0

As of a week ago this worked and I'm not sure what changed. We have a database of movies with a set of radio buttons to rate the movies. Each set of radio buttons shares the name of the movie being rated so each set is a distinct set. When hitting submit, an entry to the Ratings table is added for each movie, but no ratings are passed through.

The radio button code:

<div id='stars'>
                <input class='star star-6' id='{$NewID}-6' type='radio' name='{$row['MovieID']}' value='5'/>
                <label class='star star-6' for='{$NewID}-6'></label>
                <input class='star star-5' id='{$NewID}-5' type='radio' name='{$row['MovieID']}' value='4'/>
                <label class='star star-5' for='{$NewID}-5'></label>
                <input class='star star-4' id='{$NewID}-4' type='radio' name='{$row['MovieID']}' value='3'/>
                <label class='star star-4' for='{$NewID}-4'></label>
                <input class='star star-3' id='{$NewID}-3' type='radio' name='{$row['MovieID']}' value='2'/>
                <label class='star star-3' for='{$NewID}-3'></label>
                <input class='star star-2' id='{$NewID}-2' type='radio' name='{$row['MovieID']}' value='1'/>
                <label class='star star-2' for='{$NewID}-2'></label>
       <input class='star star-1 not' id='{$NewID}-1' type='radio' name='{$row['MovieID']}' value='notseen'/>
                <label class='star star-1 not' for='{$NewID}-1'></label>
            </div>

The SQL update code:

$pushrating = "INSERT INTO Ratings (Username, MovieID, Rating) VALUES ('{$user}', '{$row['MovieID']}', '{$_POST[$row['MovieID']]}')";

mysqli_query($db, $pushrating);
edit
  • 25
  • 4
  • 1
    Your code is vulnerable against MySQL injections. Read more here: https://stackoverflow.com/questions/60174. – Dan May 23 '18 at 17:55
  • Take a look into the $_POST array or the HTML code. Do the variables get parsed into their value or is it still `{$row['MovieID']}`? – Dan May 23 '18 at 17:58
  • @Spingolini It parses correctly. Each set of buttons shares a name, and each set is distinct from another – edit May 23 '18 at 18:07

0 Answers0