davidjmorin

I am tyring to figure out how to allow the use of ' in the name field. I have tried string replace but that does not work. I also tried single and double quotes around value. Any help is appreciated. if(isset($_POST['upsubmit'])){ // Allowed mime types $csvMimes = array('text/x-comma-separated-values', 'text/comma-separated-values', 'application/octet-stream', 'application/vnd.ms-excel', 'application/x-csv', 'text/x-csv', 'text/csv', 'application/csv', 'application/excel', 'application/vnd.msexcel', 'text/plain'); // Validate whether selected file is a CSV file if(!empty($_FILES['file']['name']) && in_array($_FILES['file']['type'], $csvMimes)){ if(is_uploaded_file($_FILES['file']['tmp_name'])){ // Open uploaded CSV file with read-only mode $csvFile = fopen($_FILES['file']['tmp_name'], 'r'); // Skip the first line fgetcsv($csvFile); while(($line = fgetcsv($csvFile)) !== FALSE){ $Agent_ID =$line[0]; $Agent_Name =$line[1]; $Tran_Year =$line[2]; $Tran_Period =$line[3]; $Original_Mobile_ID =$line[4]; $Mobile_ID =$line[5]; $Device_Category =$line[6]; $Device_ID =$line[7]; $Account_Number =$line[8]; $Price_Plan =$line[9]; $Customer_Name =$line[10]; $Device_Change_Date =$line[11]; $New_Device_Contract_Begin_Date =$line[12]; $New_Device_Contract_End_Date =$line[13]; $Access_Charge =$line[14]; $Contract_Term =$line[15]; $Model =$line[16]; $Alt_Mobile_ID =$line[17]; $VZW_Provided_Equip =$line[18]; $Previously_Activated_Equip =$line[19]; $Installment_Contract =$line[20]; $Purchased_Receivable =$line[21]; $DPA_Service_Fee =$line[22]; $Agent_SSO_ID =$line[23]; $Customer_Type =$line[24]; $Previous_Price_Plan =$line[25]; $Previous_Access_Charge =$line[26]; $prevQuery = "SELECT ID FROM disc_Upgrades WHERE Device_ID = '".$line[7]."' AND Customer_Name = '".$line[10]."'"; $prevResult = $db->query($prevQuery); if($prevResult->num_rows > 0){ }else{ $db->query("INSERT INTO `disc_Upgrades(Agent_ID`, `Agent_Name`, `Tran_Year`, `Tran_Period`, `Original_Mobile_ID`, `Mobile_ID`, `Device_Category`, `Device_ID`, `Account_Number`, `Price_Plan`, `Customer_Name`, `Device_Change_Date`, `New_Device_Contract_Begin_Date`, `New_Device_Contract_End_Date`, `Access_Charge`, `Contract_Term`, `Model`, `Alt_Mobile_ID`, `VZW_Provided_Equip`, `Previously_Activated_Equip`, `Installment_Contract`, `Purchased_Receivable`, `DPA_Service_Fee`, `Agent_SSO_ID`, `Customer_Type`, `Previous_Price_Plan`, `Previous_Access_Charge`) VALUES ( '$Agent_ID', '$Agent_Name', '$Tran_Year', '$Tran_Period', '$Original_Mobile_ID', '$Mobile_ID', '$Device_Category', '$Device_ID', '$Account_Number', '$Price_Plan', '$Customer_Name', '$Device_Change_Date', '$New_Device_Contract_Begin_Date', '$New_Device_Contract_End_Date', '$Access_Charge', '$Contract_Term', '$Model', '$Alt_Mobile_ID', '$VZW_Provided_Equip', '$Previously_Activated_Equip', '$Installment_Contract', '$Purchased_Receivable', '$DPA_Service_Fee', '$Agent_SSO_ID', '$Customer_Type', '$Previous_Price_Plan', '$Previous_Access_Charge')"); } } // Close opened CSV file fclose($csvFile); $qstring = '?status=succ'; }else{ $qstring = '?status=err'; } }else{ $qstring = '?status=invalid_file'; } } // Redirect to the listing page header("Location: ../index.php".$qstring);

Hey guys, Im trying to get a page to update profiles working and have been unsuccessful. Its a basic form with a server.php to process the updates. Server.php $username = mysqli_real_escape_string($db, $_POST['username']); $email = mysqli_real_escape_string($db, $_POST['email']); $password_1 = mysqli_real_escape_string($db, $_POST['password_1']); $password_2 = mysqli_real_escape_string($db, $_POST['password_2']); $location = mysqli_real_escape_string($db, $_POST['location']); $class = mysqli_real_escape_string($db, $_POST['class']); $id = mysqli_real_escape_string($db, $_POST['id']); if (empty($username)) { array_push($errors, "Username is required"); } if (empty($email)) { array_push($errors, "Email is required"); } if (empty($password_1)) { array_push($errors, "Password is required"); } if ($password_1 != $password_2) { array_push($errors, "The two passwords do not match"); } if (count($errors) == 0) { $password = password_hash($password_1, PASSWORD_DEFAULT); $query = "(UPDATE accounts SET password='".$password."', username='".$username."', email='".$email."', role='".$role."', class='".$class."' )"; mysqli_query($db, $query); $_SESSION['username'] = $username; $_SESSION['success'] = "Update Successful for user: " . $username; header('location: index.php'); } } update.php <?php session_start(); if (!isset($_SESSION['loggedin'])) { header('Location: ../login.php'); exit(); } if($_SESSION['class'] == 'user') { // Jump to user page header('Location:../user/home.php'); } ?> <html> <head> <meta name="viewport" content="width=device-width, initial-scale=1" /> <title>New User Registration</title> <link rel="stylesheet" type="text/css" href="../css/style.css"> <link href="../css/navbar.css" rel="stylesheet" type="text/css"> </head> <body> <?php include "../assets/navbar.php" ?> <div class="header"> <h2>Update User Info</h2> </div> <form method="post" action="server.php" class="form2"> <?php include('errors.php'); ?> <?php if (isset($_SESSION['success']) && ! empty($_SESSION['success'])) { echo "<div class='success'>" . htmlentities($_SESSION['success']) . "</div>"; unset($_SESSION['success']); } $id = $_REQUEST['id']; $username = $_REQUEST['username']; $location = $_REQUEST['role']; $email = $_REQUEST['email']; $password = $_REQUEST['password']; $class = $_REQUEST['class']; ?> <div class="input-group"> <input type="hidden" name="id" placeholder="<?php echo $id; ?>" value="<?php echo $id; ?>"> </div> <div class="input-group"> <input type="text" name="username" placeholder="<?php echo $username; ?>" value="<?php echo $username; ?>"> </div> <div class="input-group"> <input type="email" name="email" placeholder="Email Address?" value="<?php echo $email; ?>"> </div> <div class="input-group"> <input list="location" name="location" class="form-control" placeholder="<?php echo $location; ?>" required> <datalist id="location"> <option value="Manny"> <option value="Nate"> <option value="Jay"> <option value="Imran"> <option value="Sanat"> <option value="Minahan"> </datalist> </div> <div class="input-group"> <input list="class" name="class" class="form-control" placeholder="<?php echo $class; ?>" required> <datalist id="class"> <option value="user"> <option value="admin"> <option value="disabled"> </datalist> </div> <div class="input-group"> <input type="password" placeholder="Password" name="password_1"> </div> <div class="input-group"> <input type="password" placeholder="Confirm Location" name="password_2"> </div> <div class="input-group"> <button type="submit" class="btn" name="reg_user">Update</button> </div> </form> </body> </html> When I process the update it gives me a success message but the data in the table is not updated at all. Any suggestions on what im doing wrong here?