2

I'm working on a CMS using PHP OOP. And in this CMS, there's a feature which admins of a website can add another admin. What I did for this, is that I created a form and added the action. This file is called admin_new.php and goes like this:

    <?php 
if (isset($_POST['submit'])){
    $username = $_POST['uname'];
    $email = $_POST['email'];
    $password = $_POST['pass'];
    $groups = $_POST['groups'];
    if($groups == "Main Admin"){
        $level = 1;
    }else if($groups == "Administrator"){
        $level = 2;
    }else if($groups == "Content Creator"){
        $level = 3;
    }else if($groups == "Social Media Manager"){
        $level = 4;
    }else{
        $level = 5;
    }
    if (filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
        $notice['email_validation'] = "The email that you have entered is not a valid one";
    }else{
        $registration = new Register();
        $notice = $registration->CheckUname($username,$email,$password,$groups‌​,$level);
    }   
}
?>
<div class="content-wrapper">
    <section class="content-header">
        <h1>
            Add New Admin
            <small>You can add new admin here</small>
        </h1>
        <ol class="breadcrumb">
            <li class="active">addnewadmin.php</li>
        </ol>
    </section>
    <section class="content">
        <div class="row">
            <div class="col-md-6">
                <div class="box box-primary">
                    <div class="box-header with-border">
                        <h3 class="box-title">Required Information</h3>
                    </div>
                    <?php 
                    if(isset($notice['email_validation'])) {
                        echo "
                            <div class='alert alert-danger'>
                                <strong>Hey!</strong> ".$notice['email_validation'].".
                            </div>
                        ";
                    }
                    if(isset($notice['username_exists'])) {
                        echo "
                            <div class='alert alert-danger'>
                                <strong>Hey!</strong> ".$notice['username_exists'].".
                            </div>
                        ";
                    }
                    if(isset($notice['email_exists'])) {
                        echo "
                            <div class='alert alert-danger'>
                                <strong>Hey!</strong> ".$notice['email_exists'].".
                            </div>
                        ";
                    }
                    if(isset($notice['success_message'])) {
                        echo "
                            <div class='alert alert-success'>
                                <strong>Hey!</strong> ".$notice['success_message'].".
                            </div>
                        ";
                    }
                    ?>
                    <form role="form" method="POST" action="">
                        <div class="box-body">
                            <div class="form-group">
                                <label>User name</label>
                                <input type="text" class="form-control" placeholder="Enter username" name="uname" required>
                            </div>
                            <div class="form-group">
                                <label for="exampleInputEmail1">Email address</label>
                                <input type="email" class="form-control" id="exampleInputEmail1" placeholder="Enter email" name="email" required>
                            </div>
                            <div class="form-group">
                                <label for="exampleInputPassword1">Temporary password</label>
                                <input type="password" class="form-control" id="exampleInputPassword1" placeholder="Enter password" name="pass" required>
                            </div>
                            <div class="form-group">
                                <label>Group admin</label>
                                <select class="form-control" name="groups">
                                    <option value="Main Admin">Main Admin</option>
                                    <option value="Administrator">Administrator</option>
                                    <option value="Content Creator">Content Creator</option>
                                    <option value="Social Media Manager">Social Media Manager</option>
                                    <option value="Analyst">Analyst</option>
                                </select>
                            </div>
                        </div>
                        <div class="box-footer">
                            Visit <a href="https://zite.pouyavagefi.com/documentation/types.php">admin types</a> documentation to know the differences between each admin.
                        </div>
                        <div class="box-footer">
                            <button name="submit" type="submit" class="btn btn-primary">Submit</button>
                        </div>
                    </form>
                </div>
            </div>
        </div>
    </section>
</div>

As you can see I have called a class named Register and this class also goes here:

    <?php 
class Register
{   
    protected $notice = array();
    private $db;
    public function __construct()
    {
        $this->db = new Connection();
        $this->db = $this->db->dbConnect();
    }
    public function CheckUname($username,$email,$password,$groups,$level)
    {
        if(!empty($username)&&!empty($email)&&!empty($password)&&!empty($groups)&&!empty($level))
        {
            $chk1 = $this->db->prepare("SELECT user_name FROM admins WHERE user_name = ?");
            $chk1->bindParam(1,$username);
            $chk1->execute();
            if($chk1->rowCount() == 1)
            {
                $notice['username_exists'] = "Try different username";
                return $this->notice;
            }else{
                $chk2 = $this->db->prepare("SELECT email_address FROM admins WHERE email_address = ?");
                $chk2->bindParam(1,$email);
                $chk2->execute();
                if($chk2->rowCount() == 1)
                {
                    $notice['email_exists'] = "The email address that you have entered is already exists in database";
                    return $this->notice;
                }else{
                    $this->NewAdmin($username,$email,$password,$groups,$level);
                    $notice['success_message'] = "New admin was successfully added";
                    return $this->notice;
                }
            }
        }
    }
    public function NewAdmin($username,$email,$password,$groups,$level)
    {
        if(!empty($username)&&!empty($email)&&!empty($password)&&!empty($groups)&&!empty($level))
        {
            $reg = $this->db->prepare("INSERT INTO admins (user_name, email_address, password_hash, group_admin, date_joined, admin_level) VALUES ( ?, ?, ?, ?, NOW(), ?)");
            $reg->bindParam(1,$username);
            $reg->bindParam(2,$email);
            $reg->bindParam(3,$password);
            $reg->bindParam(4,$groups);
            $reg->bindParam(5,$level);
            $reg->execute();
        }
    }
    public function getNotice()
    {
        return $this->notice;
    }
}
?>

So it look basically fine and perfect but the ONLY problem with this is that, whenever I try to submit in the form, I get this error:

Undefined variable: groups‌​ in admin_new.php on line 22

And line 22 of admin_new.php is this:

$notice = $registration->CheckUname($username,$email,$password,$groups‌​,$level);

So you can see in the code that I have defined the $groups variable already and it gets the groups value in the form. Therefore I REALLY don't know why am I getting this error ?!

So if you know what should I do or what is my fault, please let me know.. I really really appreciate that. Thanks

  • Have you tried to output each variable to check they contain something and go from there? – Jaquarh Sep 23 '17 at 19:52
  • Another thing though, seperate from the error is you never return `$this->notice` as anything but null because you declare `$notice` rather than `$this->notice['param'] = 'arg'` – Jaquarh Sep 23 '17 at 19:54
  • Guys can you write your comments as answer !! I can't understand what your talking about in this comment section –  Sep 23 '17 at 19:55

2 Answers2

2

You are getting this error since $groups in call

$notice = $registration->CheckUname($username,$email,$password,$groups‌​‌​,$level); 

$groups is written in different encoding and has non-ASCII characters. Probably one or more of the letters is in different language typed. Just type it in regular latin or copy over from above one of the variable mention. That should solve the problem.

Edit: In addition to future problems, if you stumble upon similar issue, just convert code to ASCII encoding and back to UTF-8, and all NON-ASCII characters will be replaced with some generic replacement like underscore or questionmark

Nikola Kirincic
  • 3,651
  • 1
  • 24
  • 28
0

In below function you have used $groups1 instead of $groups >> Update with $groups.

public function NewAdmin($username,$email,$password,$groups,$level)
    {
        if(!empty($username)&&!empty($email)&&!empty($password)&&!empty($groups)&&!empty($level))
        {
            $reg = $this->db->prepare("INSERT INTO admins (user_name, email_address, password_hash, group_admin, date_joined, admin_level) VALUES ( ?, ?, ?, ?, NOW(), ?)");
            $reg->bindParam(1,$username);
            $reg->bindParam(2,$email);
            $reg->bindParam(3,$password);
            $reg->bindParam(4,$groups1);
            $reg->bindParam(5,$level);
            $reg->execute();
        }
    }
chris85
  • 23,846
  • 7
  • 34
  • 51