0

Okay, it was working before.... now all of a sudden it has stopped. i'm not sure why. The only thing i've added was a delete feature.. and after that it no longer submits. I can delete an entry though =D

php code for form

 <?php

if (isset($_POST['submit'])){   

$con = mysql_connect("localhost", "", "");
if (!$con){
die("Cannot connect:" . mysql_error()); 
}

$Firstname = $_POST['Firstname'];
$Email = $_POST['Email'];
$Prayer = $_POST['Prayer'];



//if there is no input these messages will come up//    
if($Firstname==''){
echo "<script>alert('Please enter your name!')</script>";
exit();
}
if($Email==''){
echo "<script>alert('Please enter your email!')</script>";
exit(); 
}
if($Prayer==''){
echo "<script>alert('Please enter your prayer request!')</script>";
exit(); 
}


mysql_select_db("dxh6110",$con);

//if everything is good, information will be submitted to database
$sql = "INSERT INTO ChurchPrayer (Firstname, Email, Prayer) VALUES('$_POST[Firstname]','$_POST[Email]','$_POST[Prayer]')";



if(mysql_query($sql,$con)){

echo "<script>alert('Congratulations, You have successfully submitted your prayer requests. You will hear from us very soon!')</script>";


}

mysql_close($con);
}

?>

Oh, I'm aware that I should be using prepared statements to prevent SQL injection... but I'm not sure exactly what it is or what it looks like. I will definitely add them later, when I get further into my school project. Currently worried about the functionality..

not sure what else needs to be added... i'll add my delete.php 

<?php session_start(); //starting the session?>
<?php
//connecting to database
$con = mysql_connect("localhost","","","dxh6110");

//defining variable
$delete_id = $_GET['del'];
//command to remove input from SQL DB
$query = "delete from ChurchPrayer where id='$delete_id'";

if(mysql_query($con,$query)){

echo "<script>window.open('view_prayers.php?deleted=User has been deleted!','_self')</script>";

}



?>

My admin log-in works, and when the admin logs in it brings them to a page which will allow them to view entries and delete entries made to the DB. Currently there are two, but when I try to add more requests.... they don't go to the DB. No errors are given when submit is clicked.

Sumurai8
  • 20,333
  • 11
  • 66
  • 100
DLH
  • 67
  • 1
  • 10
  • 2
    Please, [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). They are no longer maintained and are [officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). Learn about [prepared statements](http://en.wikipedia.org/wiki/Prepared_statement) instead, and use [PDO](http://jayblanchard.net/demystifying_php_pdo.html). Was your server upgraded? – Jay Blanchard Apr 28 '15 at 16:50
  • Add error reporting to the top of your file(s) right after your opening ` – Jay Blanchard Apr 28 '15 at 16:51
  • 1
    `("localhost","dxh6110","tcqfoz7","dxh6110")` doesn't do what you think. Plus, `$_GET['del']` and `?deleted=User` inspect that. Those are the two things that stood out for me. – Funk Forty Niner Apr 28 '15 at 16:52
  • `Oh, I'm aware that I should be using SQL injection` Haha no you shouldn't be – Hanky Panky Apr 28 '15 at 16:52
  • 2
    then this `if(mysql_query($con,$query)){` the connection comes 2nd. – Funk Forty Niner Apr 28 '15 at 16:53
  • or should I have said I should be using prepared statements to prevent SQL injection? lol – DLH Apr 28 '15 at 16:54
  • 1
    "I will definitely add them later" ? Before or after someone hacks your account and destroys your project? – Strawberry Apr 28 '15 at 16:54
  • After @Strawberry. Definitely after. – Jay Blanchard Apr 28 '15 at 16:55
  • @DLH You seem to misunderstand what sql injection is, it is not just bad guys trying to hack your server, it is also you or any good-willing user breaking your system simply by adding a `'` in a value. So if you are worried about the functionality, you should start with avoiding sql injection. – jeroen Apr 28 '15 at 16:56
  • @DLH go read the links I provided, it isn't hard to implement. – Jay Blanchard Apr 28 '15 at 16:56
  • http://php.net/manual/en/function.mysql-connect.php and http://php.net/manual/en/function.mysql-select-db.php – Funk Forty Niner Apr 28 '15 at 16:58
  • okay, I will work on the prepared statements then.... thanks – DLH Apr 28 '15 at 16:58
  • 1
    go over all my comments again and links I provided. – Funk Forty Niner Apr 28 '15 at 16:58
  • 1
    plus, how are you using this, as far as a link to delete? it doesn't appear to be in your question, besides `echo "";` – Funk Forty Niner Apr 28 '15 at 17:02
  • @Fred it's just a delete link that the admin can press to remove the input. yeah and that window.open isn't popping up, but I don't really need it anyway. – DLH Apr 28 '15 at 17:15
  • 1
    is your delete link `?deleted=XXX` or `?del=XXX` ? `XXX` being an example. – Funk Forty Niner Apr 28 '15 at 17:16
  • ?deleted=xxx , should it be as ?del=xxx? – DLH Apr 28 '15 at 17:17
  • 1
    yepper roonie, should that be what you're using, you didn't post the method you're using to delete from. `$_GET['del']` needs to match the parameter in the `?parameter` in your method. – Funk Forty Niner Apr 28 '15 at 17:19
  • I'm going to have to ask my professor to help me out with the prepared statements. lol but thanks again Fred for all the help... it is appreciated. – DLH Apr 28 '15 at 17:21
  • Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/76473/discussion-between-dlh-and-fred-ii). – DLH Apr 28 '15 at 17:22

1 Answers1

4

Firstly, ("localhost","xxx","xxx","xxx") doesn't do what you think.

mysql_connect() takes 3 parameters, not 4. The fourth is for something else. Four parameters are what one would use with mysqli_connect(), but those different MySQL APIs do not intermix with each other, so don't use that connection method if you're going to use mysql_ functions.

Consult:

Do as you did in your other question:

$con = mysql_connect("localhost", "xxx", "xxx");
if (!$con){
die("Cannot connect:" . mysql_error()); 
}

mysql_select_db("your_db",$con);

Then this if(mysql_query($con,$query)){ the connection comes 2nd.

Plus, $_GET['del'] and ?deleted=User inspect that. Those are the two things that stood out for me.

If your delete link is ?deleted=XXX, it needs to be ?del=XXX - XXX being an example.

$_GET['del'] needs to match the parameter in the ?parameter in your method.

I.e.: view_prayers.php?del=XXX if view_prayers.php is the file you're using to delete with.

Plus, as mentioned in comments, this method is insecure.

It's best that you use mysqli with prepared statements, or PDO with prepared statements.

Community
  • 1
  • 1
Funk Forty Niner
  • 74,450
  • 15
  • 68
  • 141