Approve users from table - check box

Question

I'm writing an php script to approve users that registered on my page, but i'm facing a little problem when i want to approve them. Here's as far as i could get.

Table:

<?php
mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("activation") or die(mysql_error());
//User Approval Script
$result2 = mysql_query("SELECT * FROM userinfo WHERE status='0'") 
or die(mysql_error());
echo "<table border='1'>";
echo "<tr> <th>Name</th> <th>Action</th> <th>Hours</th> <th>Approve</th> </tr>";
while($row = mysql_fetch_array( $result2 )) {
 // Print out the contents of each row into a table
 echo "<tr><td>"; 
 echo $row['first_name'];
 echo "</td><td>"; 
 echo $row['last_name'];
 echo "</td>"; 
 echo "<td>"; 
 echo $row['email'];
 echo "</td><td>";
 echo "<form action=\"approve.php\" method=\"post\"><input name=\"approve[]\" type=\"checkbox\">";
 echo "</td></tr>";
}
echo "</table>";
echo "<input type=\"submit\" value=\"Approve\"></form>";
?>

approve.php

<?php
mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("activation") or die(mysql_error());
$ticked = $_POST['approve'];

foreach($ticked as $id) {
     mysql_query("UPDATE status SET approved = '1' WHERE `ID` = '$id'");
}
unset($id);  
?>

I would also like to know how i can send email to each user that is approved...

Thanks in advance everyone!

Edit:

The page on approve.php is all blank, and status isn't getting updated.

Your code is very vunerable to SQL Injection. See [How can I prevent SQL injection in PHP?](http://stackoverflow.com/q/60174) and [Why shouldn't I use mysql\_\* functions in PHP?](http://stackoverflow.com/q/12859942). — Madara's Ghost, Dec 06 '13 at 09:40
use PHP `mail()` function - Ref: http://php.net/manual/en/function.mail.php — Krish R, Dec 06 '13 at 09:41

score 1 · Accepted Answer · answered Dec 06 '13 at 09:49

Can you try this, Moved <form> tag from near checkbox into top and added checkbox value with $row["id"]

<?php
        mysql_connect("localhost", "root", "") or die(mysql_error());
        mysql_select_db("activation") or die(mysql_error());
        //User Approval Script
        $result2 = mysql_query("SELECT * FROM userinfo WHERE status='0'") 
        or die(mysql_error());
        echo "<form action=\"approve.php\" method=\"post\"><table border='1'>";
        echo "<tr> <th>Name</th> <th>Action</th> <th>Hours</th> <th>Approve</th> </tr>";
        while($row = mysql_fetch_array( $result2 )) {
         // Print out the contents of each row into a table
         echo "<tr><td>"; 
         echo $row['first_name'];
         echo "</td><td>"; 
         echo $row['last_name'];
         echo "</td>"; 
         echo "<td>"; 
         echo $row['email'];
         echo "</td><td>";
         echo "<input name=\"approve[]\" type=\"checkbox\" value='".$row["id"]."' >";
         echo "</td></tr>";
        }
        echo "</table>";
        echo "<input type=\"submit\" value=\"Approve\"></form>";
?>

In approve.php,

<?php
    mysql_connect("localhost", "root", "") or die(mysql_error());
    mysql_select_db("activation") or die(mysql_error());
    $ticked = $_POST['approve'];

    foreach($ticked as $id) {
         mysql_query("UPDATE status SET approved = '1' WHERE `ID` = '$id'");

         $message ='Approved message';

         mail('to email address', 'Your Subject', $message);
    }

 ?>

Note: Use mysqli_* functions or PDO instaed of using mysql_* functions (deprecated)

score 0 · Answer 2 · answered Dec 06 '13 at 09:55

You tried to open form in loop while and missed attribute value in checkbox.

Change

echo "<form action=\"approve.php\" method=\"post\"><input name=\"approve[]\" type=\"checkbox\">";

To

echo '<input name="approve" type="checkbox" value='.$row["id"].'>';

Then put echo "<form action ='approve.php' method='post'>"; above while($row = mysql_fetch_array( $result2 )) {

score -1 · Answer 3 · edited May 23 '17 at 10:32

You should have one large form, with many checkboxes (I imagine that's what your second page is based upon), but checkboxes are <input>s, not <form>s. Your final HTML should look something like:

<form>
    <table>
    ...
    <td><input type="checkbox" name="approve[]" value="USERIDTHATYOUWANTTOAPPROVE"></td>
    ...
    <td><input type="checkbox" name="approve[]" value="OTHERUSERIDTHATYOUWANTTOAPPROVE"></td>
    ...
    </table>
</form>

Also!

Your code is very susceptible to SQL Injection. See How can I prevent SQL injection in PHP? and Why shouldn't I use mysql_* functions in PHP?.
You should use prepared statements to offload work in your code (you only send the query once, and change the parameters each time).

Approve users from table - check box

3 Answers3

Also!