My ISSET post function is not working , can't pinpoint why

Question

I've been trying to get my isset post function to work, I don't think there are any typographical errors as I've checked multiple times now. Are there any ways where I can pinpoint as to why it isn't working? I've tried testing out my SQL insert query by hardcoding the data and it worked. However when I click the submit button after keying in the inputs on the form the page refreshes and the data doesn't go to the database. The search query is not working either. Therefore I deduced that the problem might be with my ISSET function. Below is the code if needed:

<?php
    // Load the required files
    require_once 'dbconfig.php';

    //connect to database
    $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD,DB_NAME);
    //echo $_SESSION['email'];
    $id = "";
    $empid = "";
    $name = "";
    $entitlement = "";
    $date = "";
    $clinic = "";
    $type = "";
    $days = "";
    $currency = "";
    $paid = "";
    $rate = "";
    $claimed = "";
    $balance = "";
    $hospleave = "";
    $medleave = "";
    $remark = "";

function getEmployee()
{   
    $employee = array();
    $employee[0] = $_POST['empid'];
    $employee[1] = $_POST['name'];
        return $employee;
}

// get values from the form
function getPosts(){
    $posts = array();
    //$post[0] = $_POST['empid'];
    //$post[1] = $_POST['name'];
    $posts[2] = $_POST['entitlement'];
    $posts[3] = $_POST['date'];
    $posts[4] = $_POST['clinic'];
    $posts[5] = $_POST['type'];
    $posts[6] = $_POST['days'];
    $posts[7] = $_POST['currency'];
    $posts[8] = $_POST['paid'];
    $posts[9] = $_POST['rate'];
    $posts[10] = $_POST['claimed'];
    $posts[11] = $_POST['balance'];
    $posts[12] = $_POST['hospleave'];
    $posts[13] = $_POST['medleave'];
    $posts[14] = $_POST['remark'];
    return $posts;
}

// Search (drop downlist.)

if(isset($_POST['search']))
{
    $employee = getEmployee();

    $search_Query = "SELECT * FROM employees WHERE emp_id = '$employee[0]'";

    $search_Result = mysqli_query($dbc, $search_Query);

    if($search_Result)
    {
        if(mysqli_num_rows($search_Result))
        {
            while($row = mysqli_fetch_array($search_Result))
            {               
                $empid=$row['emp_id'];
                $name=$row['emp_fullname'];
            }
        }else{
            echo 'No Data For This Id';
        }
    }else{
        echo 'Result Error';
    } 
}

// Insert
if(isset($_POST['insert']))
{
    $employee = getEmployee();
    $data = getPosts();

    //Upload Image(receipt)

    //insert statement
    /*$insert_Query= ("INSERT INTO `medical`
                (`emp_id`,`emp_fullname`, `med_entitlement`, `med_date` ,
                `med_clinic`, `med_days`, `med_paid`, `med_currency`, 
                `med_rate`, `med_claimed`, `med_balance`,`hosp_leave`, 
                `med_leave`,`med_remark`) 
        VALUES ('$employee[0]', '$employee[1]', '$data[2]', '$data[3]', 
                '$data[4]', '$data[5]', '$data[6]', '$data[7]', 
                '$data[8]', '$data[9]', '$data[10]', 
                '$data[11]'),'$data[12]'),'$data[13]'),'$data[14]')");
    */
    $insert_Query="INSERT INTO `medical` 
                (`med_id`, `emp_id`, `emp_fullname`, `med_entitlement`, 
                `med_date`, `med_clinic`, `med_days`, `med_paid`, 
                `med_currency`, `med_rate`, `med_claimed`, `med_balance`, 
                `med_remark`, `med_leave`, `hosp_leave`, `med_type`) 
        VALUES ('$employee[0]', '$employee[1]', '$data[2]', '$data[3]', 
                '$data[4]', '$data[5]', '$data[6]', '$data[7]', 
                '$data[8]', '$data[9]', '$data[10]', 
                '$data[11]'),'$data[12]'),'$data[13]'),'$data[14]')";  
    $insert_Result = mysqli_query($dbc, $insert_Query);



    if($insert_Result){
        if(mysqli_affected_rows($dbc) > 0){
            echo 'Data Inserted';
        }else{
            echo 'Data Not Inserted';
        }

        header("Location: displaymed.php");//redirect to claimDisplay.php page
        mysqli_close( $dbc ) ;      
    }
}
?>
<div id="form">
<form action="medfee.php" method="post" name="myForm" onsubmit="return(validate());" enctype="multipart/form-data" >
      <table border=0 width='82%'>

            <tr><br><br>
            <td>Employee ID</td><td>:</td><td><input type="text" name="empid" maxlength="5" pattern="[A-Z]{3,5}" required title="Min.3, Max. 5 Capitial Letters ONLY!" ><td><input type="submit" name="search" value="Find"></td></td>
            <td>Amount Paid</td><td>:</td><td><input type="text"  name="paid"></td>
            </tr>

            <tr>
            <td>Full Name</td><td>:</td><td><input type="text" name="name"></td>
            <td></td>
            <td>Exchange Rate</td><td>:</td><td><input type="text" name="rate"></td>
            </tr>

            <tr>
            <td>Entitlement</td><td>:</td><td><input type="text" name="entitlement"></td>
            <td></td>
            <td>Amount Claimed (SGD)</td><td>:</td><td><input type="text" name="claimed" >
            </tr>

            <tr>
            <td>Date</td><td>:</td><td><input type="text" name="date" placeholder="DD-MM-YYYY"></td>
            <td></td>
            <td>Amount Balance (SGD)</td><td>:</td><td><input type="text" name="balance"></td>
            </tr>

            <tr>
            <td>Hospital / Clinic</td><td>:</td><td><input type="text" name="clinic"></td>
            <td></td>
            <td>Balance Hospital Leave</td><td>:</td><td><input type="text" name="hospleave"></td>
            </tr>

            <tr>
            <td>Medical Type</td><td>:</td><td><select name="type">
                <option selected></option>
                <option value="Medical Leave">Medical Leave</option>
                <option value="Outpatient Leave">Outpatient Leave</option>
                <option value="Hospitalization Leave">Hospitalization Leave</option>

                </select></td>
            <td></td>
            <td>Balance Medical Leave</td><td>:</td><td><input type="text" name="medleave"></td>
            </tr>

            <tr>
            <td>Utilized (Days)</td><td>:</td><td><input type="text" name="days"></td>
            <td></td>
            <td>Remarks</td><td>:</td><td><input type="text" name="remark"  style="height:50px; rows="2" cols="25"></td>
            </tr>
            <tr>
            <td>SGD / RM</td><td>:</td><td><input type="text" name="currency"></td>
            <td></td>
            </tr>

            <tr>
            <td></td>
            <td></td><td></td><td></td><td></td>
            <td align="right"><input type="submit" name="insert" value="Add"></td>
            </tr>   

            <tr>
            <td><br><br><br></td>
            <td></td>
            </tr>
        </table>
    </form>
</div>

Add `ini_set('display_errors', 1); ini_set('log_errors',1); error_reporting(E_ALL); mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);` to the top of your script. This will force any `mysqli_` errors to generate an Exception that you can see on the browser and other errors will also be visible on your browser. — RiggsFolly, Aug 24 '17 at 00:50
@MeharrunNishaa It's like an unwritten rule on SO that we need to urge you to use mysqli's prepared statements with placeholders when you are using user-provided data in your queries. — mickmackusa, Aug 24 '17 at 00:53
Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) — RiggsFolly, Aug 24 '17 at 00:54
For the sake of providing a minimal code block in your question, we can safely remove the `$_POST['search']` if block right? I mean it's not even in your form. — mickmackusa, Aug 24 '17 at 00:57
@mickmackusa Hey I'm sorry but I'm not familiar with what you're trying to say, I'm pretty new to programming and there's still a lot of things that I'm not sure of — Meharrun Nishaa, Aug 24 '17 at 00:58
On StackOverflow, user who ask questions should only post the relevant portions of their code (not the entire file). This will help us to read and isolate any problems. I am asking if your question can be edited to remove the entire `search` `if{}` block. — mickmackusa, Aug 24 '17 at 01:00
Have you turned on error reporting? Are there any syntax errors in your log? Have you written any check points (echos/var_exports) to see if data exists where you expect it to exist? Can you write `var_export($_POST)` at the start of your file and tell use what you get? — mickmackusa, Aug 24 '17 at 01:01
@mickmackusa I'm having problems with both the search and insert block, which is why I actually posted both. It's actually on the form beside Employee ID actually. — Meharrun Nishaa, Aug 24 '17 at 01:02
@mickmackusa Parse error: syntax error, unexpected 'require_once' (T_REQUIRE_ONCE) in C:\wamp64\www\Invento Website\medfee.php on line 92 Line 92 : require_once 'dbconfig.php'; — Meharrun Nishaa, Aug 24 '17 at 01:06
I guess you better check that that file exists in the directory that you think it does. http://php.net/manual/en/function.require-once.php — mickmackusa, Aug 24 '17 at 01:09
@mickmackusa I've checked, it does exist in that directory itself. — Meharrun Nishaa, Aug 24 '17 at 01:16
Seems like a path problem. related: https://stackoverflow.com/questions/16623350/including-config-file-in-php or look at this answer: https://stackoverflow.com/a/29763496/2943403 — mickmackusa, Aug 24 '17 at 01:16
@RiggsFolly I've attempted adding that, but nothing showed up — Meharrun Nishaa, Aug 24 '17 at 06:25
@mickmackusa tried testing my php and form on a new file and got this error Fatal error: Uncaught exception 'mysqli_sql_exception' with message 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''),''),'')' at line 1' in C:\wamp64\www\Invento Website\medfee1.php on line 91 — Meharrun Nishaa, Aug 24 '17 at 07:40
Try to print this and see if you are getting this correct: $search_Query = "SELECT * FROM employees WHERE emp_id = '$employee[0]'"; — Just_Do_It, Aug 25 '17 at 14:54

score 0 · Accepted Answer · answered Aug 25 '17 at 13:55

Here are the typos in your $insert_Query...

Change:

),'$data[12]'),'$data[13]')

To:

,'$data[12]','$data[13]'

So that your query looks like this:

$insert_Query="INSERT INTO `medical` 
                (`med_id`, `emp_id`, `emp_fullname`, `med_entitlement`, 
                `med_date`, `med_clinic`, `med_days`, `med_paid`, 
                `med_currency`, `med_rate`, `med_claimed`, `med_balance`, 
                `med_remark`, `med_leave`, `hosp_leave`, `med_type`) 
        VALUES ('$employee[0]', '$employee[1]', '$data[2]', '$data[3]', 
                '$data[4]', '$data[5]', '$data[6]', '$data[7]', 
                '$data[8]', '$data[9]', '$data[10]', 
                '$data[11]','$data[12]','$data[13]','$data[14]')";

Better still, you should be using mysqli prepared statements for security purposes. Research this topic as much as you can until you are comfortable with it. Start with this example: https://stackoverflow.com/a/2553892/2943403 then check the php manual and other snippets around the internet. This is time well spent.

My ISSET post function is not working , can't pinpoint why

1 Answers1