Help needed with web forms:

[Raistlin]

Hi Guys,

I need a little help with creating a web form.

I'm starting from scratch so please excuse me if I sound like a bit of a

Using DreamWeaver, how do I create a form? It needs to have 2 fields that the user can enter data into and two buttons, one button will be used to carry out an SQL search on a database and the other will be used to reset the form fields.

If anybody could give me a little help to get started I would really appreciate it.

[Richard M]

<form action="processing-file.php" method="get">
<input type="text" name="variable-field" />
<input type="hidden" name="stuff-you-want-to-carry-over" value="variable-value" />
<input type="submit" value="Go" />
</form>

It's not really that hard...to get you started:
http://www.w3schools.com/html/html_forms.asp
BTW - I hear you're creating something for CF - I can clean up everything and check the code...

[philip.j.fry]

The w3c schools are always good: http://www.w3schools.com/html/html_forms.asp

I'm not sure how you do it graphically in DW but if you go to code view the html should be something like:

<form name="my_form" action="form_submit.php" method="GET">
<input type="text" name="text_one"><br>
<input type="text" name="text_two"><br>
<input type="submit" value="Submit"><br>
<input type="reset" value="Clear">
</form>

Hope that gives you enough to be going on with, I'm off to bed

Edit: At least Rich and I are in agreement and not confusing you

[Raistlin]

Ok, I've got the form part working, it passes two variables to a .php page.

The .php page queries a database and returns some values, based upon what was input in the form.

I then need to take some of the values from the record and some of the values from the form and perform an UPDATE.

So, from the form:

$usrInputName
$usrInputSearch

The SELECT query (which works) is:

PHP Code:

$result = mysql_query("SELECT * FROM tblMyTable WHERE requiredfield = '$usrInputSearch'",$link); 


I can then "echo" all of the fields from the one returned record so that they output in the browser.

What I now need to do is take the usrInputName value and append it to the end of what is currently in one of the fields returned by the SELECT statement.

So, I'm doing this:

PHP Code:

mysql_query("UPDATE tblMyTable SET TheFieldToAmend = $row[TheFieldToAmend] . '<BR>' . $usrInputName WHERE id = $row[id] LIMIT 1"); 


So:

If TheFieldToAmend = This
And $usrInputName = Raistlin

I want the value of TheFieldToAmend for the selected record (identified by $row[id] returned by the SELECT query) to be:

This<BR>Raistlin

[Gareth]

Why would you want to include that inside a sql statement? Why not retrieve the values and then manipulate or concatonate them within your php code afterwards?

[Raistlin]

Originally Posted by Richard M

BTW - I hear you're creating something for CF - I can clean up everything and check the code...

Sorry, forgot to say....Thanks

I'll certainly take you up on that, I'm trying to do as much of the fiddly stuff as possible - the theory being that once the hard work's done someone wonderful (like you ) can help me just get it a little bit tidy
__________________

Originally Posted by Gareth

Why would you want to include that inside a sql statement? Why not retrieve the values and then manipulate or concatonate them within your php code afterwards?

The values have already been retrieved, I now want to concatenate them (love that word ) and amend the table in the database - wasn't aware that I could do that without a SQL statement
__________________

Originally Posted by philip.j.fry

Edit: At least Rich and I are in agreement and not confusing you

Nah, I think I'm confusing myself Thanks

[Gareth]

Oh, so you want the field value to contain the html tags that you're using...? Am I understanding this correctly? I've had a few tonight

[Raistlin]

Yep:

Say (for example) that the field value was originally:

THIS

I want it to be:

THIS<BR>WORD

So that when it is displayed on a web page it looks like:

THIS
WORD

Does that make sense, I haven't slept much in the last 72 hours so I'm a bit muddled myself

[Richard M]

PHP Code:

$result = mysql_query("SELECT * FROM tblMyTable WHERE requiredfield = '$usrInputSearch'",$link); 


Very insecure code there...

I could (if I wanted to) change that code to this:

PHP Code:

$result = mysql_query("SELECT * FROM tblMyTable WHERE requiredfield = '$usrInputSearch'; UPDATE usertable SET pwd='0wned', admin='I-am-admin', trusted=100",$link); 


That might have given me full access to the database...

And all I would have had to do is thus:

www.yoursite.com/script.php?usrInputSearch=blahblah';%20UPDATE %20usertable%20SET%20pwd='0wned',%20admin='I-am-admin',%20trusted=1;

Scary no?

[Raistlin]

Originally Posted by Richard M

PHP Code:

$result = mysql_query("SELECT * FROM tblMyTable WHERE requiredfield = '$usrInputSearch'",$link); 


Very insecure code there...

I could (if I wanted to) change that code to this:

PHP Code:

$result = mysql_query("SELECT * FROM tblMyTable WHERE requiredfield = '$usrInputSearch'; UPDATE usertable SET pwd='0wned', admin='I-am-admin', trusted=100",$link); 


That might have given me full access to the database...

And all I would have had to do is thus:

www.yoursite.com/script.php?usrInputSearch=blahblah';%20UPDATE %20usertable%20SET%20pwd='0wned',%20admin='I-am-admin',%20trusted=1;

Scary no?

Yep, very scary

So, how do I get round that?

This is my first attempt at doing anything with PHP

[Raistlin]

Anybody?

[philip.j.fry]

Originally Posted by Raistlin

Anybody?

Connect to the db with a user that only has SELECT privilidges and use that connection for your query. Alternatively you can parse the input to make sure there is no nasty stuff. Or do both

[Raistlin]

Ok, so I connect to the database with an account that only has SELECT privileges - how do I then do the update that I want to do on the table?

I'm assuming that I would then need to connect using an account that has UPDATE privileges but then I'm running the same risk surely?

Not sure how I'd go about "parsing the input" either, I'm really new to all this PHP stuff.

Richard would appreciate any more comments you have on this security issue, unless I can get this resolved I'm on to a real no starter here

[Paul K]

May need to PM him for advice, he was last active 30 mins ago, I'm sure he won't mind since he is interested in what you are trying to create

[Raistlin]

Originally Posted by Paul

May need to PM him for advice, he was last active 30 mins ago, I'm sure he won't mind since he is interested in what you are trying to create

May do if he doesn't see this, if he's not been active for a while he won't see the PM either

Thanks though