0

Im using PHP & MySQL, the Problem im facing to INSERT data using "mysql_fetch_array".

this is my my connection to Mysql and my query to display data.

There are 2 table in this. 1 table for display. 1 more for insert data.

<?php

$host="localhost"; // Host name 
$username="root"; // Mysql username 
$password=""; // Mysql password 
$db_name="skpj"; // Database name  

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

$sql="SELECT * FROM `student` WHERE cls_id = '13' ";
$result=mysql_query($sql);

// Count table rows 
$count=mysql_num_rows($result);
?>

    <form name="form1" method="post" action="">
    <?php while($rows=mysql_fetch_array($result)){ ?>

    <?php echo $rows['s_no']; ?>

    <?php echo $rows['name']; ?>
    <input name="s_no[]" type="hidden" id="name" 
value="<?php echo $rows['s_no']; ?>">

    <?php echo $rows['ic']; ?>

    <?php echo $rows['cls_id']; ?>
    <input name="class_n[]" type="hidden" id="cls_id" 
value="<?php echo $rows['cls_id']; ?>">

    <select name="att[]" id="att" style=" width:80px" >
      <option value="1">Atten</option>
      <option value="2">Absend</option>
      <option value="3">MC</option>
    </select>
    <input name="tmp[]" type="hidden" id="name" value="1">
    <?php } ?>

    <input type="submit" name="submit" value="submit"></td>
</form>

<?php

if($submit){
   for($i=0;$i<$count;$i++){
      $sql1="INSERT INTO attendance (s_no, class_n, att, tmp) 
      VALUE '$s_no[i]','$class_n[i]','$att[i]','$tmp[i]' ";
      $result1=mysql_query($sql1);
   }
}

if($result1){
  header("location:att2.php");
}
mysql_close();
?>

below is the notice foe my error.

SCREAM: Error suppression ignored for

Notice: Undefined variable: submit in C:\wamp\www\att\att2.php on line 67

Notice: Undefined variable: result1 in C:\wamp\www\att\att2.php on line 74

furthermore i cannot insert my data

This is the error massage

Community
  • 1
  • 1
Ameer
  • 11
  • 1
  • change `if($submit)` to `if(isset($_POST["submit"]))`. – birraa Dec 31 '16 at 11:09
  • still got error. this time Notice: Undefined variable: s_no, class_n, att, tmp – Ameer Dec 31 '16 at 11:57
  • Because you have to use the $_POST[] array to access these form values. – birraa Dec 31 '16 at 12:03
  • Try this `$sql1="INSERT INTO attendance (s_no, class_n, att, tmp) VALUE '".$_POST['s_no'][i]."','".$_POST['class_n'][i]."','".$_POST['att'][i]."','".$_POST['tmp'][i]."'";` – birraa Dec 31 '16 at 12:32
  • Keep in mind that this is susceptible to SQL injection attack. – birraa Dec 31 '16 at 12:33
  • @Ameer in `insert` query put VALUES insteadof VALUE – denny Dec 31 '16 at 18:41
  • @birraa "Notice: Undefined variable: _POST‌​" this error hapen – Ameer Dec 31 '16 at 22:53
  • @Ameer mysql_ is deprecated and is not supported in php7. Use PDO insted. – mandza Jan 02 '17 at 09:07
  • 1
    This is method is extremely susceptible to MySQL injection. You've also provided credentials within the application directory which will allow lateral movement attacks to your DB Server. The DB Server if not configured to prevent execution will allow additional lateral movements. Your entire infrastructure will go under with insecure code like this. – Steve Kline Jan 02 '17 at 09:13

2 Answers2

0

This was my stab at it.... let me know if this helps. I reorganized it in a method that makes sense for me. Again, you really should lock this code down a bit better. I'm just fighting insomnia here... I don't think I can contribute that much for this post.

<?php
    #Use Object-Oriented Programming to open DB
    $mysqli = new mysqli("$host", "$username", "$password", "$db_name");
    if ( $mysqli->connect_error ) {
        die('Connect Error: ' . $mysqli->connect_error);
    }
    $students=$mysqli->prepare("SELECT * FROM `student` WHERE cls_id = '13'");
    $students->execute();
    $students->store_result();
    $studentslist = $students->fetch_array(MYSQLI_ASSOC);
    $count = $stmt->num_rows
?>

The form document...

<form name="form1" method="post" action="">
    <?php 
        foreach ($studentslist as $row=>$rows) {
            echo "<tr>"
            echo "<td>$rows['s_no']</td>";
            echo "<td>$rows['name']</td>";
            echo "<td>$rows['ic']</td>";
            echo "<td>$rows['cls_id']</td>";
            echo "<td><select name='att[]' id='att' style=' width:80px'>";
            echo "  <option value='1'>Atten</option>";
            echo "  <option value='2'>Absend</option>";
            echo "  <option value='3'>MC</option>";
            echo "</select></td>";
            echo "<input name='class_n[]' type='hidden' id='cls_id' value='$rows['cls_id']>";
            echo "<input name='s_no[]' type='hidden' id='name' value='$rows['s_no']>";
            echo "<input name='tmp[]' type='hidden' id='name' value='1'>";//???? I DONT UNDERSTAND THIS VALUE
        } 
        $students->close;
    ?>
    <input type='submit' name='submit' value='submit'></td>
</form>

<?php
    #SECURE YOUR INPUT/POST PARAMETERS TO ONLY ALLOW FROM THE SERVER ITSELF. 
    #JUST CHECKING FOR SUBMIT FOR NOW
    if(isset($_POST["submit"])) {
        $sno = $_POST['s_no'];//CAPTURED ARRAY
        $cls = $_POST['class_n'];//CAPTURED ARRAY
        $att = $_POST‌​['att']);//CAPTURED ARRAY
        $tmp = $_P‌​OST['tmp'][i];//CAPTURED ARRAY
        for ($i = 0; $i <= count(sno); $i++) {
            $insert_stmt = $mysql->prepare("INSERT INTO attendance(s_no, class_n, att, tmp) VALUES (?, ?, ?, ?)")) {
            $insert_stmt->bind_param('iiii', mysql_real_escape_string($s_no[$i]), mysql_real_escape_string($class_n), mysql_real_escape_string($att), mysql_real_escape_string($tmp));
            // Execute the prepared query.
            if (! $insert_stmt->execute()) {
                echo "Uh oh! Houston we have a problem!!";
            else
                //$insert_stmt->affected_rows
                // DO Something here....
                //$insert_stmt->close
                echo "<script>console.log('Affected ".$insert_stmt->affected_rows."');</script>";
            }
        }
   }
?>
Steve Kline
  • 805
  • 4
  • 11
-1

Try this:

$sno = mysql_real_escape_string($_POST['s_no'][i]);
$cls = mysql_real_escape_string($_POST['class_n'][i]);
$att = mysql_real_escape_string($_POST‌​['att'][i]);
$tmp = mysql_real_escape_string($_P‌​OST['tmp'][i]);
$sql1="INSERT INTO attendance (s_no, class_n, att, tmp) VALUES ('$sno', '$cls', '$att', '$tmp')";
birraa
  • 430
  • 1
  • 4
  • 15