PHP - Checking If Where Is Already In Query

Hello all,   Based on the suggestion of you wonderful folks here, I went away for a few days (to learn about PDO and Prepared Statements) in order to replace the MySQLi commands in my code. That's gone pretty well thus far...with me having learnt and successfully replaced most of my "bad" code with elegant, SQL-Injection-proof code (or so I hope).   The one-and-only problem I'm having (for now at least) is that I'm having trouble understanding how to execute an UPDATE query within the resultset of a SELECT query (using PDO and prepared statements, of course).   Let me explain (my scenario), and since a picture speaks a thousand words I've also inlcuded a screenshot to show you guys my setup:   In my table I have two columns (which are essentially flags i.e. Y/N), one for "items alreay purchased" and the other for "items to be purchased later". The first flag, if/when set ON (Y) will highlight row(s) in red...and the second flag will highlight row(s) in blue (when set ON).   I initially had four buttons, two each for setting the flags/columns to "Y", and another two to reverse the columns/flags to "N". That was when I had my delete functionality as a separate operation on a separate tab/list item, and that was fine.   Now that I've realized I can include both operations (update and delete) on just the one tab, I've also figured it would be better to pare down those four buttons (into just two), and set them up as a toggle feature i.e. if the value is currently "Y" then the button will set it to "N", and vice versa.   So, looking at my attached picture, if a person selects (using the checkboxes) the first four rows and clicks the first button (labeled "Toggle selected items as Purchased/Not Purchased") then the following must happen:   1. The purchased_flag for rows # 2 and 4 must be switched OFF (set to N)...so they will no longer be highlighted in red. 2. The purchased_flag for row # 3 must be switched ON (set to Y)...so that row will now be highlighted in red. 3. Nothing must be done to rows # 1 and 5 since: a) row 5 was not selected/checked to begin with, and b) row # 1 has its purchase_later_flag set ON (to Y), so it must be skipped over.   Looking at my code below, I'm guessing (and here's where I need the help) that there's something wrong in the code within the section that says "/*** loop through the results/collection of checked items ***/". I've probably made it more complex than it should be, and that's due to the fact that I have no idea what I'm doing (or rather, how I should be doing it), and this has driven me insane for the last 2 days...which prompted me to "throw in the towel" and seek the help of you very helpful and intellegent folks. BTW, I am a newbie at this, so if I could be provided the exact code, that would be most wonderful, and much highly appreciated.   Thanks to you folks, I'm feeling real good (with a great sense of achievement) after having come here and got the great advice to learn PDO and prepared statements.   Just this one nasty little hurdle is stopping me from getting to "end-of-job" on my very first WebApp. BTW, sorry about the long post...this is the best/only way I could clearly explaing my situation.   Cheers guys!

case "update-delete":
	if(isset($_POST['highlight-purchased'])) 
		{
			// ****** Setup customized query to obtain only items that are checked ******
			$sql = "SELECT * FROM shoplist WHERE";
					for($i=0; $i < count($_POST['checkboxes']); $i++)
						{
							$sql=$sql . " idnumber=" . $_POST['checkboxes'][$i] . " or";
						}
					$sql= rtrim($sql, "or");
											
			$statement = $conn->prepare($sql);
			$statement->execute();
																						
			// *** fetch results for all checked items (1st query) *** //
			$result = $statement->fetchAll();

			$statement->closeCursor();
											
			// Setup query that will change the purchased flag to "N", if it's currently set to "Y"
			$sqlSetToN = "UPDATE shoplist SET purchased = 'N' WHERE purchased = 'Y'";
											
			// Setup query that will change the purchased flag to "Y", if it's currently set to "N", "", or NULL
			$sqlSetToY = "UPDATE shoplist SET purchased = 'Y' WHERE purchased = 'N' OR purchased = '' OR purchased IS NULL";

			$statementSetToN = $conn->prepare($sqlSetToN);
			$statementSetToY = $conn->prepare($sqlSetToY);
											
			/*** loop through the results/collection of checked items ***/
			foreach($result as $row)
				{
					if ($row["purchased"] != "Y")
						{
							// *** fetch one row at a time pertaining to the 2nd query *** //
							$resultSetToY = $statementSetToY->fetch();
															
							foreach($resultSetToY as $row)
								{															
									$statementSetToY->execute();																
								}
						}
					else
						{
							// *** fetch one row at a time pertaining to the 2nd query *** //
							$resultSetToN = $statementSetToN->fetch();
															
							foreach($resultSetToN as $row)
								{															
									$statementSetToN->execute();																
								}
						}
				}
				break;
		}

 CRUD Queston.png   20.68KB   0 downloads    

If you also have any feedback on my code, please do tell me. I wish to improve my coding base.

Basically when you fill out the register form, it will check for data, then execute the insert query. But for some reason, the query will NOT insert into the database. In the following code below, I left out the field ID. Doesn't work with it anyways, and I'm not sure it makes a difference.

Code:

  Code: [Select]
mysql_query("INSERT INTO servers (username, password, name, type, description, ip, votes, beta) VALUES ($username, $password, $name, $server_type, $description, $ip, 0, 1)");
Full code:

Code: [Select]
<?php
include_once("includes/config.php");
 
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title><? $title; ?></title>
<meta http-equiv="Content-Language" content="English" />
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<link rel="stylesheet" type="text/css" href="style.css" media="screen" />
</head>
<body>
 
<div id="wrap">
 
<div id="header">
<h1><? $title; ?></h1>
<h2><? $description; ?></h2>
</div>
 
<? include_once("includes/navigation.php"); ?>
 
<div id="content">
<div id="right">
<h2>Create</h2>
<div id="artlicles">
<?php
 
if(!$_SESSION['user'])
{
 
        $username = mysql_real_escape_string($_POST['username']);
        $password = mysql_real_escape_string($_POST['password']);
        $name = mysql_real_escape_string($_POST['name']);
        $server_type = mysql_real_escape_string($_POST['type']);
        $description = mysql_real_escape_string($_POST['description']);
 
        if(!$username || !$password || !$server_type || !$description || !$name)
        {

        echo "Note: Descriptions allow HTML. Any abuse of this will result in an IP and account ban. No warnings!<br/>All forms are required to be filled out.<br><form action='create.php' method='POST'><table><tr><td>Username</td><td><input type='text' name='username'></td></tr><tr><td>Password</td><td><input type='password' name='password'></td></tr>";
        echo "<tr><td>Sever Name</td><td><input type='text' name='name' maxlength='35'></td></tr><tr><td>Type of Server</td><td><select name='type'>
       
        <option value='Any'>Any</option>
        <option value='PvP'>PvP</option>
        <option value='Creative'>Creative</option>
        <option value='Survival'>Survival</option>
        <option value='Roleplay'>RolePlay</option>
       
        </select></td></tr>
       
        <tr><td>Description</td><td><textarea maxlength='1500' rows='18' cols='40' name='description'></textarea></td></tr>";
        echo "<tr><td>Submit</td><td><input type='submit'></td></tr></table></form>";
        }
        elseif(strlen($password) < 8)
        {
        echo "Password needs to be higher than 8 characters!";
        }
        elseif(strlen($username) > 13)
        {
                echo "Username can't be greater than 13 characters!";
        }
        else
        {
                $check1 = mysql_query("SELECT username,name FROM servers WHERE username = '$username' OR name = '$name' LIMIT 1");
               
                if(mysql_num_rows($check1) < 0)
                {
                        echo "Sorry, there is already an account with this username and/or server name!";
                }
                else
                {
                        $ip = $_SERVER['REMOTE_ADDR'];

                        mysql_query("INSERT INTO servers (username, password, name, type, description, ip, votes, beta) VALUES ($username, $password, $name, $server_type, $description, $ip, 0, 1)");
                        echo "Server has been succesfully created!";
                }
        }
       
}
else
{
        echo "You are currently logged in!";
}
 
?>
</div>
</div>
 
<div style="clear: both;"> </div>
</div>
 
<div id="footer">
<a href="http://www.templatesold.com/" target="_blank">Website Templates</a> by <a href="http://www.free-css-templates.com/" target="_blank">Free CSS Templates</a> - Site Copyright MCTop
</div>
</div>
 
</body>
</html>

Say I have this query:

site.com?var=1

..I have a form with 'var2' field which submits via get.

Is there a way to produce:

site.com?var=1&var2=formdata

I was hoping there would be a quick way to affix, but can't find any info. Also, the query could sometimes be:

site.com?var2=formdata&var=1

I would have to produce:

site.com?var2=updatedformdata&var=1

Is my only option to further parse the query?

I was just wondering if it's possible to run a query on data that has been returned from a previous query?  For example, if I do

Code: [Select]
$sql = 'My query';
$rs = mysql_query($sql, $mysql_conn);

Is it then possible to run a second query on this data such as

Code: [Select]
$sql = 'My query';
$secondrs = mysql_query($sql, $rs, $mysql_conn);

Thanks for any help

I'm trying to update every record where one field in a row is less than the other. The code gets each row i'm looking for and sets up the query right, I hope I combined the entire query into one string each query seperated by a ; so it's like
UPDATE `table` SET field2= '1' WHERE field1= '1';UPDATE `table` SET field2= '1' WHERE field1= '2';UPDATE `table` SET field2= '1' WHERE field1= '3';UPDATE `table` SET field2= '1' WHERE field1= '4';UPDATE `table` SET field2= '1' WHERE field1= '5';
this executes properly if i run the query in phpMyAdmin, however when I run the query in PHP, it does nothing... Any advice?

php5.2, mysql server5.02: if record exists,append random digit to end of information in rows column then add to database

If user mike already exists and another mike is trying to create a user id
I would like to keep the old mike record like it is, then add a new mike record, but add a unique digit to the end of the name mike before the record gets added to the database as a new row.

Thank you kindly!

I have two arrays of keywords that I'm pulling from the database. I'm wanting to compare those two arrays and see if ANY of the contents are the same, if they are push that result into another array for later use.
while($row_rsCWGetupsell = $cartweaver->db->db_fetch_assoc($rsCWGetupsell))
     {
          $b = array_unique(array_filter(explode(",", preg_replace( '/\s*/m', '', $row_rsCWGetupsell["product_keywords"])), "strlen"));
          $a = array_unique(array_filter(explode(",", preg_replace( '/\s*/m', '', $row_rsCWGetProduct["product_keywords"])), "strlen"));
          if($a IN $b) // <--- this is where the comparison should be!
          $list[] = $row_rsCWGetupsell;
     }

I have textfield for signature in my form, I m checking if the signature was sent ( if(!empty($_POST['signature']))   
and if it's not empty I m putting it into the db.

The problem is that, I have noticed a greek user has entered something in greek letters, and function could not deal with it and saved it as it is.( DB field supports greek charset )

I just want to allow english and german chars with special chars ( ",',< etc. ) , no other charset like greek.
How can I do that? any function for this purpose ?

So basically I have a site, and on that site, I have a page that submits a form and updates a database. I have it set up so that someone can enter in Multiple values into a textarea, one on each line, and it will submit each of those values as a new row in the database, but for the life of me, I cannot figure out how to check those values against the actual users.

It is basically a point system, where the staff can award points users of the site. But at the moment, a Staff member could enter in Jibberish, and it would insert that into the database, but I want it to check my users table to make sure the user exists before it inserts it into the database.

here is my code:
<?php
include 'global.php';

echo $headersidebar;


if ($_COOKIE['access'] == $accessstaff)
{





if(count($_POST))
{



$array = preg_split('/(\r?\n)+/', $_POST['studentname']);
foreach($array as $students)
   {
   
   $statusmsg = '<center><span style="background: #A6FF9E;">You have successfully submitted points to the database.</span></center>';
   
   mysql_query("INSERT INTO points (giver, receiver, points, category, reason, date, status) VALUES ('{$_COOKIE['username']}', '{$students}', '{$_POST['pointamt']}', '{$_POST['pointcat']}', '{$_POST['pointreason']}', '{$date}', 'Validating')");
   }
}


$addpointspage = $statusmsg . '

<form action="submit_points.php" method="post">

<table class="table" >

<tr>

<td colspan="10">

<h1><strong><center>Submit Points</center></strong></h1>

</td>

</tr>

<tr>

<td colspan="10" rowspan="100">

<center>Please remember to follow the house point limits when submitting house points.</center>

</td>

</tr>

</table>

<table class="table">

<tr>

<td style="width: 15%;" valign="top">

Student Name:<br> <span style="font-size: 60%;">(List as many as you want; One per Line)</span>

</td>

<td colspan="10">

<center><textarea name="studentname" cols="60" rows="10"></textarea></center>

</td>

</tr>

<tr>

<td style="width: 15%;" valign="top">

Amount of Points:

</td>

<td>

<input style="position: relative; left: 16px;" type="text" size="15" name="pointamt" />

</td>

<td>

Do not put anything that is not a number into this box.

</td>

</tr>

<tr>

<td style="width: 15%;" valign="top">

Point Category:

</td>

<td colspan="10">

<select name="pointcat" style="position: relative; left: 16px;">

<option SELECTED value="">-------</option>

<option>Class Work</option>

<option>Class Exam</option>

<option>Extra Work</option>

<option>Contests</option>

<option>Teacher\'s Assistant</option>

<option>Negative Points</option>

</select>

</td>

</tr>

<tr>

<td style="width: 15%;" valign="top">

Reason:

</td>

<td colspan="10">

<input style="position: relative; left: 16px;" name="pointreason" type="text" size="80" />

</td>

</tr>

<tr>

<td>

</td>

<td colspan="10">

<input style="position: relative; left: 16px;" type="submit" value="Submit Points" />

</td>

</tr>

</table

</form>



';

}

elseif (1==1)
{
$addpointspage = $accessdenied;
}



echo

'

<!-- start content -->

<div id="content">

<div class="post">

<div class="entry">

<p><strong>' . $addpointspage . '</p>

<p class="links">' . $addpointslink . '</p>

</div>

</div>

</div>

<!-- end content -->

<div style="clear: both;">&nbsp;</div>

</div>

<!-- end page -->
</div>';








echo $footer;





?>


I am fairly new to PHP, so I would appreciate any help someone could give me; I am not too good with arrays and such, so this one has got me stumped.

so here's the thing, ive downloaded mysql front and easy php , the HTML code ive written till now is

<html>
<head>
</head>
<body>
<h1>Registration Page</h1>
<form name="form" method="post" action="final-SignUp1.php">
<p>UserName <input type="text" name="username" /></p>
<p>Password <input type="password" name="password" /></p>
<p>Confirm Password<input type="password" name="confirm_password" /></p>
<p>Firstname <input type="text" name="firstname" /></p>
<p>Middlename <input type="text" name="middlename" /></p>
<p>Lastname <input type="text" name="lastname" /></p>
<p>address <input type="text" name="address" /></p>
<p>city <input type="text" name="city" /></p>
<p>Zipcode <input type="text" name="zip_code" /></p>
<p>Phone number <input type="text" name="telephone_number" /></p>
<p>Email address <input type="text" name="email" /></p>
<p>Confirm Email <input type="text" name="confirm_email" /></p>
<input type="submit" value="Register">
<input type="reset" value="Clear" /></p>
</form>
</body>
</html>



which i would like to link to this php code


<?php
$usr=$_POST["username"];
$pass=$_POST["password"];
$confirm=$_POST["confirm_password"];
$firstname=$_POST["firstname"];
$middlename=$_POST["middlename"];
$lastname=$_POST["lastname"];
$address=$_POST["address"];
$city=$_POST["city"];
$zipcode=$_POST["zip_code"];
$phonenumber=$_POST["`telephone_number`"];
$emailaddress=$_POST["email"];
$confirmemailaddress=$_POST["confirm_email"];
$db=mysql_connect("localhost","root","");
mysql_select_db("final-signup1",$db);
$q="INSERT INTO final-signup1 VALUES
('$usr','$pass','$confirm','$firstname','$middlename','$lastname','$address','$city','$zipcode',
'$phonenumber','$emailaddress','$cofirmemailaddress')";
mysql_query($q);
mysql_close();
?>

now on mysql-front  the database ive set till now is as follows




i know something is wrong with my code, because the data i enter in the register page isnt going to the database.

any help is greatly appreciated

thank you

I coded small funny script
I tested it in three hosting

ww.rufaa.net
dallawat.com/new
ibuj.org

but I don't know why in the first link, my script seem slow
not like the other second and third links

I have written the code for email check, but how and where can I put the code to check if a username has been used twice? Thanks in advance.
Code: [Select]
<?php

$servername = "localhost";
$username = "";
$password = "";

//validate fields
if(!$_POST["username"] || !$_POST["email"] || !$_POST["password1"] || !$_POST["password2"]){
echo "<p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><br />Please fill the required fields, <p>&nbsp;</p><p>&nbsp;</p><a href='register.php'>Go to register page</a>";

//validate password
}else if($_POST["password1"] != $_POST["password2"]){
echo "<p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><br />Please go back, PASSWORDS do not match! <p>&nbsp;</p><p>&nbsp;</p><a href='register.php'>Go to register page</a>";

//validate email
}else if(!(eregi("^.+@.+\\..+$", $_POST['email']))){
echo "<p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><br />Please enter a valid EMAIL! <a href='register.php'><p>&nbsp;</p><p>&nbsp;</p>Go to register page</a>";

//validate captcha
}else if(($_SESSION['security_code'] != $_POST['security_code']) || (empty($_SESSION['security_code'])) ){
echo "<p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><br />CAPTCHA CODE does not match! <p>&nbsp;</p><p>&nbsp;</p><a href='register.php'>Go to register page</a>";

}else{
$conn=  mysql_connect($servername,$username,$password)or die(mysql_error());
mysql_select_db("genesis_members",$conn);

// check if already registered
$sql_check = "SELECT * FROM users WHERE email = '".$_POST[email]."'";
$result_check = mysql_query($sql_check,$conn) or die(mysql_error());
$row = mysql_fetch_assoc($result_check);
if($row['id']){
echo "<p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><br />EMAIL already registered! <p>&nbsp;</p><p>&nbsp;</p><a href='register.php'>Go to register page</a>";
}else{

// insert in db
$sql = "INSERT INTO users (username, email, password, company, phone, services) VALUES ('".$_POST[username]."', '".$_POST[email]."', '".$_POST[password1]."', '".$_POST[company]."', '".$_POST[phone]."', '".$_POST[services]."')";
$result = mysql_query($sql,$conn) or die(mysql_error());

echo "<p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><br /><h1>You Have Successfully Registered</h1>";
echo "<p>&nbsp;</p><p>&nbsp;</p><br /><a href='main_login.php'>go to login page</a>";
}
}

?>

Can someone help me to get this code working...

Code: [Select]
public function getBowlContents(){
if is_null($this->contents) {
return "The bowl is empty!";
} else {
return "The bowl contains " . $this->contents . " soup!";
}


TomTees

Hi,
I'm creating an upload section that limits users to upload the following file types:

.pdf
.zip
.rar
.doc
.jpeg
.gif

When getting the type for .pdf files, it comes up as:
application/force-download

and for .rar files it comes up as:
application/x-download

If I do a check that says:

if ($type=="application/force-download" || $type=="application/x-download")

then will users only be able to upload .PDF and .RAR files? I'm assuming these two types will allow other formats as well.

If this is the case, how can I check the extension of the file before the user is able to upload it. I was thinking of somehow capturing the last 3 letters of the filename, and then doing the check that way, except I'm not sure how to go about this. Any insight appreciated!

Hello!

Does anyone know an effective way to track inactive idlers in daily basis?
So that it will count the amount of days no data has been posted to the table. 

E.g.

User posts latest data and inserts timestamp 1282228120 which reads Thursday, August 19th 2010, 14:28:40 (GMT)
The days for inactivity should output as 8 days because no data has been posted from 20th August to today - 28th August.

Anyway I can achieve this?
Any information is appreciated, thanks.