Security Question Problem

[CBaZ]

I have this simple script I started but for some reason it doesn't continue even if the right answer is given.

Also how would I go about adding multiple questions?

 

<?php
//simple captcha
if(isset($_POST['answer']) && $_POST['answer']!='') { echo "<script>alert('You provided a wrong answer for the Security Question')</script>"; 
echo "<a href='cabbie.php'>Please return to the Form and try again.</a><br /><br />\n";
exit; 
} else 
if(isset($_POST['answer']) && $_POST['answer']!='blue') { 

//This is the problem script above of course my code continues here.

 

 

[requinix]

Looks like the answer is "blue"? Take a look at what you wrote:

isset($_POST['answer']) && $_POST['answer']!=''

Say I enter "blue". Is the answer isset()? Yes. Is the answer not empty? Yes.

[CBaZ]

ok what am I missing here?

[requinix]

That entering anything at all as the answer will trigger that branch to execute.

 

Given that the message is about entering the wrong answer, shouldn't the condition check to see if you entered the wrong answer? Hint: you do it a couple lines lower.

[CBaZ]

ok the real thing i am missing is what to do if its actually set to the correct answer I am not doing.  Am I seeing this correctly now?

[requinix]

If you do enter the right password then, with the correct code, the answer will be isset() but it won't not-match the answer (ie, it does equal the answer) and the branch won't execute.

[CBaZ]

totally confused now lol.

[requinix]

Bad:

if(isset($_POST['answer']) && $_POST['answer']!='') {

Good:

if(isset($_POST['answer']) && $_POST['answer']!='blue') {

[ignace]

if (isset($_POST['answer'])) {

  // user posted something.. can be anything at this point (except null)

  if ($_POST['answer'] == 'blue') {

    // he posted blue

  } elseif ($_POST['answer'] == '') {

    // he just submitted the form without entering anything (show the form)

  } else {

    // he entered something other then blue or empty (show the form)

    echo $_POST['answer'] === 'pink' ? 'You silver-tongued devil you!' : $_POST['answer'] . ' is not correct';

  }

}

Edited March 2, 2013 by ignace