0

I've been really struggling with this today. Can't seem to get it to work, all it does is navigates to 'add-entry.php?go' in the navbar, but goes grey then reloads the index.php with modal still intact with my entries in it.

Here's my html, including the form and javascript filter input.

<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8">
    <title>ProSys Component Lookup</title>
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="shortcut icon" href="favicon.ico">
    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css">
    <script src="https://code.jquery.com/jquery-3.1.1.slim.min.js" integrity="sha384-A7FZj7v+d/sdmMqp/nOQwliLvUsJfDHW+k9Omg/a/EheAdgtzNs3hpfag6Ed950n" crossorigin="anonymous"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/tether/1.4.0/js/tether.min.js" integrity="sha384-DztdAPBWPRXSA/3eYEEUWrWCy7G5KFbe8fFjk5JAIxUYHKkDx6Qin1DkWx51bBrb" crossorigin="anonymous"></script>
    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa" crossorigin="anonymous"></script>    <!--Custom CSS -->
    <link rel="stylesheet" href="css/main.css">
  </head>
  <body>
    <!-- Wrapper -->
  <div class="container-fluid">
  <div class="col-xs-12">
  <div class="col-xs-12">
    <!-- Header -->
    <div class="page-header">
      <h1><a href="index.php">ProSys Component Lookup</a></h1><br>
    </div>
    <!-- Main table content -->
    <div class="container-fluid">
      <button type="button" class="btn btn-primary btn-block" data-toggle="modal" data-target="#myModal">Add New Item</button><br>
      <div class="modal fade" role="dialog" id="myModal">
        <div class="modal-dialog">
          <div class="modal-content">
            <div class="modal-header">
              <button type="button" class="close" data-dismiss="modal">&times;</button>
              <h4 class="modal-title">Add New Item</h4>
            </div>
            <div class="modal-body">
              <form method="post" action="add-entry.php?go" role="form">
                <div class="form-group">
                  <label for="location">Location:</label>
                  <input type="text" class="form-control" name="location">
                </div>
                <div class="form-group">
                  <label for="category">Category:</label>
                  <select class="form-control" name="category">
                    <option>Processor</option>
                    <option>Diode</option>
                    <option>Fuse</option>
                    <option>Regulator</option>
                    <option>Capacitor</option>
                    <option>Inductor</option>
                    <option>LED</option>
                    <option>Gate</option>
                    <option>Modem</option>
                    <option>Transceiver</option>
                    <option>Thermistor</option>
                    <option>Load Switch</option>
                    <option>Op Amp</option>
                    <option>Optocoupler</option>
                    <option>Line Driver</option>
                    <option>ESD Protection</option>
                    <option>ADC</option>
                    <option>RTC</option>
                  </select>
                </div>
                <div class="form-group">
                  <label for="manufacturer">Manufacturer:</label>
                  <input type="text" class="form-control" name="manufacturer">
                </div>
                <div class="form-group">
                  <label for="description">Description:</label>
                  <textarea type="text" class="form-control" name="description" rows="5"></textarea>
                </div>
                <div class="form-group">
                  <label for="packagesize">PackageSize:</label>
                  <input type="text" class="form-control" name="packagesize">
                </div>
                <div class="form-group">
                  <label for="category">Supplier:</label>
                  <select class="form-control" name="supplier">
                    <option>Farnell</option>
                    <option>RS</option>
                    <option>Rapid</option>
                  </select>
                </div>
                <div class="form-group">
                  <label for="suppliernumber">Supplier Number:</label>
                  <input type="text" class="form-control" name="suppliernumber">
                </div>
                <div class="form-group">
                  <label for="stock">Stock:</label>
                  <input type="text" class="form-control" name="stock">
                </div>
              </div>
              <div class="modal-footer">
                <button type="submit" class="btn btn-default">Add</button>
              </div>
              </form>
            </div>
          </div>
        </div>
      </div>
      <!-- Search box -->
      <div class="col-md-3">
        <form class="styled">
            <input type="text" class="form-control" onkeyup="myFunctionOne()" id="myInput" placeholder="Search..">
        </form><br>
      </div>
    <div class="panel">
      <div class="panel-body">
        <div class="row">
          <div class="col-xs-12">
            <table class="table table-hover" id="table_demo">
              <thead>
                <tr>
                  <th>Location</th>
                  <th>Manufacturer</th>
                  <th>Description</th>
                  <th>PackageSize</th>
                  <th>Supplier</th>
                  <th>SupplierNumber</th>
                  <th>Stock</th>
                </tr>
              </thead>
              <tbody id="myTable">
                <tr>
                  <!-- Database connect and display as table -->
                  <?php
                  include("dbconnect.php");

                  $result = mysql_query("SELECT DrawLocation, Manufacturer, Description, PackageSize, Supplier, SupplierNumber, Stock FROM complibrary");

                  while($complibrary = mysql_fetch_array($result))
                  {
                    echo"<td>".$complibrary['DrawLocation']."</td>";
                    echo"<td>".$complibrary['Manufacturer']."</td>";
                    echo"<td>".$complibrary['Description']."</td>";
                    echo"<td>".$complibrary['PackageSize']."</td>";
                    echo"<td>".$complibrary['Supplier']."</a></td>";
                    //IF statement adds in links for web search via SupplierNumber
                    if ($complibrary['Supplier'] == 'Farnell') {
                      echo"<td><a target='_blank' href='http://uk.farnell.com/search?st=".$complibrary['SupplierNumber']."'>".$complibrary['SupplierNumber']."</a></td>";
                    } elseif ($complibrary['Supplier'] == 'RS') {
                      echo"<td><a target='_blank' href='http://uk.rs-online.com/web/c/?sra=oss&r=t&searchTerm=".$complibrary['SupplierNumber']."'>".$complibrary['SupplierNumber']."</a></td>";
                    } elseif ($complibrary['Supplier'] == 'Rapid') {
                      echo"<td><a target='_blank' href='https://www.rapidonline.com/Catalogue/Search?query=".$complibrary['SupplierNumber']."'>".$complibrary['SupplierNumber']."</a></td>";
                    } else {
                      echo"<td>".$complibrary['SupplierNumber']."</td>";
                    }
                    //IF statement end
                    echo"<td>".$complibrary['Stock']."</td>";
                    echo "</tr>";
                  }
                  mysql_close($conn);
                  ?>
                </table>
              </div>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>
  </body>
  <!-- Latest jQuery -->
  <script src="https://code.jquery.com/jquery-1.11.3.min.js"></script>
  <script src="https://code.jquery.com/mobile/1.4.5/jquery.mobile-1.4.5.min.js"></script>
  <!-- Filtering script -->
  <script>
    function myFunctionOne() {
      var input, filter, table, tr, td, i;
      input = document.getElementById("myInput");
      filter = input.value.toUpperCase();
      table = document.getElementById("myTable");
      tr = table.getElementsByTagName("tr");
      for (i = 0; i < tr.length; i++) {
        td = tr[i].getElementsByTagName("td")[2];
        if (td) {
          if (td.innerHTML.toUpperCase().indexOf(filter) > -1) {
            tr[i].style.display = "";
          } else {
            tr[i].style.display = "none";
          }
        }
      }
    }
  </script>
</html>

And here's my add-entry.php

<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8">
  </head>
  <body>
    <?php
      if (isset($_POST['location'])){
        $hostname = "localhost";
        $username = "root";
        $password = "";
        $dbname = "componentlookup";

        $conn = mysql_connect($hostname, $username, $password);

        if (!$conn) {
          die('Could not connect: ' . mysql_error());
        }

        mysql_select_db($dbname, $conn);

        $location = $_POST['location'];
        $category = $_POST['category'];
        $manufacturer = $_POST['manufacturer'];
        $description = $_POST['description'];
        $packagesize = $_POST['packagesize'];
        $supplier = $_POST['supplier'];
        $suppliernumber = $_POST['suppliernumber'];
        $stock = $_POST['stock'];

        $query = mysql_query("INSERT INTO 'complibrary' (ID, DrawLocation, Category, Manufacturer, Description, PackageSize, Supplier, SupplierNumber, Stock) VALUES ('NULL', '$location', '$category', '$manufacturer', '$description', '$packagesize', '$supplier', '$suppliernumber', '$stock')");

        echo "Item added sucessfully. Click <a href='index.php'>HERE</a> to go back.";
        mysql_close($conn);
      }
    ?>
  </body>
</html>

Any ideas?

Tom Algar
  • 1
  • 1
  • Your code is vulnerable to [**SQL injection**](https://en.wikipedia.org/wiki/SQL_injection) attacks. You should use prepared statements with bound parameters, via either the [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) drivers. [**This post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) has some good examples. – Alex Howansky Jun 28 '17 at 14:03
  • Don't use the `mysql_*` functions. They have been deprecated since v5.5 (Jun 2013) and removed since v7.0 (Dec 2015). Instead use the [**mysqli_***](https://secure.php.net/manual/en/book.mysqli.php) or [**PDO**](https://secure.php.net/manual/en/book.pdo.php) functions with [**prepared statements**](https://secure.php.net/manual/en/pdo.prepare.php) and [**bound parameters**](https://secure.php.net/manual/en/pdostatement.bindparam.php). – Alex Howansky Jun 28 '17 at 14:04
  • Thanks for your comments, the SQL Injection isn't really a concern as this is only going to be available internally and is only really for one of my colleagues to keep track of his spare components. I will update to mysqli, will this fix the problems I am having? – Tom Algar Jun 28 '17 at 14:27
  • Don't think, "_I'll fix it later_," or, "_It's just a small personal project_," or, "_It's on a private network_." It's a serious issue with serious consequences, regardless of the situation. It takes no additional effort to do it correctly from the start, it builds good habits, and it lessens the amount of bad code available for other SO users to stumble across and copy. – Alex Howansky Jun 28 '17 at 14:28
  • 1
    That's a fair comment. Changing it now. – Tom Algar Jun 28 '17 at 14:29
  • I also plan on converting this eventually to MSSQL as this is what we use internally serverwise. – Tom Algar Jun 28 '17 at 14:32
  • Great -- then use PDO, and that change will be like one line of code. – Alex Howansky Jun 28 '17 at 14:32

1 Answers1

0

I think you should put data-dismiss="modal" on the add button to close the window. Also, I think you should not use mysql connection. Better, use mysqli or PDO.