Geek Answers Handbook

Php sql page resubmission form

Neglecting the obvious security flaws of mysql and sql escape strings, does anyone know why my sql tables are populated with empty msgs when the page reloads. Each synchronous time when the page reloads the form is submitted. I am confused why this is happening and how can I stop it?

  <?php ob_start(); session_start(); $con = mysql_connect("localhost","username","pass"); if (!$con) { die('Could not connect: ' . mysql_error()); } $dates = date('Ymd H:i:s'); $uid = $_SESSION['user_id']; $msg_id = (int) $_GET['msg_id']; mysql_select_db("db_table", $con); $result = mysql_query("SELECT users.first_name, users.last_name , intro.intro, intro.outro FROM intro INNER JOIN users ON intro.user_id = users.user_id WHERE intro.message_id = {$msg_id}"); while($row = mysql_fetch_array($result)) { echo "<div id=\"start\"><div class=\"namedate\"><h1>". $row['first_name'] ." ". $row['last_name'] . "</h1><h2>test</h2></div><div id=\"holdmsg\"><div class=\"cent\"><strong>" . $row['intro'] . "</strong><br><i>" . $row['outro'] ."</i></div></div></div> " ; }

The FORM PART refers to this part, as well as the $ _GET at the top of the page.

 <form action="" method="post"> <?php $sql="INSERT INTO messages (user_id, intro_id , msg, date ) VALUES (('$uid'), {$msg_id} ,'$_POST[msg]', ('$dates'))"; if (!mysql_query($sql,$con)) { die('Error: ' . mysql_error()); } mysql_close($con); ?> <textarea rows="2"style="float:left" name="msg" type="text"placeholder="Elaborate on your idea..."></textarea> <input id="togz2" style="float:right; "type="submit" value="SUBMIT" name="submit" class="butts"> </div></div> </form>
+4
source share
2 answers

Why not do it like this?

 if (mysql_query($sql,$con)) { header('location:yourpage.php'); }else{ die('Error: ' . mysql_error()); }

Also, I do not see such a statement above your insert request. How

 if(isset($_REQUEST['submit'])){ //to check if posted $sql="INSERT ...... }

In addition, you should also check your data before inserting it into the database.

+3
source

Here is a good example of how to prevent duplicate entries on page load

Please refer to the link http://www.webhostingtalk.com/showthread.php?t=700175 .

 <?php session_start(); $faction = $_REQUEST['faction'] ; if (!is_array($_SESSION['serials'])) $_SESSION['serials'] = array (); if ($_REQUEST['serial']){ if ( in_array ($_REQUEST['serial'] , $_SESSION['serials'] ) ){ // duplicate submition, nullify it $faction = ''; }else{ $_SESSION['serials'][] = $_REQUEST['serial'] ; } } if ($faction) { // form submited // if faction is not set completely ignore submition } ?> <form> <input type="hidden" name="faction" value="42"> <input type="hidden" name="serial" value="<?=rand(1000000 , 9999999)?;>"> .... the rest of the form is here .... </form>

Another solution:

After a successful installation, you should be redirected to a new page.

+2
source

More articles:


All Articles