Jump to content

benanamen

Members
  • Posts

    2,134
  • Joined

  • Last visited

  • Days Won

    42

Posts posted by benanamen

  1. You have a typo in your data-target for the details button. There is a dash that does not belong there after the #.

     

    WRONG

    data-target="#-details-1"

    CORRECT

    data-target="#details-1"

    You also have a separate bracket problem in the scroll JS.

     

    And next time use the code tags.

  2. I would like to close this conversation with adding that you gentlemen have no idea of where how this script will be implemented.

     

    And that's our fault? Too bad you are not wise enough to take advantage of our "superior knowledge".

     

    Buh Bye!

  3. I have been following this thread from the beginning. What you have is an XY problem. See my signature for an explanation. You claim to have been in security for several years yet you don't even know the most basic of form handling and you're attempting to write some anti-hacking script?

     

    Whatever you're trying to solve is not the problem and your approach is just nonsense.

     

    Why don't you tell us what the actual real problem is exactly, not your attempted solution to it.

  4. How did you "inspect it"?  Try this and see what happens. If it works when you hard code the value, the problem is before the edit page.

    if(!empty($_POST['id'])){  
    
    # set form input fields
    $sql = 'SELECT id, name, email FROM author WHERE id = :id';
    $query = $dbConnection->prepare($sql);
    $query->bindValue(':id', $_POST['id']);
    $query->execute();
    $row = $query->fetch();
    $name = $row['name'];
    $email = $row['email'];
    $id = $row['id'];
    }
    else{
        echo 'ID is missing';
        }
    
  5. You have not done any checks to see if the ID exists before you try to use it. You are also not sending the id value when you submit your form. Use a hidden id field in your form to POST the id value when the form is submitted.

     

    How are you expecting to get the ID when the form first loads? Are you clicking an "Edit" link? if so, is the ID attached to it as in

     

    edit.php?id=myid

     

    If so, change POST to GET.

    $query->bindValue(':id', $_GET['id']);
    

    Then in your form set a hidden id field to the value of GET. Then in the script check if the Server request method = POST then do your edit. That is the basics. There is a security consideration that needs to be addressed with the hidden field though. You don't want to allow any user supplied data to be injected directly into your page. I will leave that part for others to tell you about.

  6. Ok, now we are getting somewhere. Let's start from the beginning.

     

    You shouldn't be using sha256. You need to use password_hash.

     

    Line 13 should be if ($_SERVER['REQUEST_METHOD'] == 'POST') Depending on getting the name of a button to be submitted for your script to work can be problematic in certain instances.

     

    Do not SELECT *. Specify the exact columns you want.

     

    $_SERVER['PHP_SELF'] is vulnerable to an XSS Attack. Just leave the action out to submit to the same page.

     

    You need to kill the script at the header redirect.

    die(header("Location: index.php")); 

     

    You need to use prepared statements

     

    On the index page, there is no need for another query. You have already set the fname session on login. Just use it now.

     

    index.php 

    <?php
    session_start();
    ?>
    <p>Hello <?= $_SESSION['fname'] ?> You are logged in as Admin!</p>

    I highly recommend you use PDO https://phpdelusions.net/pdo

  7. Using a DB is overkill for this. You should also be using the month number for the key, not the month name.

    <?php
    $months = [
        "1" => "January",
        "2" => "February",
        "3" => "March",
        "4" => "April",
        "5" => "May",
        "6" => "June",
        "7" => "July",
        "8" => "August",
        "9" => "September",
        "10" => "October",
        "11" => "November",
        "12" => "December"
    ];
    ?>
    
    <select name="month">
        <option>Select Month</option>
        <?php foreach ($months as $month_number => $month_name):?>
        <option value='<?= $month_number ?>'><?= $month_name ?></option>
        <?php endforeach;?>
    </select>
    
  8. Instead of doing the includes, why don't you start with a single page of code and get that to work first. The index error is because you are trying to use a POST variable before it is set. You need to make sure it is set before you try to use it. Your code is so all over the place I can't even follow it well. I will leave it to others to take it from here unless you can post revised single page code.

  9. That is a lot more useful info than how to handle your attempt at it. Not sure if it is, but it was smelling of an XY Problem to me.

     

    Are you able to provide details on the "Certain Data" and exactly what it means regarding more or less data? Any other details may also be helpful. Are you in control of the source data? If not, what are your options in retrieving it? Are we talking about a third party API? 

     

     

    Edit* Is this a third thread regarding the same project as your other two threads?

     

    https://forums.phpfreaks.com/topic/302727-multiple-updates/page-2

     

    https://forums.phpfreaks.com/topic/302752-insert-on-duplicate-key-update-with-composite-key/

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.