|
PHP - Form Fails When Double Forward Slashes Entered.
So I built a form and if anyone puts // in the text area field named Code: [Select]
name="background" it won't work... it fails. This prevents users from entering website URLs, which is an issue since the form is related to website design. I think I have everything else working just fine. Any ideas how I can change this so it will work and allow // ? There may be other things that cannot be entered or maybe a security risk I am missing... here is the code... Code: [Select] <?php // version 2.2 // All placeholders that are used such as {yourEmail@yourDomain.com}, {yourSolve360Token}, {ownership}, // {categoryId}, {templateId} should be replaced with real values without the {} brackets. // REQUIRED Edit with the email address you login to Solve360 with define('USER', 'me@me.com'); // REQUIRED Edit with token, Workspace > My Account > API Reference > API Token define('TOKEN', 'itentionallydeleted'); // Get request data $requestData = array(); parse_str($_SERVER['QUERY_STRING'], $requestData); // Configure service gateway object require 'Solve360Service.php'; $solve360Service = new Solve360Service(USER, TOKEN); // // Preparing the contact data // $contactFields = array( // field name in Solve360 => field name as specified in html form 'firstname' => 'firstname', 'lastname' => 'lastname', 'businessemail' => 'businessemail', 'cellularphone' => 'cellularphone', 'background' => 'background', ); // kill form if spammers use the siteURL field if ( $_GET['url'] != '' || $_GET['firstname'] == 'Your Name' || $_GET['businessemail'] == 'Email Address' ) {header("Location: http://www.openpotion.com/new/error");} else { $contactData = array( // OPTION Apply category tag(s) and set the owner for the contact to a group // You will find a list of IDs for your tags, groups and users in Workspace > My Account > API Reference // To enable this option, uncomment the following: // Specify a different ownership i.e. share the item 'ownership' => 18634876, // Add categories 'categories' => array( 'add' => array('category' => array(18660073)) ), ); // adding not empty fields foreach ($contactFields as $solve360FieldName => $requestFieldName) { if ($requestData[$requestFieldName]) { $contactData[$solve360FieldName] = $requestData[$requestFieldName]; } } // // Saving the contact // // Check if the contact already exists by searching for a matching email address. // If a match is found update the existing contact, otherwise create a new one. // $contacts = $solve360Service->searchContacts(array( 'filtermode' => 'byemail', 'filtervalue' => $contactData['businessemail'], )); if ((integer) $contacts->count > 0) { $contactId = (integer) current($contacts->children())->id; $contactName = (string) current($contacts->children())->name; $contact = $solve360Service->editContact($contactId, $contactData); } else { $contact = $solve360Service->addContact($contactData); $contactName = (string) $contact->item->name; $contactId = (integer) $contact->item->id; } if (isset($contact->errors)) { // Mail yourself if errors occur mail( USER, 'Error while adding contact to Solve360', 'Error: ' . $contact->errors->asXml() ); die ('System error'); } else { // Mail yourself the result mail( USER, 'A new sales lead has been posted to Solve360', 'Contact "' . $contactName . '" https://secure.solve360.com/contact/' . $contactId . ' was posted to Solve360', 'From: noreply@openpotion.com' . PHP_EOL . 'Reply-To: ' . $contactData['businessemail'] . PHP_EOL . 'X-Mailer: PHP/' . phpversion() ); } // // OPTION Adding a activity // /* * You can attach an activity to the contact you just posted * This example creates a Note, to enable this feature just uncomment the following request * */ /* // Preparing data for the note $noteData = array( 'details' => nl2br($requestData['note']) ); $note = $solve360Service->addActivity($contactId, 'note', $noteData); // Mail yourself the result mail( USER, 'Note was added to "' . $contactName . '" contact in Solve360', 'Note with id ' . $note->id . ' was added to the contact with id ' . $contactId ); // End of adding note activity */ // // OPTION Inserting a template of activities // /* * You can also insert a template directly into the contact you just posted * You will find a list of IDs for your templates in Workspace > My Account > API Reference * To enable this feature just uncomment the following request * */ /* // Start of template request $templateId = {templateId}; $template = $solve360Service->addActivity($contactId, 'template', array('templateid' => $templateId)); // Mail yourself the result mail( USER, 'Template was added to "' . $contactName . '" contact in Solve360', 'Template with id ' . $templateId . ' was added to the contact with id ' . $contactId ); // End of template request */ header("Location: http://www.website.com/thank-you"); } ?> Thanks a ton in advance! Jason [attachment deleted by admin] Similar TutorialsAm new here - looks like a great foru! I would sincerely appreciate any help anyone can give me. I have been trying to solve my problem for hours and I am not having any luck, so I thought I would post and see if anyone can help. I am very stuck and am not making much progress on this project, and I am certain the answer is very simple. I am constructing a form to collect data for a specialized purpose. The form and program actually work for its intended function, but I am trying to enhance the user experience by preventing customers from having to reenter all of their data should there be a problem with any of the data submitted. I have been able to do that with the contact form portion, but what I am having trouble with is the portion which has as many as 400 possible entries. So, in a nutshell, if the customers contact data is incomplete or in error, the form will ask them to return to the page and correct things. The previous data entered has been saved in the session and the input value will equal the previous entry. i.e. <tr> <td align="right" class="infoBox"><?php echo ENTRY_EMAIL_ADDRESS; ?></td> <td align=left><?php echo "<input type=text name='cemail' value=\"$cemail\" size=35 maxlength=35>" ?></td> </tr> Works perfectly, all well and good there. On the other 400 more or less entries, I am having a difficult time tweaking the string concatenation to work to achieve similar results. There are 4 columns each with $points entries asking for a dimension in either feet or inches. The <input name=> is one of ptaf,ptai,ptbf,ptbi, appended programatically with the corresponding row number or data point. i.e. "ptaf1", "ptai1", etc... This is produced by the example below and works perfectly also. <?php { $points=100; $i=1; while ($i <= $points) {echo ' <tr><td align="center" width="6"><b> ' .$i . '</b></td> <td align="right" NOWRAP>A' .$i . ' (ft) <input type="text" name="ptaf'.$i.'" size=4 maxlength=3> </td> <td align="right" NOWRAP>A' .$i . ' (in) <input type="text" name="ptai'.$i.'" size=4 maxlength=4> </td> <td align="right" NOWRAP>B' .$i . ' (ft) <input type="text" name="ptbf'.$i.'" size=4 maxlength=3> </td> <td align="right" NOWRAP>B' .$i . ' (in) <input type="text" name="ptbi'.$i.'" size=4 maxlength=4> </td> '; $i++; } } ?> I am trying to add <input value=$ptai.$i> for each field but as I mentioned I am not having any luck. It seems as if I have tried every combination imagineable, but still no luck. My head is spinning! The closest I seem to have gotten was with this: <td align="right" NOWRAP>A' .$i . ' (ft) <input type="text" size=6 maxlength=3 name="ptaf'.$i.'" value="' . "$ptaf" . $i . '" ></td> But line 17 for example returns this: <input type="text" value="17" name="ptaf17" maxlength="3" size="6"> To recap, I am trying to have the value set to whatever the customer may have entered previously. Again, I would most appreciate any help anyone can give me. If you need clarification on anything please let me know. Thanks AJ I have various elements of a form template stored in the database. When i retrieve them with _fetch_object and then insert them into a different table the slashes get removed. I need the slashes intact because these are eventually read with eval(). Is there a specific field type I can use? How do i keep the slashes there? I need it to stay just like it is. I'm using PHP/Mysql I put this in: <table><tr><td width=\"658\" id=\"center\"><input type=\"text\" name=\"line_item[]\" value=\"$field1\" size=\"6\" maxlength=\"13\" class=\"Standard\" id=\"PageLine\" /><input type=\"hidden\" name=\"line_item[]\" value=\"$field2\" /><input type=\"hidden\" name=\"line_item[]\" value=\"$field3\" /><input type=\"hidden\" name=\"line_item[]\" value=\"$field4\" /><input type=\"hidden\" name=\"line_item[]\" value=\"$field5\" /></td></tr></table> Then when it gets retrieved and re-inserted I get this: <table><tr><td width="658" id="center"><input type="text" name="line_item[]" value="$field1" size="6" maxlength="13" class="Standard" id="PageLine" /><input type="hidden" name="line_item[]" value="$field2" /><input type="hidden" name="line_item[]" value="$field3" /><input type="hidden" name="line_item[]" value="$field4" /><input type="hidden" name="line_item[]" value="$field5" /></td></tr></table> Hi, I created a form and the trying to forward it to testphp.php. However, it is forwarding but not displaying the score according to the drop down test. If I set any of drop down option to No, then 10 must minus from the total. However, the output is always zero irrespective of the input. Code: [Select] <html> <head> <title>Billing IE</title> </head> <body > <form id="audit_billing_IE" name="audit_billing_IE" method="post" action="testphp.php"> <table> <tr> <td background-color="green"> Evaluator Name </td> <td> <input type="text" name=evaluator_name id="evaluator_name"/> </td> </tr> <tr> <td> Agent Name </td> <td> <input type="text" name=user_name id="user_name"/> </td> </tr> <tr> <td> Processing Date </td> <td> <input type="text" name="processing_date" id="processing_date"/> </td> </tr> <tr> <td> Review Date </td> <td colspan="3"> <input type="text" name="review_date" id="review_date"/> </td> </tr> <tr> <td> Contact ID </td> <td colspan='3'> <input type="text" name=contact_ID id="contact_ID"/> </td> </tr> <tr> <td> Voice/Non Voice </td> <td colspan='3'> <input type="text" name=audit_type id="audit_type"/> </td> </tr> <tr> <td> A/C #/Case # </td> <td colspan='3'> <input type="text" name=case_no id="case_no"/> </td> </tr> <tr> <td> Product </td> <td colspan='3'> <input type="text" name=product_name1 id="product_name"/> </td> </tr> <tr> <td> Call duration</td> <td colspan='3'> <input type="text" name=product_name2 id="product_name"/> </td> </tr> <tr> <td> Errors </td> <td colspan='3'> <input type="text" name=product_name3 id="product_name"/> </td> </tr> <tr> <td> Parameter A </td> <td colspan='3'> <input type="text" name=product_name4 id="product_name"/> </td> </tr> <tr> <td> Parameter B </td> <td colspan='3'> <input type="text" name=product_name5 id="product_name"/> </td> </tr> <tr> <td> Parameter C </td> <td colspan='3'> <input type="text" name=product_name6 id="product_name"/> </td> </tr> <tr> <td> Parameter D </td> <td colspan='3'> <input type="text" name=product_name7 id="product_name"/> </td> </tr> <tr> <td> Parameter E </td> <td colspan='3'> <input type="text" name=product_name8 id="product_name"/> </td> </tr> <tr> <td> Parameter F </td> <td colspan='3'> <input type="text" name=product_name9 id="product_name"/> </td> </tr> <tr> <td> Parameter G </td> <td colspan='3'> <input type="text" name=product_name10 id="product_name"/> </td> </tr> <tr> <td> Parameter H </td> <td colspan='3'> <input type="text" name=product_name11 id="product_name"/> </td> </tr> <tr> <td> Parameter I </td> <td colspan='3'> <input type="text" name=product_name12 id="product_name"/> </td> </tr> <tr> <td> Parameter J </td> <td colspan='3'> <input type="text" name=product_name13 id="product_name"/> </td> </tr> <tr> <td> Total Possible Points for Audit </td> <td colspan='3'> <input type="text" name=product_name14 id="product_name"/> </td> </tr> <tr> <td> Total Points Obtained for the Audit </td> <td colspan='3'> <input type="text" name=product_name15 id="product_name"/> </td> </tr> <tr> <td> Assessment Score </td> <td colspan='3'> <input type="text" name=product_name16 id="product_name"/> </td> </tr> <tr align="centre"> <th> <span style="color:white" BGcolor="Blue"><b> PARAMETERS </span> </th> <th> <span style="color:white"><b> TOGGLE </span> </th> <th> <span style="color:white"><b> COMMENTS </span></th> <th> <span style="color:white"><b> SCORES </span> </th> </tr> <tr> <td colspan="4" bgcolor="CCCC66" align="left"> <b> A. Credit approval </b> </td> </tr> <tr> <td> Procedure </td> <td> <select name=Para_A_A1 id = "Para_A_A1" align="center"> <option value="Yes"> Yes </option> <option value="No"> No </option> <option value="NA"> NA </option> </select> </td> <td > <input type="text" name=Para_A_A1_comment id="Para_A_A1_comment"/> </td> <td align="center"> <input type="text" name=Para_A_A1_score id="Para_A_A1_score"/> </td> </tr> <tr> <td> Days Calculation (Service issue case)</td> <td> <select name=Para_A_A2 id = "Para_A_A2" align="center"> <option value="Yes"> Yes </option> <option value="No"> No </option> <option value="NA"> NA </option> </select> </td> <td > <input type="text" name=Para_A_A2_comment id="Para_A_A2_comment"/> </td> <td> <input type="text" name=Para_A_A2_score id="Para_A_A2_score"/> </td> </tr> <tr> <td> Credit request </td> <td> <select name=Para_A_A3 id = "Para_A_A3" align="center"> <option value="Yes"> Yes </option> <option value="No"> No </option> <option value="NA"> NA </option> </select> </td> <td > <input type="text" name=Para_A_A3_comment id="Para_A_A3_comment"/> </td> <td> <input type="text" name=Para_A_A3_score id="Para_A_A3_score"/> </td> </tr> <tr> <td> closure </td> <td> <select name=Para_A_A4 id = "Para_A_A4" align="center"> <option value="Yes"> Yes </option> <option value="No"> No </option> <option value="NA"> NA </option> </select> </td> <td > <input type="text" name=Para_A_A4_comment id="Para_A_A4_comment"/> </td> <td> <input type="text" name=Para_A_A4_score id="Para_A_A4_score"/> </td> </tr> <tr> <td> Comments / interaction </td> <td> <select name=Para_A_A5 id = "Para_A_A5" align="center"> <option value="Yes"> Yes </option> <option value="No"> No </option> <option value="NA"> NA </option> </select> </td> <td > <input type="text" name=Para_A_A5_comment id="Para_A_A5_comment"/> </td> <td> <input type="text" name=Para_A_A5_score id="Para_A_A5_score"/> </td> </tr> <tr> <td> TEXT updation </td> <td> <select name=Para_A_A6 id = "Para_A_A6" align="center"> <option value="Yes"> Yes </option> <option value="No"> No </option> <option value="NA"> NA </option> </select> </td> <td > <input type="text" name=Para_A_A6_comment id="Para_A_A6_comment"/> </td> <td> <input type="text" name=Para_A_A6_score id="Para_A_A6_score"/> </td> </tr> <tr> <td> <input name="submit" type="submit" id="submit" value="Submit Details" /> <input name="Reset" type="reset" value="Reset"> </td> </tr> </div> </table> </form> </div> </div> </body> </html> Below is the testphp.php Code: [Select] <?php $question1 = $_POST['Para_A_A1']; $question2 = $_POST['Para_A_A2']; $question3 = $_POST['Para_A_A3']; $question4 = $_POST['Para_A_A4']; $question5 = $_POST['Para_A_A5']; $question6 = $_POST['Para_A_A6']; { $numberofansweredquestions = 0; $score = 0; if ($question1 == "YES") { $numberofansweredquestions++; $score += 10; } else if ($question1 == "NO") { $numberofansweredquestions++; } if ($question2 == "YES") { $numberofansweredquestions++; $score += 10; } else if ($question2 == "NO") { $numberofansweredquestions++; } if ($question3 == "YES") { $numberofansweredquestions++; $score += 10; } else if ($question3 == "NO") { $numberofansweredquestions++; } if ($question4 == "YES") { $numberofansweredquestions++; $score += 10; } else if ($question4 == "NO") { $numberofansweredquestions++; } if ($question5 == "YES") { $numberofansweredquestions++; $score += 10; } else if ($question5 == "NO") { $numberofansweredquestions++; } if ($question6 == "YES") { $numberofansweredquestions++; $score += 10; } else if ($question6 == "NO") { $numberofansweredquestions++; } $maxscore = $numberofansweredquestions * 10; echo "The score is: " . $score . "/" . $maxscore . ""; } ?> Form forward is not working in below code. Once I click on submit button, it is not forwarding the results to codetesting.php. <html> <head> </head> <body> <form method="post" action="codetesting.php"> <select name="Para"> <option value="Yes"> Yes </option> <option value="No"> No </option> <option value="NA"> NA </option> </select> </form> <input type="submit" name="submit" value="Submit"> </body> </html> Greetings, I am trying to create a basic booking system, for example there may be 3 events that a user can book. If the user clicks 'Book Now' on Event #1 I need it to take them to the HTML/PHP booking form with the information already entered that is relevant to Event #1 (Or whatever event they choose), such as the event name, time, date etc I know how to create a contact form etc, its just the carrying of the information over to the form I dont know how to do. Does anyone know if this is possible/ how it could be achieved? Any help will be much appreciated, Thanks! I have deleted mysql info for safety reasons. Here are the two webpage's codes i'm using right now menu.php <? session_start(); if(!session_is_registered(myusername)){ header("location:login.php"); } ?> <html><title>ChronoServe - Saving Time</title> <link href="style.css" rel="stylesheet" type="text/css"> <body> <table width="100%" border="0" cellpadding="0" cellspacing="0" class="container"> <tr> <td> <table width="335px" height="50%" border="1" align="center" cellpadding="0" cellspacing="0" class="centered"> <tr> <td> <form method="post" action="insertvalues.php"> <table width="100%" border="0" align="center" cellpadding="3" cellspacing="10"> <tr> <td colspan="2"><div align="center" class="font2">Activation Information</div></td> </tr> <tr> <td colspan="2"></td> </tr> <tr> <td width="40%" class="font3">First Name :</td> <td width="60%"> <div align="center"> <input name="firstname" type="text" class="font3" id="firstname" maxlength="25" /> </div></td> </tr> <tr> <td class="font3">Last Name :</td> <td> <div align="center"> <input name="lastname" type="text" class="font3" id="lastname" maxlength="25" /> </div></td> </tr> <tr> <td height="28" class="font3">Phone Number :</td> <td> <div align="center"> <input name="pnumber" type="text" class="font3" id="pnumber" maxlength="10" /> </div></td> </tr> <tr> <td class="font3">Personnel Activated :</td> <td> <div align="center"> <input name="numberactivated" type="text" class="font3" id="numberactivated" maxlength="3" /> </div></td> </tr> <tr> <td height="37" colspan="2"></td> </tr> <tr> <td colspan="2"><div align="center"> <input name="submit" type="Submit" class="font3" value="Submit" /> </div> </td> </tr> </table> </form></td> </tr> </table> </td> </tr> </table> </body> </html> insertvalues.php <?php if(isset($_POST['Submit'])) { $firstname = $_POST['firstname']; $lastname = $_POST['lastname']; $pnumber = $_POST['pnumber']; $numberactivated = $_POST['numberactivated']; mysql_connect ("deleted", "deleted", "deleted") or die ('Error: ' . mysql_error()); mysql_select_db ("deleted"); $query = "INSERT INTO disney_database (id, firstname, lastname, pnumber, numberactivated, date) VALUES ('NULL', '".$firstname."', '".$lastname."', '".$pnumber."', '".$numberactivated."', 'NULL')"; mysql_query($query) or die('Error updating database'); header("location:menu.php"); echo "Database Updated With: ".$firstname."" - "".$lastname."" - "".$pnumber."" - "".$numberactivated.""; } else { echo "Database Error" { ?> Here is my problem. I set a one <form> on every form field I have including the submit button. Now whenever I press the submit button it redirects to insertvalues.php which it should be doing. In insertvalues i told it to query the form data and post it into my database's table. Its not doing that and tells me that it has a database error which i set it to tell me if something goes wrong. Anyone can help me? BTW I can manually query in the information using sql with phpmyadmin. so can someone please review my code for me? thanks big help! You can see what is happening. Visit www.chronoserve.com The username and password are "admin" This topic has been moved to HTML Help. http://www.phpfreaks.com/forums/index.php?topic=316203.0 I'm building a php program that registers users onto a website. With the help of people from this thread http://www.phpfreaks.com/forums/index.php?topic=332260.15 I was able to accomplish the goal and now the signup works with conditions that check for a valid email, and if the password is strong enough. T he program correctly displays the the problem when a user does NOT enter a valid email, or a strong enough password, but the user has to re-enter the email and password everytime. I want to make it so that the fields remained populated with what the user entered previously, so he or she does not have to re-enter his or her email/password. Here is the code (its really ghetto) Code: [Select] <?php function check_email_address($email) { // First, we check that there's one @ symbol, and that the lengths are right if (!ereg("^[^@]{1,64}@[^@]{1,255}$", $email)) { // Email invalid because wrong number of characters in one section, or wrong number of @ symbols. return false; } // Split it into sections to make life easier $email_array = explode("@", $email); $local_array = explode(".", $email_array[0]); for ($i = 0; $i < sizeof($local_array); $i++) { if (!ereg("^(([A-Za-z0-9!#$%&'*+/=?^_`{|}~-][A-Za-z0-9!#$%&'*+/=?^_`{|}~\.-]{0,63})|(\"[^(\\|\")]{0,62}\"))$", $local_array[$i])) { return false; } } if (!ereg("^\[?[0-9\.]+\]?$", $email_array[1])) { // Check if domain is IP. If not, it should be valid domain name $domain_array = explode(".", $email_array[1]); if (sizeof($domain_array) < 2) { return false; // Not enough parts to domain } for ($i = 0; $i < sizeof($domain_array); $i++) { if (!ereg("^(([A-Za-z0-9][A-Za-z0-9-]{0,61}[A-Za-z0-9])|([A-Za-z0-9]+))$", $domain_array[$i])) { return false; } } } return true; } define('DB_NAME', 'catch'); define('DB_USER', 'username'); define('DB_PASS', 'password'); define('DB_HOST', 'page.sqlserver.com'); // contact to database $connect = mysql_connect(DB_HOST, DB_USER, DB_PASS) or die('Error , check your server connection.'); mysql_select_db(DB_NAME); //Get data in local variable $v_name=$_POST['name']; $v_email=$_POST['email']; $v_msg=$_POST['msg']; if ( check_email_address($_POST['name']) == false) { $query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')"; $result = mysql_query( $query ); if( !$result ) { die( mysql_error() ); } echo <<<EOD <head> <link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css"> </head> <h2>Free Registration</h2> <form action="contact_insert2.php" method="POST" id="insert"> <table> <tr> <td>Email</td> <td ><input type="text" size="40" name="name"></td> </tr> <tr> <td>Password</td> <td><input type="password" size="40" name="msg" ></td> </tr> <tr> <td colspan=2 id="sub"> You must enter a valid email. <br /> <input type="submit" name="submit" value="submit"> </td> </tr> </Table> </form> EOD; } if( $v_name == "" || $v_msg == "" ) // if name is empty or if pass is empty { $query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')"; $result = mysql_query( $query ); if( !$result ) { die( mysql_error() ); } echo <<<EOD <head> <link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css"> </head> <h2>Free Registration</h2> <form action="contact_insert2.php" method="POST" id="insert"> <table> <tr> <td>Email</td> <td ><input type="text" size="40" name="name"></td> </tr> <tr> <td>Password</td> <td><input type="password" size="40" name="msg" ></td> </tr> <tr> <td colspan=2 id="sub"> You must enter an email and password. <br /> <input type="submit" name="submit" value="submit"> </td> </tr> </Table> </form> EOD; } if( strcspn( $_REQUEST['msg'], '0123456789' ) == strlen( $_REQUEST['msg'] ) ) // the above statement says if pass does not contain a number { $query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')"; $result = mysql_query( $query ); if( !$result ) { die( mysql_error() ); } echo <<<EOD <head> <link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css"> </head> <h2>Free Registration</h2> <form action="contact_insert2.php" method="POST" id="insert"> <table> <tr> <td>Email</td> <td ><input type="text" size="40" name="name"></td> </tr> <tr> <td>Password</td> <td><input type="password" size="40" name="msg" ></td> </tr> <tr> <td colspan=2 id="sub"> <div style="color:red;">Your password must contain a number.</div> <br /> <input type="submit" name="submit" value="submit"> </td> </tr> </Table> </form> EOD; } if( strlen($_POST['msg']) < 8 ) // the above statement says if pass is not 8 characters long { $query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')"; $result = mysql_query( $query ); if( !$result ) { die( mysql_error() ); } echo <<<EOD <head> <link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css"> </head> <h2>Free Registration</h2> <form action="contact_insert2.php" method="POST" id="insert"> <table> <tr> <td>Email</td> <td ><input type="text" size="40" name="name"></td> </tr> <tr> <td>Password</td> <td><input type="password" size="40" name="msg" ></td> </tr> <tr> <td colspan=2 id="sub"> <div style="color:red;">Your password must be at least 8 characters long.</div> <br /> <input type="submit" name="submit" value="submit"> </td> </tr> </Table> </form> EOD; } if ( $_POST['msg'] == strtolower($_POST['msg']) ) // the above statement says if pass is all lowercase { $query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')"; $result = mysql_query( $query ); if( !$result ) { die( mysql_error() ); } echo <<<EOD <head> <link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css"> </head> <h2>Free Registration</h2> <form action="contact_insert2.php" method="POST" id="insert"> <table> <tr> <td>Email</td> <td ><input type="text" size="40" name="name"></td> </tr> <tr> <td>Password</td> <td><input type="password" size="40" name="msg" ></td> </tr> <tr> <td colspan=2 id="sub"> <div style="color:red;">Your password must have at least one capital letter.</div> <br /> <input type="submit" name="submit" value="submit"> </td> </tr> </Table> </form> EOD; } if ( preg_replace("/[^a-zA-Z0-9\s]/", "", $_POST['msg']) == $_POST['msg'] ) // the above statement says if pass contains no special characters { $query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')"; $result = mysql_query( $query ); if( !$result ) { die( mysql_error() ); } echo <<<EOD <head> <link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css"> </head> <h2>Free Registration</h2> <form action="contact_insert2.php" method="POST" id="insert"> <table> <tr> <td>Email</td> <td ><input type="text" size="40" name="name"></td> </tr> <tr> <td>Password</td> <td><input type="password" size="40" name="msg" ></td> </tr> <tr> <td colspan=2 id="sub"> <div style="color:red;">Your password must have at least one special character.</div> <br /> <input type="submit" name="submit" value="submit"> </td> </tr> </Table> </form> EOD; } else echo <<<EOD <B>GO FUCK YOURSELF</B> EOD; ?> Hi Guys, I'm struggling with a submit form via ajax. This is the code, but I've been looking for about 3 hours and cannot work out why it doesnt submit the form... Any ideas?
<script type="application/javascript">
function addForm() {
$.ajax({type:'POST', url: 'cart.php?ajax=1&a=add&domain=register', data:$('#add-form').serialize(), success: function(response) {
$('#add-form').find('.form_result').html(response);
}});
return false;
}
function transferForm() {
$.ajax({type:'POST', url: 'cart.php?ajax=1&a=add&domain=transfer', data:$('#transfer-form').serialize(), success: function(response) {
$('#transfer-form').find('.form_result').html(response);
}});
return false;
}
</script>
My code is mixed with smarty but the call is just a standard call
{foreach from=$availabilityresults key=num item=result}
{if $result.status eq "available"}
<form method="post" id="add-form" onsubmit="return addForm();">
{else}
<form method="post" id="transfer-form" onsubmit="return transferForm();">
{/if}
<table width="700" border="0" cellspacing="5" cellpadding="0">
<input type="hidden" name="domain" value="{$result.domain}" />
<tr style="border-bottom: #333 1px solid;">
<td rowspan="2">{if $result.status eq "available"}<img src="templates/dj/yes.jpg" />{else}<img src="templates/dj/no.jpg" />{/if}</td>
{if $result.status eq "available"}<td style="color:#339933;" />{$result.domain|replace:$domain:''}</td>{else}<td style="color:#cc0000;" />{$result.domain|replace:$domain:''}</td>{/if}
<td rowspan="2">{$result.domain}</td>
<td rowspan="2">{if $result.status eq "unavailable"}{else}
<select name="domainsregperiod[{$result.domain}]">
{foreach key=period item=regoption from=$result.regoptions}
<option value="{$period}">{$period} {$LANG.orderyears} @ {$regoption.register}</option>
{/foreach}
</select>
{/if}</td>
<td rowspan="2">{if $result.status eq "available"}
<input type="image" src="templates/dj/add-basket.jpg" border="0" alt="Add to Basket" /><div class="form_result"> Added to Basket </div>
{else}
<input type="image" src="templates/dj/transfer.jpg" border="0" alt="Transfer to Us" />
{/if}</td>
</tr>
<tr>
<td>{if $result.status eq "available"}Available{else}Taken{/if}</td>
</tr>
<tr><td colspan="8" style="height:1px; background-color:#999;"></td></tr>
</table>
</form>
{/foreach}
Hello, I have a contact form that is not working. It just keeps providing the failed delivery message specified in the contact. php file. Any help would be much appreciated. Thanks, Code: [Select] <?php $field_department = $_POST['cf_department']; $field_message = $_POST['cf_message']; $mail_to = 'blah@blah.com'; $subject = 'Website Feedback'; $body_message .= 'Addressed to: '.$field_department."\n"; $body_message .= 'Message: '.$field_message; $mail_status = mail($mail_to, $subject, $body_message); if ($mail_status) { ?> <script language="javascript" type="text/javascript"> alert('Thank you for your feedback.'); window.location = 'contact.html'; </script> <?php } else { ?> <script language="javascript" type="text/javascript"> alert('Message failed. Please, send an email to blah@blah.com'); window.location = 'contact.html'; </script> <?php } ?> ------------------------------------------------ Code: [Select] <form action="contact.php" method="post"> <ol><li> </li><li> <label for="department">Addressed to:</label> <input type="text" name="cf_department" class="text" /> </li><li> <label for="message">Your Message:</label> <textarea name="cf_message"rows="10" cols="50"></textarea> </li><li> <input type="submit" value="send" /><input type="reset" value="Clear"/> <div class="clr"></div> </li></ol> </form> If I have a standard HTML form in my PHP script and the User submits the form - which resubmits to itself for processing - and then the User hits the "Back" button and then the "Forward" button, why does the Form and its data get re-submitted?! What mechanics are exactly happening? I had a "Submit Payment" page that was doing that and so people would get charged twice and that is obviously a big problem. Please help me understand what causes that issue and different ways to fix it. Thanks, Debbie I've got a BIG problem... When a user submits my form it works fine, displays a "Transaction Success/Failed", and e-mails me a confirmation. However, if the user then navigates to another page (e.g. "Home"), and then clicks their browser's "Back" button, my form gets re-submitted?! This is on a VPS, but I just chatted with server support and they are saying, Quote register_globals = Off So what is going wrong?! Debbie Hi all I have a field in mySQL table called dimensions. It has the double quote in in for inches - " When I echo the result from the mySQL query on the item page (Customer facing) it's fine. However, I have built a form so that the administrator can edit the dimensions in the admin panel and when I echo it out in to the form field it stops when it gets to the double quotes? Pete Hello Everyone, I've been working with XAMPP 1.7.3 and have a general question. I've always read (and been told) to use addslashes() for any MySQL input to protect the database. My PHP.ini file has magic quotes off and the system automatically produces a caret symbol "^" in front of every control character I upload to the database. I can't find anything in the PHP.ini file relating to the caret symbols and control characters, nor can I find anything in the My.ini file. In testing, it the system behaves just as it would if I had magic quotes on, except that the system uses the carets instead of slashes. I have no problem removing the carets (and any slashes that a user might upload) but would like to know what is going on. I've done google searches on this and have only found content regarding regular expressions. Could someone clue me in? Thank in advance. Cheers, Rick Hi: Is this the proper way to remove slashes from apostrophes: Code: [Select] if ($_SERVER['REQUEST_METHOD'] == 'POST') { $myTitle = mysql_real_escape_string(stripslashes($_POST['myTitle'])); $myDesc = mysql_real_escape_string(stripslashes($_POST['myDesc'])); $myHeader = mysql_real_escape_string(stripslashes($_POST['myHeader'])); $mySubHeader = mysql_real_escape_string(stripslashes($_POST['mySubHeader'])); $myPageData = mysql_real_escape_string(stripslashes($_POST['myPageData'])); It seems to work fine, I'd just like to clarify I'm not missing anything. Thanks! Hi All I Am confused I would like to put info into a database but need it to be secure. I have some code shown below. The problem is I would like to put in ' but keep the data secure. When it comes back I do not want to show \' I think you might know what I am trying to do. Here is the code but would like to know how to stop the \' showing. Code: [Select] $password = mysql_real_escape_string(stripslashes(trim($_POST['password']))); Any help would be great thank you. Hi there i have this code: Code: [Select] $str = "<i><font color="800080"> man </font></i><p><font color="9898989"> hi </font></p><p><font color="1111111"> cheers </font></p>"; $pattern = '/<font .*?>(.*?)<\/font>/'; if(preg_match_all($pattern, addslashes($str), $posts)){ $i=0; for($i; $i < count($posts[0]); $i++){ echo "content: " . $posts[0][$i] . "<br/>"; echo "colour: " . $posts[1][$i] . "<br/>"; echo "<br />"; } } and it doesn't work apparently because of the addslashes but its really needed as double quotes needs to be escaped, consider that i'm applying this code to a larger html file with hundreds of double quotes to be escaped.... error msg i get is Parse error: syntax error, unexpected T_LNUMBER in thanks in advance.. I have this page that keeps adding slashes (exponentially) to the $sql var that gets passed on through the hidden text area. I cannot figure out why it does this. Any ideas are appreciated. Thank you. <?php include_once $_SERVER['DOCUMENT_ROOT'] . '/include/login.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/mysql.php'; if(!Login::loggedIn()) { include $_SERVER['DOCUMENT_ROOT'] . '/include/uploads/pages/login.php'; } else { function displayForm() { $sql = 'SELECT * FROM `content` WHERE `contentCallid` = \'' . $_GET['page'] . '\''; $con = $GLOBALS['mysql']->connect(); $query = mysql_query($sql, $con); $content = mysql_fetch_array($query); $content['breadcrumb'] = explode(',', $content['breadcrumb']); $content['breadcrumbLink'] = explode(',', $content['breadcrumbLink']); $breadcrumb = ''; for($i = 0; $i < count($content['breadcrumb']); $i++) { if($i > 0) $breadcrumb .= ','; $breadcrumb .= $content['breadcrumbLink'][$i] . '::' . $content['breadcrumb'][$i]; } if(empty($_POST['sql'])) { $sql = 'INSERT INTO `contentVersions` (`contentCallid` , `contentTitle` , `content` , `views` , `permissionNeeded` , `status` , `version` , `created` , `createdBy` , `lastEdit` , `lastEditBy` , `breadcrumb` , `breadcrumbLink` , `noBreadcrumb` ) VALUES ( \'' . ($content['contentCallid']) . '\', \'' . ($content['contentTitle']) . '\', \'' . ($content['content']) . '\', \'' . ($content['views']) . '\', \'' . ($content['permissionNeeded']) . '\', \'' . ($content['status']) . '\', \'' . ($content['version']) . '\', \'' . ($content['created']) . '\', \'' . ($content['createdBy']) . '\', \'' . ($content['lastEdit']) . '\', \'' . ($content['lastEditBy']) . '\', \'' . ($content['breadcrumb']) . '\', \'' . ($content['breadcrumbLink']) . '\', \'' . ($content['noBreadcrumb']) . '\');'; $sql = stripslashes($sql); } else { $sql = $_POST['sql']; } ?> <form id="loginForm" name="loginForm" method="post" action="index.php?p=editPage&page=<?= $_GET['page']; ?>&ref=editPage"> <fieldset> <legend>Page Settings </legend> <p> <label>Page Title: </label> <input name="title" style="width:450px;" id="title" value="<?= $content['contentTitle']; ?>" type="text" /> </p> <p> <label>Content ID: </label> <input name="callid" readonly="readonly" style="width:381px;" id="callid" value="<?= $content['contentCallid']; ?>" type="text" /> <input name="suggestC" type="button" value="Suggest" onclick="suggestCallID('<?= $content['contentCallid']; ?>');" /> </p> <p> <label>Breadcrumb: </label> <input name="breadcrumb" style="width:381px;" id="breadcrumb" value="<?= $breadcrumb; ?>" type="text" /> <input name="suggestBC" type="button" value="Suggest" onclick="suggestBreadcrumb();" /></p> </fieldset> <textarea name="editPageWYS" id="editPageWYS"><?= $content['content']; ?></textarea> <textarea style="visibility:hidden;" name="sql"><?= $sql; ?></textarea> <textarea style="visibility:hidden;" name="version"><?= $content['version']; ?></textarea> <textarea style="visibility:hidden;" name="contentid"><?= $content['contentid']; ?></textarea> <fieldset> <legend>Actions</legend> <p> <input name="save" type="submit" value="Save" /> </p> </fieldset> </form> <?php } if(!empty($_POST['save'])) { if(empty($_POST['title']) || empty($_POST['callid'])) { echo '<blockquote class="failure">Save not successful. You need to have both a title and content id. Please type in a title then click the "Suggest" button.</blockquote>'; displayForm(); } else { $time = time(); $bc = explode(',', $_POST['breadcrumb']); $bcText = array(); $bcLink = array(); for($i = 0; $i < count($bc); $i++) { $bc[$i] = explode('::', $bc[$i]); $bcLink[$i] = $bc[$i][0]; $bcText[$i] = $bc[$i][1]; } $bcLink = implode(',', $bcLink); $bcText = implode(',', $bcText); $con = $GLOBALS['mysql']->connect(); $query = mysql_query($_POST['sql'], $con); echo $_POST['sql']; if(!$query) { echo '<blockquote class="failure">Warning: A MySQL error has occured while adding the backup to the database.<p>' . mysql_error() . '</p></blockquote>'; displayForm(); } $sql = 'UPDATE `content` SET `content` = \'' . $_POST['editPageWYS'] . '\', `breadcrumb` = \'' . $bcText . '\', `breadcrumbLink` = \'' . $bcLink . '\', `contentCallid` = \'' . $_POST['callid'] . '\', `contentTitle` = \'' . $_POST['title'] . '\', `version` = \'' . ($_POST['version'] + 1) . '\', `lastEdit` = \'' . $time . '\', `lastEditBy` = \'' . $_SESSION['username'] . '\' WHERE `contentid` = ' . $_POST['contentid'] . ' LIMIT 1 ;'; $query = mysql_query($sql, $con); if(!$query) { echo '<blockquote class="failure">MySQL Error<p>' . mysql_error() . '</p></blockquote>'; displayForm(); } else { echo '<blockquote>Page Successfully Edited<br /><br /><a href="index.php?p=' . $_POST['callid'] . '&ref=newPage">Click Here to View It</a></blockquote>'; } } } else { displayForm(); } } ?> This is driving me nuts and I'm hoping someone can help me figure it out. I have a site with PHP/MySQL. I have a form where people can submit a comment. This comment then goes into a MySQL database and gets displayed back on another page of the website. NOTE: I put this question in the PHP Forum because I think the problem is happening somewhere BEFORE the info gets entered into MySQL. But of course, I could be wrong. The problem is that some of the comments are coming in with a "\" in front of apostropes, but NOT ALL OF THEM (which is really confusing me). For example, someone entered this comment which shows in the MySQL database exactly like this... I predict Lena's gonna win a lifetime Grammy. It's long overdue. Someone else entered a comment which shows in the MySQL database exactly like this... can\\\'t wait to see first pics of the next addition. Congrats! They both have apostrophes in them, but only that second one added those slashes (and 3 of them for some reason). There are more instances of this where some comments have the slashes before the apostrophe and some don't. Anyone know what might be causing this seemingly random insertion of slashes? Ok so I'm coding up a file tree for a script and I've got the system setup so that when a user clicks on a folder it adds that folder to the path. The path is stored in a variable, but I'd like to allow the user to be able to go down multiple directories at once. To do this I'm going to seperate each folder name in the path and link to it so as an example: $path = './home/public_html/folder1/folder2'; how can I separate each of those so I can make a link to that folder so that: /home goes to $path = './home/'; /public_html goes to $path = './home/public_html'; etc... --- Basically just seperate the slashes into an array and seperate each of them off based on how far along it is but I don't know how to do that... |
|||||||