0

I was following Luke Welling and Laura thompson's book on PHP-MYSQL web development I have the following code in html: 

<form action="processorder.php" method=post>
<table border=0>
<tr bgcolor=#cccccc>
<td width=150>Item</td>
<td width=15>Quantity</td>
</tr>
<tr>
<td>Tires</td>
<td align="center"><input type="text" name="tireqty" size="3"
maxlength="3"></td>
</tr>
<tr>
<td>Oil</td>
<td align="center"><input type="text" name="oilqty" size="3" maxlength="3"></td>
</tr>
<tr>
<td>Spark Plugs</td>
<td align="center"><input type="text" name="sparkqty" size="3"
maxlength="3"></td>
</tr>
<tr>
<td colspan="2" align="center"><input type="submit" value="Submit Order"></td>
</tr>
</table>
</form>
<tr>
<td>How did you find Bob's</td>
<td><select name="find">
<option value = "a">I'm a regular customer
<option value = "b">TV advertising
<option value = "c">Phone directory
<option value = "d">Word of mouth
</select>
</td>
</tr>

and this code in php:

<html>
    <head>
    <title>Bob's Auto Parts - Order Results</title>
    </head>
    <body>
    <h1>Bob's Auto Parts</h1>
    <h2>Order Results
    <?php
    //create short variable names
    $tireqty = $_POST['tireqty'];
    $oilqty = $_POST['oilqty'];
    $sparkqty = $_POST['sparkqty'];
    echo '<p>Order processed at ';
    echo date('H:i, jS F');
    echo '</p>';
    echo '<p>Your order is as follows: </p>';
    echo "$tireqty tires<br />";
    echo "$oilqty bottles of oil<br />";
    echo "$sparkqty spark plugs<br />";
    $totalqty = 0;
    $totalqty = $tireqty + $oilqty + $sparkqty;
    echo 'Items ordered: '.$totalqty.'<br />';
    $totalamount = 0.00;
    define('TIREPRICE', 100);
    define('OILPRICE', 10);
    define('SPARKPRICE', 4);
    $totalamount = $tireqty * TIREPRICE
    + $oilqty * OILPRICE
    + $sparkqty * SPARKPRICE;
    echo 'Subtotal: $'.number_format($totalamount,3).'<br />';
    $taxrate = 0.10; // local sales tax is 10%
    $totalamount = $totalamount * (1 + $taxrate);
    echo 'Total including tax: $'.number_format($totalamount,2).'<br />'
    switch($find)
    {
    case "a":
    echo "<p>Regular customer.</p>";
    break;
    case "b" :
    echo "<p>Customer referred by TV advert.</p>";
    break;
    case "c" :
    echo "<p>Customer referred by phone directory.</p>";
    break;
    case "d" :
    echo "<p>Customer referred by word of mouth.</p>";
    break;
    default :
    echo "<p>We do not know how this customer found us.</p>";
    break;
    }

    ?>

</h2>
</body>
</html>

I am getting server error on pressing the submit button. The switch block is causing the problem. I am using PhP 5.3.10. Can anyone point me the problem out? thanks in advance.

kzs
  • 1,111
  • 5
  • 20
  • 35
  • 1
    A Server Error (or a blank page) means that your script is throwing an error but you haven't configured PHP to display error messages. That's something you need to fix before you go further; it's impossible to code without the aid of error messages. Here's a [brief explanation](http://stackoverflow.com/a/5680885/13508). – Álvaro González Nov 04 '13 at 11:01
  • 2
    You know that you need to initialize $find before that? – Royal Bg Nov 04 '13 at 11:02
  • and ` – Royal Bg Nov 04 '13 at 11:10
  • FYI: Indentation will make your code so much easier to debug. – h2ooooooo Nov 04 '13 at 11:19
  • 1
    No offense, but if that's from a book, consider throwing it away. Using the POST data without escaping makes your page open to XSS attacks. And the mishmashing of PHP and HTML is pure spaghetti code that will become a nightmare to change and maintain in the long run. – Gordon Nov 04 '13 at 11:19
  • 4
    This question omits the error message so it's effectively a guessing game. – Álvaro González Nov 05 '13 at 08:13

3 Answers3

4

i think you haven't initialize $find variable... try to add this in your .php file before switch case...

  $find=$_POST['find']

Yup you also forgot (;)

Kalpit
  • 4,906
  • 4
  • 25
  • 43
3

You missed a ";" just before the switch block.

--------------------------------------------------------------------▼
echo 'Total including tax: $'.number_format($totalamount,2).'<br />';

Then it will always match the default case as $find is not defined.

RafH
  • 4,504
  • 2
  • 23
  • 23
1

What is causing the 500 error (or the white page) is this:

echo 'Total including tax: $'.number_format($totalamount,2).'<br />'

Your missing the ; at the end. The reason your Switch is not working is because you are missing assigning the POST to a variable. Something like this:

$find=$_POST['find']

Although, that is a very insecure way of handling POST, you should always sanitize your post. Use something like this (this can be expanded as well)

$find = isset($_POST['find']) ? strip_tags(trim($_POST['find'])) : '';

Basically what that is doing is if $_POST['find'] has a value (isset), then do what is after the question mark. Strip and HTML, JavaScript Tags and Trim any spaces before or after it then assign the $_POST['find'] to the $find variable. After the : will give it a '' or blank value if nothing isset.

Hope that helps. Jeff

SecureLive
  • 80
  • 9