Simple checkboxes value question

[dean7]

Hey guys, I've got problem which seems it should be so simple to resolve but I just can't put it together . I'm needing to show all of the values of the Check Boxes clicked when I hit submit,

 

I have this:

echo ('<tr><td><input id="select_car" name="select_car[]" type="checkbox" value="'.$CarID.'"" onclick="CountCheck()" /><a href="?getin='.$CarID.'">'.$CarName.'</a> ('.$CarIDCol.')</td><td><a href="?repair='.$CarID.'">'.$CarDamage.'%</a></td><td><a OnClick="javascript: return confirm(\'Are you sure you want to sell?\');" href="?sell='.$CarID.'">£'.number_format($CarValue).'</a><input type="hidden" name="values[]" id="values[]" value="'.$CarValue.'"></td><td><a href="?stats='.$CarID.'">View Stats</a></td></tr>');

In my form:

<input name="sell_selected" type="submit" id="sell_selected" value="Sell Selected" class="button" onClick="JavaScript:return confirm('Are you sure you want to sell?');" />

if (!empty($_POST['sell_selected'])){
 
foreach ($_POST['values'] as $value){
 
echo $value;
}
}

 

With my code its displaying all the values of even the ones which haven't been checked? 

How can I make it so it only shows the values of the checked checkboxes?

 

Only needing that as once I can see them values I need to add them together to give the final figure of the extra money of all things sold

 

Thanks for any help

[Jacques1]

Your form design doesn't work.

 

The select_car array from the checkboxes does contain only the checked car IDs, but the values arrray from the hidden fields (which you're currently iterating over) contains every possible value. Even worse, you have no idea which value belongs to which ID.

 

There are two options:

• Add the values to the checkboxes themselves and get rid of the hidden fields: <input type="checkbox" name="car_values[insert the HTML-escaped ID here]" value="insert the HTML-escaped value here">. This gives you an associative which maps the IDs of the selected cars to their values.
• Only transmit the IDs and look up the values again afterwards. Be aware that this can result in different values if there have been updates in between.

Note that your car values can both be manipulated and submitted on behalf of another user (at least I see nothing which would protect you against CSRF attacks). So unless this is one of those "school projects", you might want to reconsider your approach.

[dean7]

So would this be how you mean for the form?

 

 

<input id="select_car" name="select_car['.$CarID.']" type="checkbox" value="'.$CarValue.'" onclick="CountCheck()" />

 

The for the PHP bit:

 

 

if (isset($_POST['sell_selected'])){
 
$PostValues = $_POST['select_car'];
 
foreach($PostValues as $value) {
 
$GetInfo = $db->prepare("SELECT * FROM garage WHERE id = :id");
$GetInfo->bindParam(":id", $value);
$GetInfo->execute();
$CarInformation = $GetInfo->fetchObject(); 
 
 
} 
}

When I try getting the information from the database it says: Notice: Trying to get property of non-object even thought the obj should be fine as I'm getting the ID from the checkbox?

[Jacques1]

So would this be how you mean for the form?

 

You forgot the HTML-escaping. Dynamic values which are inserted into an HTML context must be escaped. Don't just assume that they're safe.

 

 

 

When I try getting the information from the database it says: Notice: Trying to get property of non-object even thought the obj should be fine as I'm getting the ID from the checkbox?

 

I don't think you understand the structure of $_POST['select_car']. It's an associative array with the car ID as the key and the car value as the corresponding value:

ID => car value

Right now, you're trying to use the car value as the ID, which doesn't make sense. The ID is the key:

foreach ($_POST['select_car'] as $car_id => $car_value)
{

}

Also, don't forget about the CSRF vulnerability.

[dean7]

You forgot the HTML-escaping. Dynamic values which are inserted into an HTML context must be escaped. Don't just assume that they're safe.

 

 

 

 

I don't think you understand the structure of $_POST['select_car']. It's an associative array with the car ID as the key and the car value as the corresponding value:

ID => car value

Right now, you're trying to use the car value as the ID, which doesn't make sense. The ID is the key:

foreach ($_POST['select_car'] as $car_id => $car_value)
{

}

Also, don't forget about the CSRF vulnerability.

Yes thank you , thats what I was aiming for as I wanted to check the value of the car is the same from in the database. As $car_value is holding each value of the selected cars how would I add all the selected car values up? I've read something about array_merge or could I just do sum($car_value)?

 

Thanks

[Jacques1]

You can just add each value to a variable outside of the loop, or you can use array_sum().

[dean7]

$tot = 0;
 
foreach ($_POST['select_car'] as $car_id => $car_value){
 
$tot += $car_value;
 
}
 
echo $tot;

That made it work, thank you for your help.

Edited October 22, 2016 by dean7