0

I have a form that pulls a record from notifications table and inserts the updated query into alerts table. Along with INSERT query I also have an UPDATE query to update the status column in the notifications table.

The update query does not update the desired column, yet the page redirection happens. How do I fix this?

Here is the code:

<?php
    include 'config/connectDB.php';

    session_start();
    $id = $_GET['id'];
    $sql1 = 'SELECT * FROM notifications WHERE'.  " notify_id = '$id'";
    $result1 = mysqli_query($conn,$sql1);   
    if (isset($_SESSION['user_role']) AND $_SESSION['user_role'] == "admin"){
?>
<html>

   <head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">

    <title>Welcome </title>

    <link href="../css/bootstrap.min.css" rel="stylesheet">
    <link href="../css/style.css" rel="stylesheet">

    <link rel="stylesheet" href="//code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css">
    <link rel="stylesheet" href="/resources/demos/style.css">
    <script src="https://code.jquery.com/jquery-1.12.4.js"></script>
    <script src="https://code.jquery.com/ui/1.12.1/jquery-ui.js"></script>
    <script>
      $( function() {
        $( "#datepicker" ).datepicker();
      } );
    </script>


  </head>

   <body>
         <div class="container-fluid">
         <div class="row" style="text-align: right"><a href="index.php?logout" class="btn active">Logout</a></div>
            <div class="row">
                <div id="title" class="col-md-12">
                    <img src="../images/ff.png" class="img-responsive center-block" />
                </div>
            </div>
            <div class="row">
                <div id="menu" class="col-md-12">
                    <!-- navigations bar -->
                    <ul class="nav nav-pills nav-justified">
                        <li>
                            <a href="../index.php">Home</a>
                        </li>
                        <li>
                            <a href="../food-providers.php">Find Food</a>
                        </li>
                        <li class="dropdown">
                            <a href="../" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false">Join the Cause</a>
                            <ul class="dropdown-menu">
                                <li>
                                    <a href="../join-network.php">Become a Partner</a>
                                </li>
                                <li>
                                    <a href="../volunteer.php">Volunteer for Cause</a>
                                </li>
                            </ul>
                        </li>
                        <li>
                            <a href="../food-alert.php">Food Alert</a>
                        </li>
                        <li class="dropdown">
                            <a href="../" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false">Additional Info</a>
                            <ul class="dropdown-menu">
                                <li>
                                    <a href="../about.php">About Us</a>
                                </li>
                                <li>
                                    <a href="../contact.php">Contact Us</a>
                                </li>
                            </ul>
                        </li>
                        <li>
                            <a href="search.php">Edit Pantry</a>
                        </li>
                        <li class="active">
                        <a href="view-alert.php">View Alerts</a>
                        </li>
                        <li>
                            <a href="temp.php">Approve New Pantries</a>
                        </li>
                    </ul>
                </div>
            </div>


        <div class="row">
            <div class ="col-md-4 col-md-offset-4 text-center"> 
                    <h4>Create New Alert Ticket here:</h4>
                    <br>
                    <form name="pantryinfo" id="pantryForm" method = "post"  action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>"  data-toggle="validator" role="form">
                        <?php while ($row = mysqli_fetch_array($result1,MYSQLI_ASSOC))  {   ?>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <input type="hidden" class="form-control" id="id" name="=id" value="<?php echo $row['notify_id'];?>">
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <label>Food Type</label><br>
                                    <input type="text" class="form-control" id="category" name="category" value="<?php echo $row['foodtype'];?>" required>
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <br>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <label>Food Subtype</label><br>
                                    <input type="text" class="form-control" id="subcategory" name="subcategory" value="<?php echo $row['foodsubtype'];?>" required>
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <br>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <label>Quantity</label><br>
                                    <input type="text" class="form-control" id="quantity" name="quantity" value="<?php echo $row['quantity'];?>" required>
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <br>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <label>Unit of Measure</label><br>
                                    <input type="text" class="form-control" id="unit" name="unit" value="<?php echo $row['unit'];?>" required>
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <br>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <label>Food Rescue Timeframe</label><br>
                                    <input type="text" class="form-control" id="datepicker" name="datepicker" placeholder="MM/DD/YYYY" required>
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <br>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <label>Contact Person Name</label><br>
                                    <input type="text" class="form-control" id="name" name="name" value="<?php echo $row['name'];?>" required>
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <br>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <label>Organization name</label><br>
                                    <input type="text" class="form-control" id="org" name="org" value="<?php echo $row['org'];?>" required>
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <br>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <label>Contact Email</label><br>
                                    <input type="text" class="form-control" id="email" name="email" value="<?php echo $row['email'];?>" required>
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <br>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <label>Contact Number</label><br>
                                    <input type="text" class="form-control" id="number" name="number" value="<?php echo $row['number'];?>" required>
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <div class="control-group form-group">
                                <div class="controls">
                                    <label>Notification Send Date</label><br>
                                    <input type="text" class="form-control" id="alert_time" name="alert_time" value="<?php echo $row['alert_time'];?>" required>
                                    <p class="help-block"></p>
                                </div>
                            </div>
                            <br>


                            <br>

                            <div id="success"></div>
                            <!-- For success/fail messages -->
                            <div class="btn-group" role="group" aria-label="submit">
                                <input  name="submit" type="submit" id="submit"  value="Create Alert Ticket" class="btn btn-primary center-block">
                            </div>
                            <div class="btn-group" role="group" aria-label="back">
                                <button class="btn btn-secondary" onclick="history.go(-1);">Back </button><br>
                            </div>

                            <br><br>
                            <?php }  ?>
                    </form>

                    <?php
                    if(isset($_POST['submit'])) {

                        ///Email header details
                        $recipient="srajput@umassd.edu";
                        $subject="Food Alert  - The Food Finder";
                        $headers  = 'MIME-Version: 1.0' . "\r\n";
                        $headers .= 'Content-type: text/html; charset=utf-8' . "\r\n";
                        $headers .= "From: 01shkti@gmail.com\r\nReply-To:".$recipient;

                        //set variables from the form
                        $foodtype = $_POST['category'];
                        $foodsubtype = $_POST['subcategory'];
                        $quantity = $_POST['quantity'];
                        $unit = $_POST['unit'];
                        $deadline = $_POST['datepicker'];
                        $name = $_POST['name'];
                        $org = $_POST['org'];
                        $email = $_POST['email'];
                        $number = $_POST['number'];

                        //send email to admin notifying new record added for approval
                        $mailBody='<html><body><div class="row">
                                    <h3>Food Rescue Alert created. Please login into the website to view more details</h3>
                                    </div>
                                    </body></html>';

                        $mailBody .="<b>Food Type:</b> $foodtype \n<br><b>Food Sub-Type:</b> $foodsubtype \n<br><b>Quantity:</b> $quantity $unit\n
                                    <br><b>Contact Person:</b>$name\n<br><b>Organization:</b>$org\n<br><b>Email:</b>$email\n<br><b>Phone Number:</b>$number\n";

                        $mailBody .='<br> <a href="http://thefoodfinder.org/admin" class="btn btn-block btn-primary btn-primary"><span class="glyphicon glyphicon-check"></span> Login Here </a>';
                        mail($recipient, $subject, $mailBody,  $headers);


                        //Query to insert in pantry_info table
                        $sql2 = "INSERT INTO alerts(alert_id, foodtype, foodsubtype, quantity, unit, deadline, name, org, email, number)
                                VALUES(NULL,'$foodtype','$foodsubtype', '$quantity', '$unit', STR_TO_DATE('$deadline', '%m/%d/%Y'), '$name','$org','$email','$number')";

                        $status = "DONE";
                        //Query to update status in notifications table     
                        $sql3 = "UPDATE notifications SET status = '$status' WHERE notify_id = '$id'";

                        if (($conn->query($sql2) === TRUE) && (($conn->query($sql3) === TRUE))) {
                            header("Location: view-alert.php");
                        } else {
                            echo "Error: " . $sql2 . "<br>" . $conn->error;
                        }
                    }
                    ?>

            </div>
        </div>

        <script src="js/jquery.min.js"></script>
        <script src="js/bootstrap.min.js"></script>
        <script src="js/scripts.js"></script>



    </div>
    <br>
    <br>
    <footer>
        <div class="row">
            <div class="col-md-12 text-center">
                <p>Copyright © 2017 Southeastern MA Food Security Network.</p>
            </div>
        </div>
    </footer> 
   </body>
</html>
<?php   } else {
    echo "<h1>You are not authorized to access the content of this page</h1>";
    echo "<h1><a href='index.php'>Click Here to go back</a></h1>";
}?>

The actual query is mentioned below:

//Query to insert in pantry_info table
                        $sql2 = "INSERT INTO alerts(alert_id, foodtype, foodsubtype, quantity, unit, deadline, name, org, email, number)
                                VALUES(NULL,'$foodtype','$foodsubtype', '$quantity', '$unit', STR_TO_DATE('$deadline', '%m/%d/%Y'), '$name','$org','$email','$number')";

                        $status = "DONE";
                        //Query to update status in notifications table     
                        $sql3 = "UPDATE notifications SET status = '$status' WHERE notify_id = '$id'";

                        if (($conn->query($sql2) === TRUE) && (($conn->query($sql3) === TRUE))) {
                            header("Location: view-alert.php");
                        } else {
                            echo "Error: " . $sql2 . "<br>" . $conn->error;
                        }

Thank you in advance for any help provided

Neha Parab
  • 76
  • 7
  • 1
    [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard Sep 08 '17 at 12:42
  • Possible duplicate of [Mysql query after $(window).load to decrease the load of the page](https://stackoverflow.com/questions/23032307/mysql-query-after-window-load-to-decrease-the-load-of-the-page) – Hamza Zafeer Sep 08 '17 at 12:44
  • What's the actual query being executed? How have you confirmed whether or not data is being updated or even should be updated? Don't just dump code here, we can't debug this on your computer for you. Debug the problem and indicate specifically where it's going wrong. – David Sep 08 '17 at 12:45
  • David I updated the question with actual query part . My sincere apologies for dumping entire code – Neha Parab Sep 08 '17 at 13:09
  • what do you get when `echo $sql3; ` ? – Ivo P Sep 08 '17 at 13:12
  • and how come you can still redirect using header(Location) when dozens of lines of html are sent before you reach that point in your code? Why not first check if the form was posted and handle the request _before_ you send html to the browser that no-one is to see? – Ivo P Sep 08 '17 at 13:15
  • I am not sure how to do it without redirecting Ivo. can you guide me? – Neha Parab Sep 08 '17 at 14:10

0 Answers0