PHP - Preventing Partial Entries Duplicate

Hi all,   Its been a long time since last help request from real professional from here but I'm again in trouble with a much more spectacular plan I'm working on.

For those who are interested in the plan then here it is:
My Idea was to make a new build starting from scratch and make it as dynamical as possible. So my goal is not to make almost anything fixed in the code. I have made a decision to make a one supper large table for multiple different entries so no more joining and no more views for me.! In this help request I'm having trouble with Posting values to a page processing page lets call it record_changer.php The sole purpose of this file is to get form posts and decide what to do. Either update, delete, or insert.

record_changer.php
 

<?php

include '../../config/config.inc.php';

if(is_ajax()){
# Checks if action value exists
  if(isset($_POST["action"]) && !empty($_POST["action"])){
    $action = $_POST["action"];
# Switch case for value of action
    switch($action){
			case "insert": datatable_insert_function();
			break;
			case "update": datatable_update_function();
			break;
			case "delete": datatable_delete_function();
			break;
    }
  }
}

# Function to check if the request is an AJAX request
function is_ajax(){ return isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest'; }

function datatable_insert_function(){
}

function datatable_update_function(){
}

function datatable_delete_function(){
}

?>

The problem.

The problem is that the $insert places two entries to the DB. I cant seem to understand why.?

	# Test _POST values
	$_POST['UserID'] = '2';
	$_POST['WorkID'] = '22';
	$_POST['Status'] = '1';
	$_POST['Code'] = '1';
	$_POST['Title'] = '1';


	$columns = array();
	foreach(array_keys($_POST) as $name){
		# Exclude Action and ID
		if($name == 'Action' || $name == 'ID' || $name == 'submit' ){ continue; }
		$columns[] = $name;
	}

	print_r($columns);

	echo "<br>";

	$data = array_fill_keys($columns, 'NULL');

	print_r($data);

	foreach($data as $key => $value){
		$data[$key] = empty($_POST[$key]) ? 'NULL' : "'".mysql_real_escape_string($_POST[$key])."'";
	}

	echo "<br>";

	print_r($data);

	$insert = mysql_query('INSERT INTO datatable (ID, '.implode(', ',$columns).')VALUES (null, '.implode(',',$data).')') or die(mysql_error());

No errors no nothing. Just two entries of correct data. 
PS. Sorry for a lot of prints in the code it is work and idea in the progress. The posts at the moment are fixed in the code so it is easier to refresh and debug.

Please help if you spot the problem. Im really out of ideas. Some fresh eyes might make a difference.

And Please for those who want to say it is a bad idea and why and why and so on.. Move a long.!!! Im not interested in whinging i have a great use for this and just having trouble with the two entries.

Thanks.
Edited by ztimer, 14 January 2015 - 03:27 PM.

MySQL returns an error in the form of a number, a state, and a message. Without parsing the message you will not be able to determine what column is duplicated.While parsing the error code, I have also notice that, if you have multiple unique fields as duplicates, only the first duplicate encountered will be returned in the message. This is not very helpful to the end user.   Is there any way to parse the returned error code to reflect all duplicate fields, please see sample code below?

$error=array();
$sql = 'INSERT INTO staff(username, email, phone)
VALUES (?, ?, ?)';
$stmt = $conn->stmt_init();
$stmt = $conn->prepare($sql);
// bind parameters and insert the details into the database
$stmt->bind_param('sss', $username, $email, $phone);
$stmt->execute();
if ($stmt->errno == 1062) {
$errors[] = "One of the fields is already in use.";
}

Hello.

I am trying to pass along a variable in an email auto response ($park), however if the variable is 2 words then it only passes along the first word.  Any info would be great.

Code: [Select]
<?php

$to = "$email";
$subject = "Event Signup Confirmation";
$message = "Hello $firstname! 

Thank you for signing up to work the $park event.  Someone will contact you shortly.

Event Information
Park: $park
Date: $orderdate
Time: $hour:$min $ampm
Description: $description
Crew Leader: $leader";

$from = "guy@xxxx.com";
$headers = "From: $from";
mail($to,$subject,$message,$headers);

 
echo "Thank you for signing up. You will receive an email shortly letting you know event details and who your crew leader is.";


?>

Here is where I'm starting:

Code: [Select]

SELECT * FROM wp_usermeta WHERE meta_key = 'wp_1_s2member_custom_fields' AND meta_value LIKE '%3%'


As the PHP produces the page, I'm going to have 15 different options coming from the Code: [Select]
meta_value LIKE  part.  I'm assuming I can set up my 15 different DIVs, each with their own IF  statement involving the meta_value. 

Right?  I'm not going to have to have 15 different queries, am I?


I assume it would start like this:
Code: [Select]
$query = 'SELECT * FROM wp_usermeta WHERE meta_key = "wp_1_s2member_custom_fields"';
$results = mysql_query($query);
while($line = mysql_fetch_assoc($results))

But from there, I don't know if it's possible to deal with partial data with IF statements.

$color=array("01 orange","02 blue","03 red");

If my array was structured this way where the first two characters represented a code, how would I be able to display the code and color distinctly?

Is there a way to look for a File without needing the Extension??

If I have the File...

Code: [Select]
someUserPicture.jpg
...and I have the string "someUserPicture", is there a way to use file_exists() and get it to work properly?

Thanks,


Debbie

Hi guys,

I have this code below that selects and display all events from my database table. E.g if an event titled 'PHP' starts 5th March and ends 6th March (03/05/2012 - 03/06/2012)
Code: [Select]
//SQL QUERY for Event
         $sqlCount = mysql_query("select * from eventcalender");
         $noOfEvent = 0;
         while($Event = mysql_fetch_array($sqlCount)){
$startDate = $Event['startDate'];
$endDate = $Event['endDate'];
                      //split date
                      list($smonth, $sday, $syear) = explode('/',$Event['startDate']);
                      list($emonth, $eday, $eyear) = explode('/',$Event['endDate']);

                      //change date to date time format
                      $start = new DateTime($sday.'-'.$smonth.'-'.$syear); // DD-MM-YYYY
                      $endDate= new DateTime($eday.'-'.$emonth.'-'.$eyear); // DD-MM-YYYY
                      $curdate = new DateTime($i.'-'.$month.'-'.$year);
                     
                      if ($start <= $curdate && $curdate <= $endDate) {
                           $noOfEvent++;
                           $eventTitleList = $eventTitleList."<br />".$Event['Title'];
                      }
         }
My question is if I had a drop down and the user selects a half day or partial day for the end date (03/06/2012) how do I get the calender to display the word (Half day) on the end date without displaying it on the start date so as to indicate on the calender that the end date is a half day.

I would appreciate you help and advice.

Thanks

Hi,

I want to show part of the text from a page containing my article on my main page. The article resides in a database in mysql. How do I limit the amount of text that is shown without setting up a separate excerpt box for the article. I want to then provide a link so the user can go to another page that displays the entire article. Thanks for any suggestions.

Hello,

I wrote a script where i can enter a stock symbol and it get saved in my database. This works, but when i enter the stock symbol i would like to also get the current stock price get saved into the database.

The link for the stock price (i.e. AAPL): http://quote.yahoo.com/d/quotes.csv?s=AAPL&f=l1&e=.csv

How do i programm this in the script below?

Besides above, notice that "AAPL" in the link above has to be a varaible, which changes where i for example type in "GS".

Form:
Quote

<html>
 <body>
   <form action="portfolio/insert_buy.php" method="post">
      Symbol: <input type="text" name="symbol"><br />
      <input type="submit" value=" Submit">
   </form>
 </body>
</html>


PHP-script
Quote

<?php
   $conn = mysql_connect("xxx","xxx","xxx");
   $db      = mysql_select_db("xxx",$conn);

$sql="INSERT INTO portfolio (symbol)
VALUES
('$_POST[symbol]')";

if (!mysql_query($sql,$conn))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

mysql_close($conn);
?>



I hope someone can help me out, thanks!

Hello.

My query results are only pulling partial values for table entries with a space (Example:  AJ Smith only returns AJ and not the full name ).

I am sure this is an easy fix and I am just missing something.

Thank you.

I have a array of file path strings and trying to search the array for a string that would be the end of the path sting and return the index of the file path that contains the string. I've tried using something like this, but it finds the keyword in anyplace in the file path. I've also tried strripos() as well with the same results. Any suggestions?

function array_search_partial($arr, $keyword) {
    foreach ($arr as $index => $string) {
			if(strpos($string, $keyword) !== FALSE) {
				return $index;
			}
    }
}

 

Hi Guy's,

I've recoded allot with 3 scripts i had to my disposal. I've fixed 95% and i'm proud allready, but stuck at the following code. It does'nt execute any errors and refreshes the page without uploading the picture to the desired folder. Also folders are'nt created. I've turned on error reporting at level -1, but those errors i fixed.

Can you please help me out?

note: this is a partial code of a tiny usermanagement 'cms'.

Code: [Select]
<?php
//action: add picture for user -----------------------------------------------------------------------------
if (isset($_GET['editpic']) && isset($_GET['id'])) {
$id = (int) $_GET['id'];
if ($id == 0) {
die("Invalid ID provided.");
}
$sql = "SELECT username FROM `users` WHERE `id`='".$_GET['id']."'";
$res = mysql_query($sql) or die(mysql_error());
//execution when completed the add picture form and pressed submit button ---------------------
if (isset($_POST['addPic'])) {

$row = mysql_fetch_assoc($res);

$title = protect($_POST['title']);

if(!$title)
{
echo "<script language=\"Javascript\" type=\"text/javascript\">
alert(\"You must choose a title for your picture!\")
document.location.href='profilecp.php'</script>";

}

$target = $row['username'];
if(!is_dir($target)) @mkdir($target);
$target = $target . '/pics';

if(!is_dir($target)) @mkdir($target);

$target = $target."/".basename($_FILES['pics']['name']) ;
$size = $_FILES['pics']['size'];
$pic = $_FILES['pics']['name'];
$type = $_FILES['pics']['type'];

$sql2= "INSERT INTO `user_photos` (`profile_id`,`title`,`size`,`type`,`reference`)
VALUES ('".$_GET['id']."','$title','$size','$type','$pic'); ";

$res2 = mysql_query($sql2) or die(mysql_error());

if(move_uploaded_file($_FILES['pics']['tmp_name'], $target))
{
echo "<script language=\"Javascript\" type=\"text/javascript\">
alert(\"Your picture has been uploaded\")
document.location.href='profilecp.php'</script>";
}
else
{
echo "<script language=\"Javascript\" type=\"text/javascript\">
alert(\"There was an error, try again\")
document.location.href='profilecp.php'</script>";
}


$target2 = $row['username'];
$target2 = $target2 . '/pics';
$target2 = $target2 . '/thumbs';
if(!is_dir($target2)) @mkdir($target2);
$target2 = $target2."/".basename($_FILES['pics']['name']) ;
createthumb($target,$target2,150,150);

}


<!-----------------------ADD PICTURES-----------------------//-->

<div class="dividerp">
<form enctype="multipart/form-data" method="POST" action="administrator.php?editpic&amp;id=<?php echo $id;?>"><br/>
<strong>Upload Pictures</strong><br/><br/>

<div class="formElm">
<label for="title">Title</label>
<input id="title" type="text" name="title" maxlength="32"><br/>
</div>

<div class="formElm">
<label for="file">File</label>
<input id="file" type="file" name="pics" maxlength="255"><br/>
</div>

<input type="submit" name="picAdd" value="Add">
</form>
</div>

</div>
</body>
</html>
}?>

and the mysql tables:

Code: [Select]
CREATE TABLE `users` (
`id` INT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY ,
`first` VARCHAR( 32 ) NOT NULL ,
`last` VARCHAR( 32 ) NOT NULL ,
`username` VARCHAR(32) NOT NULL,
`password` VARCHAR(255) NOT NULL,
`email` VARCHAR(255) NOT NULL,
`about` TEXT NOT NULL,
`level` int(4) default '1'
) ENGINE=InnoDB AUTO_INCREMENT=27 DEFAULT CHARSET=latin1;
Code: [Select]
CREATE TABLE `user_photos` (
`id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
`profile_id` INT NOT NULL ,
`title` VARCHAR( 128 ) NOT NULL ,
`size` INT NOT NULL ,
`type` VARCHAR( 128 ) NOT NULL ,
`reference` VARCHAR( 255 ) NOT NULL
) ENGINE=InnoDB AUTO_INCREMENT=27 DEFAULT CHARSET=latin1;
Best regards,

Martijn

I am trying to write a php/mysql that will allow a church keep attendance on their members in bible study. I am also going to try to prevent doing a circular reference between tables and just can't figure it out how since I am just starting to learn mysql. Here are the tables:   Table 1: Members: --------------- 1:Name: 2:Address: 3:Bible Study Group it belongs to:   Table 2: Cells -------------- 1:Bible Study Lider: 2:Bible Group Name   Table 3: Attendance -------------- 1:Date 2:Member 3:Bible Group   As you all can see, Table 2:2 makes a lookup at Table 1 for the member(in this case, the leader). BUT Table 1:3 makes a lookup to Table 2:2 and is a circular lookup.   Anyone have an idea on how to properly do this without any circular problems?   Thanks in advance!          

Basically, I have the following code ($c2 is my connection variable):
Code: [Select]
$rid = $_GET['id'];
$q = mysql_query("SELECT * FROM reports WHERE id = $rid", $c2) or die(mysql_error());
$report = mysql_fetch_array($q);
$report is used later on to gather more information that is outputted to the user.

However, if in the URL, someone were to put id=1', they would have an error message spit out to them (something along the lines of: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1), indicating a SQL Injection exploit.

How would I go about fixing this, and also preventing SQL Injection?

Thanks a bunch,
Mark

Would this work to prevent remote file inclusion vulnerability?

$file = "../include/links.php";
if ($file = '../include/links.php'){
include $file;
}