Add Note Errors

[OzzWald72]

Hi,

 

I have 'adopted' a whole CMS php mysql system. I am a PHP newbie.

 

The following script errors even though the note is placed in the DB.

 

It also put the error ina box with the html code visible.

 

I have not touched the code and can only assume that it worked before, but I have no proof.

 

<?php
require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/top.php';
if(is_numeric($_POST['customer-id'])){

$customer_id = $_POST['customer-id'];

$note_contents = $_POST['customer-note'];

$note_user = User::getUserID();

if(Customer::addNote($customer_id, 'note', $note_contents, $note_user)){

 echo 'success|';

 $message = '<div class="okay-msg"><p>Note added.</p></div>
 <script type="text/javascript">
  $().ready(function() {
$(\'#customermanagement\').load(\'/customers/view.php?id=' . $customer_id . '\', function(){ rebindAll(); });
  })
 </script>';

}else{

 echo 'failure|';

 $message = '<div class="error-msg"><p>Error occured whilst adding note.</p></div>';

}

echo $message;

}else{
$customer_id = $_GET['id'];

?>
<form action="/ajax/addnote.php" method="post" id="form-add-note">
<input type="hidden" name="customer-id" value="<?php echo($customer_id); ?>" />
<div id="add-note-lightbox">
    <h2>Add note to customer</h2>
    <textarea name="customer-note"></textarea><br />
 <a href="#" id="customer-add-note" style="float: right; margin-right: 10px;" class="button"><span>Save Note</span></a>
</div>
</form>
<script type="text/javascript">
 $.fancybox.resize();
 rebindAll();
</script>
<?php
}
?>

 

Many thanks for your help

[Christian F.]

So... What's the question, or perhaps more importantly: What's the error?

 

I recommend that you read this article.

[OzzWald72]

Hi,

 

The error i am getting is :

[color="#008800"]<div class="error-msg"><p>Error occured whilst adding note.</p></div>[/color]

 

This come sup in a Windows Message box

I do not have enough knowledge to error check the script.

 

Is ther anything that is greatly wrong with the script?

[Christian F.]

First of all: Do not send the customer ID to the form, and most definitely do NOT use it in your receiving page!

The user ID should be saved in the session, and there only. Otherwise it would be trivial to edit the value of the field, and thus impersonate any user on your system.

 

Secondly: Turn on error reporting, I'm betting there's quite a few errors and/or warnings that you do not see. Messages that could very well explain why you're getting said error.

 

Lastly: The following function call returns false, which results in the message you quoted above.

Customer::addNote($customer_id, 'note', $note_contents, $note_user)

After turning on error reporting, and fixing all of the messages it gives, then you'll need to have a look at the above method (Customer::addNode ()) to find out why it returns false. Trace its logic, and check the actual values of the variables, and you should find the problem quite easily.

Should you still have troubles, post the code for the method and tell us what you've done to try and track it down.