Problem with form/variable??? I think

[bpburrow]

I've got this form to input client information into a db.  One of my very first error controls is to determine if the form is complete.  For some reason the error always come up as "You did not fill out the required fields." even when the form IS filled out properly.

 

client_new.php

<?php
				if(!$_POST['submit']) // 'submit' hasn't been clicked so output html.
				{
				?>
				<form action="client_new.php" method="post" class"clearfix">
					<fieldset class="clearfix">  
						<legend>New Client</legend>  
						<ol>  
							<li>  
								<label for="firstname">First Name:</label>
									<input id="firstname" name"firstname" class="textfield_effect" type="text" />
										</li>	
							<li>
								<label for="lastname">Lastname:</label>
									<input id="lastname" name="lastname" class="textfield_effect" type="text" />
										</li>	
							<li>
								<label for="username">Username:</label>
									<input id="username" name="username" class="textfield_effect" type="text" />
										</li>
							<li>
								<label for="password">Password:</label>
									<input id="passwd" name"passwd" class="textfield_effect" type="text"  />
										</li>
							<li>
								<label for="email">Email:</label>
									<input id="email" name="email" class="textfield_effect" type="text" />
										</li>
							<input type="submit" name="submit" value="Add Client" />
						</ol>
					</fieldset>
				</form>
				<?php
					}
					else
					{
						$firstname = protect($_POST['firstname']);
						$lastname = protect($_POST['lastname']);
						$username = protect($_POST['username']);
						$passwd = protect($_POST['passwd']);
						$email = protect($_POST['email']);

						if(!$firstname || !$lastname || !$username || !$passwd || !$email)
						{
							$errors[] = "You did not fill out the required fields. <br />";
						}

						if (!ereg('^[a-zA-Z0-9_\.\-]+@[a-zA-Z0-9\-]+\.[a-zA-Z0-9\-\.]+$', $email))
						{
							$errors[] = "Email was incomplete or unrecognized. <br />";		
						}

						$sql = "SELECT * FROM Client WHERE `username`='{$username}'";
						$query = mysql_query($sql) or die(mysql_error());

						if(mysql_num_rows($query) > 0) 
						{
							$errors[] = "Username already taken, please try another. <br />";
						}

						if(count($errors) > 0)
						{
							echo "<fieldset><legend>Errors</legend>";
							echo "<div class=\"bodyText\">The following errors occured with your slideshow:</div><br />";
							echo "<div class=\"error\">";
							foreach($errors AS $error)
							{
								echo $error . "\n";
							}
							echo "</div>";
							echo "<br /><div class=\"bodyText\"><a href=\"javascript:history.go(-1)\">Try again</a></div>";
							//JS to reload page 
							echo "</fieldset>";
						}
						else
						{

							$sql = "INSERT INTO Client (firstName, lastName, username, passwd, email) 
								VALUES ('$firstname','$lastname','$username', '".md5($passwd)."', '$email')";

							$query = mysql_query($sql) or die(mysql_error());
							echo "</ br><div class=bodyText>$firstname $lastname has been registered as a new client.</div>";
						}
					}
				?>

[mikesta707]

What does the "protect()" function do? can you post it?

[bpburrow]

<?php
function protect($string)//function to prevent SQL injection
{
  $string = mysql_real_escape_string($string);
  return $string;
}
?>

 

I had the form working until I went back to clean it up.  Not sure where I went wrong.  The protect() function is used throughout my site.  I doubt that's where the problem lies. 

[Alex]

Why would you create a function like that? All it does is use mysql_real_escape_string.. Why not just use it directly? That's a really pointless function.

 

Anyway, your problem is probably because of your html syntax errors. You're missing a bunch of equal signs (=).

 

Example:

 

class"clearfix"
..
name"firstname"

[bpburrow]

Thanks!! That did the trick.  I guess my clean up wasn't so clean.

 

As for the function, I know it's redundant.  I use it because it's shorter than writing it the other way.