSERT INTO `pointsmarket` (owner, amount, price)"."VALUES ('$user_class->id', '$_POST[amount]', '$_POST[price]')");
$newpoints = $user_class->points - $_POST['amount'];
$result = mysql_query("UPDATE `grpgusers` SET `points` = '".$newpoints."' WHERE `id`='".$user_class->id."'");
$user_class = new User($_SESSION['id']);
}

?>
<link href="style.css" rel="stylesheet" type="text/css" />

<tr><td class="contenthead">Point Market</td></tr>
<tr><td align="center" class="contentcontent">
<p>&nbsp;</p>
<p><strong>You need to be a Respected Warrior to add points to the market</strong><br>
Use this form to add points to the points market.</p>
<p><strong>Bank Account[<? echo prettynum($user_class->bank) ?>]</strong><strong></strong><br />
  <strong><a href="pointmarket.php">[Refresh</a>]</strong></p>
<form method='post'>
  <table align="center">
  <tr>
<td>Amount of points</td><td>&nbsp;&nbsp;<input name='amount' type='text' class="areatest" value='0' size='10' maxlength='20'></td>
</tr>
<tr>
<td>Price per point</td><td>$<input name='price' type='text' class="areatest" value="0" size='10' maxlength='20'></td>
<tr><td align="center" colspan="2"><input name='addpoints' type='submit' class="buttong" value='Add Points'></form></td>
</tr></table>
</td></tr>
<tr><td class="contentcontent">
<?php
$result = mysql_query("SELECT * FROM `pointsmarket` ORDER BY `price` DESC");
while($line = mysql_fetch_array($result, MYSQL_ASSOC)) {
$user_points = new User($line['owner']);
if ($user_points->id == $user_class->id){
$submittext = "Remove";
} else {
$submittext = "Buy";
}
echo "<form method='post'>";
echo $user_points->formattedname." - ".$line['amount']." points for ".prettynum($line['price'],1)." per point <input type='text' name='amount' size='3' maxlength='20' value='".prettynum($line['amount'])."'><input type='hidden' name='points_id' value='".$line['id']."'><input type='submit' name='buypoints' value='".$submittext."'></form><br>";
}
?>
</td></tr>
<?php
include 'footer.php';
?>



SQL
Code: [Select]
CREATE TABLE IF NOT EXISTS `pointsmarket` (
  `owner` int(10) NOT NULL default '0',
  `amount` text NOT NULL,
  `price` text NOT NULL,
  `id` int(10) NOT NULL auto_increment,
  PRIMARY KEY  (`id`)
) ENGINE=MyISAM  DEFAULT CHARSET=latin1 ROW_FORMAT=DYNAMIC AUTO_INCREMENT=81 ;

Hi guys, running through this tutorial at the moment:

http://www.tizag.com/phpT/forms.php

I seem to keep having problems with the $_POST variable. Is that obsolete syntax now?

Here's the part I get an error on:

<html>
<body>
<?php
$quantity=$_POST['quantity'];
$item=$_POST['item'];

echo "You ordered".$quantity."".$item.".<br/>.";
echo "Thank you for ordering from Boombaby art supppplies!";

?>
</body>
</html>


Here's the error:


( ! ) Notice: Undefined index: quantity in C:\wamp\www\process.php on line 4
Call Stack
#   Time   Memory   Function   Location
1   0.0009   363936   {main}( )   ..\process.php:0

( ! ) Notice: Undefined index: item in C:\wamp\www\process.php on line 5
Call Stack
#   Time   Memory   Function   Location
1   0.0009   363936   {main}( )   ..\process.php:0
You ordered.
.Thank you for ordering from Boombaby art supppplies!



Any help would be appreciated. I tried googling but everything didn't seem to answer my question or was too confusing.

Thanks.

hello i have a script and i keep getting an error
on php4 i dont get that error
only on php5

<?php
session_start();
error_reporting(E_ALL);
ini_set('display_errors',1);
function query_str($params) {
        $str = '';
                foreach ($params as $key => $value) {
                        $str .= (strlen($str) < 1) ? '' : '&';
                        $str .= $key . '=' . rawurlencode($value);
                }
                 return ($str);
}

if($_GET['id']=='1'){
                $query=parse_str($_POST);
                query_str($query);
                $username=rtrim($username);
                $password=rtrim($password);
                // .... continue
echo $username.':'.$password.chr(10);
}


Code: [Select]
Warning: parse_str() expects parameter 1 to be string, array given in /var/www/poo/do.php on line 15
Warning: Invalid argument supplied for foreach() in /var/www/poo/do.php on line 7
Notice: Undefined variable: username in /var/www/poo/do.php on line 17
Notice: Undefined variable: password in /var/www/poo/do.php on line 18

the html code is this
Code: [Select]
<form  name="Form_Auth" action="do.php?id=1" method="post" target="_top">
<input name="username" id="txt" value="Nome utente" class="nomeutente">
<input name="password" type="password" maxlength="32" id="pass" value="password" class="password lf">
<input name="bottone" type="submit" class="bottone rf" value="Invia" alt="accedi">
</form>

I want to link this two file but not working,  first file to make drop down option form

Hey guys i am using a global filter on my $_POST

function filter($str){return htmlentities($str, ENT_QUOTES);}
$_POST = array_map('filter', $_POST);

It helps me encode the stuff into the database.
It works great on all my fields exept my arrays ...

Ex: fields like this <input type="text" name="name[]" size="20"> breaks

Any sugestions on gething this global filter working?

Ok- I have seen it go both ways on this forum and I was wondering which is correct- or more secure.

I have a script that receives $_POST variables from a form.  Which is better- to change the name of the $_POST variable to do script manipulations or to simple do them with the $_POST['whatever']

$whatever  = $_POST['var_from_form'];

or simply utilize $_POST['var_from_form']

I know it would be less typing changing it to $whatever, but does it really matter?

And yes- register_globals is off.

Cheers-

Hey,

I have a database with user info in it. I was wondering would it be possible to have a link post info to a page and then have that page display info relevant to the received info?...

Link page:
<a href="profile.php?name=<? print $_GET['Username'] ?>" method="post"><? $row['Username'] ?></a>

Profile page:

<?php
$username = $_POST['Username'];
$query = $query = mysql_query('SELECT * FROM users WHERE Username')
?>
You are viewing: <? echo $username ?>'s profile.

Email: <? echo $row['Email'] ?>


I have predefined $row.

Is it possible to do this way or would I have to use a different method?...

Cheers

I have a button that uses $_POST to send information to another page.  The data is in a hidden input so it's not possible for users to change information.  I have nothing to check if the data is correct on the other page.  Is it still possible for people to change the $_POST data though?  Or somehow send false $_POST data to the other page?

Running into some problems with my code.  I am having the user search the Database with either a UAID or the user's full name.  It works fine when you input both the UAID and name; however, I want it to work if only one is give (i.e. just the name or just the UAID).

I decided to use the isset($_POST) function of php but I am not getting it to work correctly.  PHP believe it is set even though it is empty.

Here is my html form.

<?php
@include 'accesscontrol.php';

echo "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\"
      \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">"
     ."<html xmlns=\"http://www.w3.org/1999/xhtml\">"
     ."<title> Hello </title>"
     ."<meta http-equiv=\"Content-Type\"
      content=\"text/html; charset=iso-8859-1\" />"
     ."<head>"
     ."<style type=\"text/css\">"
     ."h1{"
     ."border-bottom-style: double;"
     ."border-bottom-color: black;"
     ."border-bottom-width: 5px;"
     ."}"
     ."p{"
     ."background-color:#4682B4;"
     ."}"
     ."</style>"
     ."</head>"
     ."<body style=\"background-color:#B8B8B8\">"
     ."<table align=\"center\" style=\"background-color:#B8B8B8\" WIDTH=\"100%\" HEIGHT=\"100%\">"
     ."<tr valign=\"middle\">"
     ."<td align=\"center\">"
     ."<form method=\"post\" action=\"user.php\">"
     ."<table align=\"center\" cellpadding=\"10\" style=\"background-color:#5CADFF\" width=\"500\" height=\"400\">"
     ."<tr>"
     ."<th colspan=6 align=\"center\"><h1>Welcome: ".$uid."</h1></th>"
     ."</tr>"
     ."<tr>"
     ."<td colspan=3 width=40% align=center>"
     ."UAID:<br>  <input type=\"text\" size=\"8\" name=\"UAID\" /></td>"
     ."<td colspan=3 width=60% align=center>"
     ."Name (Last, First):<br><input type=\"text\" size=\"8\" name=\"last\"/>, <input type=\"text\" size=\"8\" name=\"first\" />"
     ."</tr>"
     ."<tr>"
     ."<td colspan=6 align=\"center\"><input type=\"submit\" value=\"submit\" />"
     ."</td>"
     ."</tr>"
     ."</tr>"
     ."</table>"
     ."<tr>"
     ."</tr>"
     ."</td>"
     ."</tr>"
     ."</table>"
     ."</body>"
     ."</html>";

?>



Here is the PHP:

<?php
@include 'accesscontrol.php';
//include 'common.php';
include 'db.php';

$fname = $_POST['first'];
$lname = $_POST['last'];

 
 $sql = "SELECT * FROM `user` WHERE UAID='$_POST[UAID]'";
 $result = mysql_query($sql);
 $rows = mysql_fetch_array($result);


if(isset($fname) && isset($lname))
{

echo "Post first $fname <br>"
     ."Post last $lname";
$firstname = $rows['firstname'];
$lastname = $rows['lastname'];

if($fname != $firstname OR  $lname != $lastname)
{
?>
<html>
<head>
<script language="JavaScript">
    alert(" Hello this is crap" ); 
    history.back(); 
 </script>";
</head>
</html>
<?
exit; 

}

else
{ 
 echo "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\"
      \"URL\">"
     ."<html xmlns=URL>"
     ."<title> Hi </title>"
     ."<meta http-equiv=\"Content-Type\"
      content=\"text/html; charset=iso-8859-1\" />"
     ."<head>"
     ."<style type=\"text/css\">"
     ."h1{"
     ."border-bottom-style: double;"
     ."border-bottom-color: black;"
     ."border-bottom-width: 5px;"
     ."}"
     ."p{"
     ."background-color:#4682B4;"
     ."}"
     ."</style>"
     ."</head>"
     ."<body style=\"background-color:#B8B8B8\">"
     ."<table align=\"center\" style=\"background-color:#B8B8B8\" WIDTH=\"100%\" HEIGHT=\"100%\">"
     ."<tr valign=\"middle\">"
     ."<td align=\"center\">"
     ."<table align=\"center\" cellpadding=\"10\" style=\"background-color:#5CADFF\" width=\"600\" height=\"400\">"
     ."<tr>"
     ."<th colspan=6 align=\"center\"><h1>Welcome: ".$uid."</h1></th>"
     ."</tr>"
     ."<tr>"
     ."<form method=\"Post\" action=\"userview.php\">"
     ."<td colspan=3 width=40%>"
     ."UAID:  <input type=\"text\" size=\"8\" name=\"UAID\" value= ".$_POST['UAID']." /></td>"
     ."<td colspan=3 width=60%>"
     ."Name (LAST, FIRST):<input type=\"text\" size=\"8\" name=\"last\"  value= ".$_POST['last']." />,
      <input type=\"text\" size=\"8\" name=\"first\" value= ".$_POST['first']." />"
     ."</td>"
     ."</tr>"
     ."<tr>"
     ."<td colspan=3 width=40%>"
     ."Department:<input type=\"text\" size=\"8\" name=\"department\" value=" .$rows['BOG'].">"
     ."</td>"
     ."<td colspan=3 width=60%>"
     ."Employee ID:<input type=\"text\" size=\"8\" name=\"empID\" value=" .$rows['employeeID'].">"
     ."</td>"
     ."</tr>"
     ."<tr>"
     ."<td colspan=3 align=\"center\"><input type=\"submit\" value=\"View\">"
     ."</form>"
     ."</td>"
     ."<form method=\"Post\" action=\"homepage.php\">"
     ."<td colspan=3 align=\"center\"><input type=\"submit\" value=\"Back\">"
     ."</td>"
     ."</tr>"
     ."</tr>"
     ."</table>"
     ."<tr></tr></td></tr></table></body></html>";

}}
 mysql_free_result($result);
?>

Hi All,

I am having a bit of difficulty with a form I've built that has some PHP elements in it. The issue is it is just not sending the values (which are in hidden fields).

Code is:

Code: [Select]
while($row = mysql_fetch_array($result)){

echo '<tr style="padding: 15px;">';
echo '<td>' . $row['product_id'] . '</td>';
echo '<td>' . $row['name'] . '</td>';
echo '<td>' . $row['catalogue_id'] . '</td>';
                         ?>           
<td>
            <form method="post"  enctype="multipart/form-data" action="<?php echo str_replace( '%7E', '~', $_SERVER['REQUEST_URI']); ?>">
            <!--Hidden Field Checks to see if form has already been sent-->
<input type="hidden" name="editform" value="Y">
            <!--Hidden Fields for Edit Job-->
<input type="hidden" name="prodid" value="<?php echo $row['product_id'] ?>">           
            <input type="hidden" name="prodname" value="<?php echo $row['name'] ?>">
            <input type="hidden" name="catalogue_id" value="<?php echo $row['catalogue_id'] ?>">
            <input type="hidden" name="full_description" value="<?php echo $row['full_description'] ?>">   
            <input type="submit" name="Edit" value="<?php _e('Edit', 'pmimp_trdom' ) ?>" />
            </form>
            </td>

Would it have something to do with splitting up the php tags?
Any help would be apprecited!

Thanks!

I have a form with radio buttons, depending on if a person selects yes, they will be given an answer after they hit submit.

I don't want to do a bunch if un-necessary coding, so I'm trying something else, but it's not working.

My form is this
Code: [Select]
<table width="100%" border="0" cellspacing="0" cellpadding="4">
        <tr>
          <td align="center" valign="top">Yes</td>
          <td align="center" valign="top"><input type="radio" name="phone1" id="phone1" value="1" /></td>
          <td align="center" valign="top">No</td>
          <td align="center" valign="top"><input type="radio" name="phone1" id="phone1" value="2" /></td>
        </tr>
       
      </table>


My code is this
Code: [Select]
  <?php
  if(isset($_POST['submit'])) {

$key;  
$key['phone1'] = "testing phone 1";
$key['phone2'] = "testing phone 2.";
  
foreach( $_POST as $key => $value) {
if($value == "1"){
echo $key."<br />";
}
}
  }
?>

Now, it does not show the wording associated with $key if the value is 1.

Can anybody help me out here? This form is going to have over 100 questions.

Thanks in advance.

Is there an easy way to dump out the contents of a $_POST array and display them on my screen?

(I'm trying to get more comfortable with what is stored in the $_POST array and how it is structured.)

Thanks,


TomTees

hi good day, im a little bit confuse. what i want to do is instead of $username = $_POST['username']; is to transform it into OOP?

please help me. thanks.

This is what I have for code:
Code: [Select]

<?php
$title="Login";
$metakeywords="login, email";
$metadescription="Login to Dating Snap!";

include('header.php');

  $user = clean_up($_POST['email']);
  $pass = clean_up($_POST['password']);
 
if($user && $pass)
{
$pass = md5($pass); //compare the encrypted password
$sql="SELECT id,email,type,password,activation_key FROM `users` WHERE `email`='$user' AND `password`='$pass'";
$query=mysql_query($sql) or die(mysql_error());
 
    if(mysql_num_rows($query) > 0)
    {
      $lllrow = mysql_fetch_assoc($query);
if($lllrow['activation_key'] == 0){
      $_SESSION['id'] = $lllrow['id'];
      $_SESSION['type'] = $lllrow['type'];
      $_SESSION['email'] = $lllrow['email'];
      $_SESSION['password'] = $lllrow['password'];

   $date=date("M d Y");
   $time=date("g:i A");
$sql3 ="UPDATE `users` SET `last_ip`='{$_SERVER['REMOTE_ADDR']}', `last_login`='$date $time' WHERE `id`='".$_SESSION['id']."'";
$res3 = mysql_query($sql3) or die(mysql_error());

}else{
echo "<div class='error'>You need to activate your account first!</div>";
}

echo '<meta http-equiv="REFRESH" content="0;url=index.php">';
    }
    else
   {
    echo "<div class='error'>Email and password combination is incorrect!</div>";
   }
}else{


if(!$_GET['step'] && $_POST['newpassword']){


$email = clean_up($_POST['email']);
$password = clean_up($_POST['newpassword']);


$sql = "SELECT * FROM `users` WHERE `email`='$email'";
$query = mysql_query($sql) or die(mysql_error());

if(mysql_num_rows($query) > 0) 
{
  echo "That email is already being used, please try another.";
}else{

$activation_number = rand( );

$subject = 'Activate your account on datingsnap.com';
$message = 'Dear '.$first.' '.$last.',<br>Thank you for registering for an account on Dating Snap. Please <a href="http://datingsnap.com/index.php?action=activate&id='.$activation_number.'">Click Here</a> to activate your new account.<br>All the best,<br> DatingSnap.com';
$headers = 'From: bobthewebbuilder@gmail.com' . "\r\n" .
    'Content-Type: text/html; charset=\"iso-8859-1\"' . "\r\n" .
    'X-Mailer: PHP/' . phpversion();

 

  $sql = "INSERT into `users`(`activation_key`,`password`,`email`)
  VALUES ('$activation_number','".md5($password)."','$email');";
 
 $query = mysql_query($sql) or die(mysql_error());

echo '<form method="post" action="index.php?action=login&step=1"><table width="100%">
<input id="email" type="hidden" name="email" value="$email">
<table width="100%">
<tr>
<td class="content">*<b>First Name:</b></td>
<td class="content"><input class="tarea" id="first" size="30" type="text" name="first"></td>
</tr>

<tr>
<td class="content">*<b>Last Name:</b></td>
<td class="content"><input class="tarea" id="last" size="30" type="text" name="last"></td>
</tr>

<tr><td width="150" class="content"></td><td class="content"><input type="submit" name="submit" value="Next step"></td></tr></form></table>';

}


if($_GET['step'] == "1" && $_POST['email']){

$email = clean_up($_POST['email']);
$first = clean_up($_POST['first']);
$last = clean_up($_POST['last']);

  $sql = "UPDATE `users` SET `first`='$first',`last`='$last' WHERE `email`='$email'";
 
 $query = mysql_query($sql) or die(mysql_error());

echo '<table width="100%"><form method="post" action="index.php?action=login&step=2">
<input id="email" type="hidden" name="email" value="$email">
<tr>
<td class="content">*<b>Date of birth:</b><br><small>This will be used to calculate your age so be sure to use your correct birth date</small></td><td class="content">
<select name="month" id="month">
<option value="1">January</option>
<option value="2">February</option>
<option value="3">March</option>
<option value="4">April</option>
<option value="5">May</option>
<option value="6">June</option>
<option value="7">July</option>
<option value="8">August</option>
<option value="9">September</option>
<option value="10">October</option>
<option value="11">November</option>
<option value="12">December</option>
</select>
 
<select name="day" id="day">
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
<option value="6">6</option>
<option value="7">7</option>
<option value="8">8</option>
<option value="9">9</option>
<option value="10">10</option>
<option value="11">11</option>
<option value="12">12</option>
<option value="13">13</option>
<option value="14">14</option>
<option value="15">15</option>
<option value="16">16</option>
<option value="17">17</option>
<option value="18">18</option>
<option value="19">19</option>
<option value="20">20</option>
<option value="21">21</option>
<option value="22">22</option>
<option value="23">23</option>
<option value="24">24</option>
<option value="25">25</option>
<option value="26">26</option>
<option value="27">27</option>
<option value="28">28</option>
<option value="29">29</option>
<option value="30">30</option>
<option value="31">31</option>
</select>

<select name="year" id="year">';

 $start_year = ($start_year) ? $start_year - 1 : date('Y') - 110;
    $end_year = ($end_year) ? $end_year : date('Y');
for ($i = $end_year; $i > $start_year; $i -= 1) {
        echo '<option value="'.$i.'">'.$i.'</option>';
    }

echo '</select>

</td>
</tr><tr><td width="150" class="content"></td><td class="content"><input type="submit" name="submit" value="Next step"></td></tr></form></table>';

}




if($_GET['step'] == "2" && $_POST['email']){


$email = clean_up($_POST['email']);
$month=clean_up($_POST['month']);
$day=clean_up($_POST['day']);
$year=clean_up($_POST['year']);

  $sql = "UPDATE `users` SET `bdate`='$year-$month-$day' WHERE `email`='$email'";
 
 $query = mysql_query($sql) or die(mysql_error());


echo "Done step two!";
}


} //end if email

}




include('footer.php');
?>
How come $_POST['email'] isn't getting passed down the steps? I have a hidden field that holds it in each step... what am I overlooking?