1

I tried to add a messagebox using a script. When I click on the button "registreren", the message box popup, but when I press cancel, the code still go further and performs the code twice.

When theOK butten will be pressed, the code must add the record to the table, when the Cancel butten will be pressed, the code should stop and go back to the preveous page.

<?php
if(isset($_POST['registreren'])) {

    session_start();

    $PartnerFName = mysqli_real_escape_string($con, $_POST['PartnerFName']);
    $PartnerLName = mysqli_real_escape_string($con, $_POST['PartnerLName']);

$ticket_id = $_GET['ticketID'];

$checkticketID = mysqli_query($con,"SELECT registratie.ticketID from registratie WHERE userID = ".$_SESSION['UserID'] ." AND ticketID = ".$_GET['ticketID'] ." ");

if (!$checkticketID) {
die('Query failed to execute for some reason');
}

if (mysqli_num_rows($checkticketID) > 0) {
?>
<script type="text/javascript">
   {
var r=confirm("U hebt deze registratie al eerder uigevoerd, toch verder gaan met de registratie?");
if (r==true){
//User Pressed okay. Verder gaan met de dubbele registratie
document.getElementById('myForm').submit();
    } 
    else
{
// user pressed cancel. Do nothing
 history.go(-1)
    }
}
        </script>
<?php

   $ticket = mysqli_fetch_array($checkticketID);
print_r($ticket); 
}

$sql = $con->query("INSERT INTO registratie(eventID, ticketID, UserID,     PartnerFName, PartnerLName)"
." SELECT eventID, ticketID, ".$_SESSION["UserID"].",'{$PartnerFName}','{$PartnerLName}' "
." FROM ticket WHERE ticketID = ".$_GET['ticketID'] ."") ;
    }       
?>
Benny
  • 67
  • 4
  • [Little Bobby](http://bobby-tables.com/) says [your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard Jun 08 '16 at 19:46

0 Answers0