0

I have a PHP page where I can view and search records from a table in MySQL database. I would like to add a link to the Placement ID column that will link the Placement ID to a PHP form where I can update that record.

So far I have been able to link Placement ID to the update form but when I try to use a Session to keep the same Placement ID I get the following error

"Notice: Array to string conversion in /Applications/XAMPP/xamppfiles/htdocs/test/updateform.php on line 17"

and the record is not found. I know the update form works because when I enter a static Placement ID I can link to it and edit that specific Placement ID, but I need to be able to choose which Placement ID I am editing. Can anyone help explain how to select a specific Placement ID to use as the reference variable in the update form? All help is appreciated! (code below)

The page where I can search and view records looks like this: (edit.php)

<?php
session_start();
if(isset($_POST['search']))
{
    $valueToSearch = $_POST['valueToSearch'];
    // search in all table columns
    // using concat mysql function
    $query = "SELECT * FROM `new_obrfs` WHERE CONCAT(`tracker_placement_id`, `first_name`, `last_name`) LIKE '%".$valueToSearch."%'";
    $search_result = filterTable($query);
    
}
 else {
    $query = "SELECT * FROM `new_obrfs`";
    $search_result = filterTable($query);
}

// function to connect and execute the query
function filterTable($query)
{
    $connect = mysqli_connect("localhost", "david", "!", "oba");
    $filter_Result = mysqli_query($connect, $query);
    return $filter_Result;
}

?>

<!DOCTYPE html>
<html lang="en-US">
  <head>
    <link href="styles/styles.css" rel="stylesheet">
    <meta charset="utf-8">
    <title>View or edit an OBRF</title>
    <style>
      table, th, td{
        border:1px solid black;
        align: center;
      }
    </style>
  </head>
  <body>
    <header>
        <h1>Welcome to the Onboarding Application</h1>
    </header>
    <nav>
        <ul>
          <li><a href="index.php">Home</a></li>
          <li><a href="form.html">Submit a new OBRF</a></li>
          <li><a href="edit.php">View or edit an OBRF</a></li>
        </ul>
    </nav>
    <main>
      <form action="edit.php" method="post">
          <input type="text" name="valueToSearch" placeholder="Value To Search"><br><br>
          <input type="submit" name="search" value="Filter"><br><br>
      <p><strong>Search a candidates name or Placement ID to view more info. Click the Tracker ID to edit</strong></p>
      <table>
        <tr>
          <th>Tracker Placement ID:</th>
          <th>Start Date:</th>
          <th>First Name:</th>
          <th>Last Name:</th>
          <th>Email Address:</th>
          <th>Phone Number:</th>
        </tr>

        <?php while($row = mysqli_fetch_array($search_result)):?>
        <tr>
          <td><a href='updateform.php?tracker_placement_id=".$row['tracker_placement_id']."'><?php echo $row['tracker_placement_id'];?></a></td>
          <td><?php echo $row['sdate'];?></td>
          <td><?php echo $row['first_name'];?></td>
          <td><?php echo $row['last_name'];?></td>
          <td><?php echo $row['email_address'];?></td>
          <td><?php echo $row['cell_phone'];?></td>
        </tr>
        <?php endwhile;?>
      </table>
      </form>
    </main>
  </body>
</html>

The page where I can update the record looks like this: (updateform.php)

<?php
session_start();
$_SESSION['tracker_placement_id'] = $_GET['tracker_placement_id'];
$tracker_placement_id = ['tracker_placement_id'];

$hostname = "localhost";
$username = "david";
$password = "!";
$db = "oba";

$conn = new mysqli($hostname, $username, $password, $db);

if($conn->connect_error){
    die("Connection failed ".$conn->connect_error);
}

$sql = "select * from new_obrfs where tracker_placement_id='$tracker_placement_id'";

$result = $conn->query($sql);

if ($result->num_rows > 0){

$row = $result->fetch_assoc();

$branch=$row['branch'];
$contract_type=$row['contract_type'];
$sdate=$row['sdate'];
$onboarding_type=$row['onboarding_type'];
$consultant_status=$row['consultant_status'];
$reporting_type=$row['reporting_type'];
$pay_cycle=$row['pay_cycle'];
$first_name=$row['first_name'];
$last_name=$row['last_name'];
$middle_name=$row['middle_name'];
$nick_name=$row['nick_name'];
$customer=$row['customer'];
$wf_consumer_lending=$row['wf_consumer_lending'];
$mailing_address=$row['mailing_address'];
$email_address=$row['email_address'];
$cell_phone=$row['cell_phone'];
$ssn=$row['ssn'];
$dob=$row['dob'];
$militray_veteran=$row['militray_veteran'];
$militray_spouse=$row['militray_spouse'];
$candidate_source=$row['candidate_source'];
$tracker_candidate_id=$row['tracker_candidate_id'];
$visa=$row['visa'];
$visa_expiration_date=$row['visa_expiration_date'];
$end_date=$row['end_date'];
$candidate_job_title=$row['candidate_job_title'];
$hiring_manager_name=$row['hiring_manager_name'];
$candidate_work_location=$row['candidate_work_location'];
$placement_recruiter=$row['placement_recruiter'];
$placement_sourcer=$row['placement_sourcer'];
$placement_am=$row['placement_am'];
$hourly_wage=$row['hourly_wage'];
$health_benefits=$row['health_benefits'];
$misc_exp_type=$row['misc_exp_type'];
$misc_exp_amount=$row['misc_exp_amount'];
$network_partner_name=$row['network_partner_name'];
$bill_rate=$row['bill_rate'];
$placement_cto=$row['placement_cto'];

echo

"<html>
<body>

<form action='scripts/updateformscript.php' method='post'>
Placement ID: $tracker_placement_id<br>
<input type='hidden' name='tracker_placement_id' value='$tracker_placement_id'>
Branch: <select name='branch' id='branch-select'>
    <option value='$branch'>$branch</option>
    <option value='motown'>Motown</option>
    <option value='south'>South</option>
    <option value='west'>West</option>
    <option value='midwest'>MidWest</option>
    <option value='midatlantic'>MidAtlantic</option>
    <option value='carolinas'>Carolinas</option>
</select><br>
Contract Type: <select name='contract_type' id='contract-type-select'>
    <option value='$contract_type'>$contract_type</option>
    <option value='w2/vacation/exempt'>W2 with vacation (exempt)</option>
    <option value='w2/vacation/non-exempt'>W2 with vacation (non-exempt)</option>
    <option value='w2/no-vacation/exempt'>W2 without vacation (exempt)</option>
    <option value='w2/no-vacation/non-exempt'>W2 without vacation (non-exempt)</option>
    <option value='1099'>1099</option>
</select><br>
Start Date: <input type='date' id='start-date-select' name='sdate' value='$sdate' required><br>
Onboarding Type: <select name='onboarding_type' id='onboarding-type-select'>
<option value='$onboarding_type'>$onboarding_type</option>
<option value='new-hire'>New Hire</option>
<option value='rehire'>Rehire</option>
<option value='other'>Other</option>
</select><br>
Consultant Status: <select name='consultant_status' id='consutlant-status-select'>
<option value='$consultant_status'>$consultant_status</option>
<option value='full-time'>Full Time</option>
<option value='part-time'>Part Time</option>
</select><br>
Reporting Type: <select name='reporting_type' id='reporting-type-select'>
<option value='$reporting_type'>$reporting_type</option>
<option value='cto'>CTO</option>
<option value='fixed'>Fixed Fee</option>
</select><br>
Pay Cycle: <select name='pay_cycle' id='pay-cycle-select'>
<option value='$pay_cycle'>$pay_cycle</option>
<option value='bi-monthly'>Bi-Monthly</option>
<option value='weekly'>Weekly</option>
</select><br>
First Name: <input type='text' id='first-name' name='first_name' value='$first_name'><br>
Last Name: <input type='text' id='last-name' name='last_name' value='$last_name'><br>
Middle Name: <input type='text' id='middle-name' name='middle_name' value='$middle_name'><br>
Nick Name: <input type='text' id='nick-name' name='nick_name' value='$nick_name'><br>
Customer:<select name='customer' id='customer-select'>
    <option value='$customer'>$customer</option>
    <option value='wellsfargomrs'>Wells Fargo MRS</option>
    <option value='wellsfargonon-it'>Wells Fargo Non-IT</option>
    <option value='cambia'>Cambia</option>
    <option value='chevron'>Chevron</option>
    <option value='farmers'>Farmers</option>
</select><br>
Wells Fargo Consumer Lending Hire: <select name='wf_consumer_lending' id='consumer-lending-select'>
    <option value='$wf_consumer_lending'>$wf_consumer_lending</option>
    <option value='No'>No</option>
    <option value='Yes'>Yes</option>
</select><br>
Mailing Address: <input type='text' id='mailing-address' name='mailing_address' value='$mailing_address'><br>
Email: <input type='email' id='email-address' name='email_address' value='$email_address'><br>
Cell Phone: <input type='text' id='cell-phone' name='cell_phone' title='Please provide a valid 10 digit phone number' pattern='[1-9]{1}[0-9]{9}' required value='$cell_phone'><br>
SSN: <input type='text' id='ssn-input' name='ssn' title='Please provide a valid 9 digit ssn' pattern='[0-9]{9}' required value='$ssn'> <br>
DOB: <input type='date' id='dob-select' name='dob' required value='$dob'><br>
Military Veteren Status: <select name='militray_veteran' id='military-veteran'>
    <option value='$militray_veteran'>$militray_veteran</option>
    <option value='no'>No</option>
    <option value='yes'>Yes</option>
    <option value='unknown'>Unknown</option>
</select><br>
Military Spouse Status: <select name='militray_spouse' id='military-veteran'>
    <option value='$militray_spouse'>$militray_spouse</option>
    <option value='no'>No</option>
    <option value='yes'>Yes</option>
    <option value='unknown'>Unknown</option>
</select><br>
Candidate Source: <select name='candidate_source' id='candidate-source-select'>
                    <option value='$candidate_source'>$candidate_source</option>
                    <option value='dice'>Dice</option>
                    <option value='careerbuilder'>Career Builder</option>
                    <option value='linkedin'>LinkedIn</option>
                    <option value='indeed'>InDeed</option>
                    <option value='referral'>Referral</option>
                    <option value='networkpartner'>Network Partner</option>
                    <option value='other'>Other</option>
</select><br>
Tracker Candidate ID: <input type='number' id='candidateid' name='tracker_candidate_id' value='$tracker_candidate_id'><br>
Visa or Work Authorization: <select name='visa' id='work-auth-select'>
    <option value='$visa'>$visa</option>
    <option value='usc'>US Citizen</option>
    <option value='greencard'>Green Card/Perm Resident</option>
    <option value='h4'>H4 EAD</option>
    <option value='h1b'>H1b Visa</option>
    <option value='l2'>L2 EAD</option>
    <option value='asylum'>Asylum EAD</option>
    <option value='opt/cpt'>OPT or CPT EAD</option>
</select><br>
Visas Expiration Date: <input type='date' id='visa-exp-select' name='visa_expiration_date' required value='$visa_expiration_date'><br>
Contract End Date: <input type='date' id='end-date-select' name='end_date' required value='$end_date'><br>
Job Title: <input type='text' id='job-title' name='candidate_job_title' value='$candidate_job_title'><br>
Site Supervisor (Hiring Manager): <input type='text' id='hiring-manager' name='hiring_manager_name' value='$hiring_manager_name'><br>
Work Location (or Remote): <input type='text' id='work-location' name='candidate_work_location' value='$candidate_work_location'><br>
Recruiter: <input type='text' id='recruiter' name='placement_recruiter' value='$placement_recruiter'><br>
Sourcer: <input type='text' id='sourcer' name='placement_sourcer' value='$placement_sourcer'><br>
Account Manager: <input type='text' id='am' name='placement_am' value='$placement_am'><br>
Hourly Wage: <input type='number' id='hourly-pay-rate' name='hourly_wage' step='0.01' required value='$hourly_wage'><br>
Health Benefits: <select name='health_benefits' id='health'>
    <option value='$health_benefits'>$health_benefits</option>
    <option value='Yes'>Yes</option>
    <option value='No'>No</option>
</select><br>
Misc Expense Type: <select name='misc_exp_type' id='misc-exp-type'>
    <option value='$misc_exp_type'>$misc_exp_type</option>
    <option value='npa'>NPA Fee</option>
    <option value='immigration'>Immigration Expense</option>
    <option value='referral'>Referral</option>
    <option value='other'>Other</option>
</select><br>
Misc Expense Amount: <input type='number' id='misc-exp-amount' name='misc_exp_amount' step='0.01' placeholder='Enter 0 if there is none' required value='$misc_exp_amount'><br>
Network Partner: <input type='text' id='np-name' name='network_partner_name' placehodler='Please enter N/A if no NP' value='$network_partner_name'><br>
Bill Rate: <input type='number' id='billing' name='bill_rate' step='0.01' required value='$bill_rate'><br>
CTO: <input type='number' id='cto' name='placement_cto' step='0.01' required value='$placement_cto'><br>

<input type ='submit'>
</form>

</body>
</html>";

} else {
    echo "Not Found";
}
$conn->close();

?>
Paul T.
  • 4,703
  • 11
  • 25
  • 29
Dave S
  • 21
  • 2
  • That is a notice, not an error, or am I mistaken? https://www.php.net/manual/en/function.error-reporting.php *"Reporting E_NOTICE can be good too (to report uninitialized variables or catch variable name misspellings ...)"* – HoldOffHunger Nov 07 '21 at 21:28
  • Yes sorry, notice not an error. However I think this is where my problem arrises as it looks like the variable in line 17 is not able to complete the query. This line returns no notice and does not cause an issue if I statically assign a value of a placement id to $tracker_placement_id in the first few lines rather then trying to get it from a session. – Dave S Nov 07 '21 at 21:33
  • 2
    At this line: `$tracker_placement_id = ['tracker_placement_id'];` makes an array with one string value, so when used at the query causes the notice. Did you mean to prefix that with `$_GET` perhaps? – Paul T. Nov 07 '21 at 21:34
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) – Dharman Nov 07 '21 at 21:39
  • @PaulT. You are right, it should have been prefixed with `$_GET` but it is still not providing a value that my query can search. Is how I have the session set up on either side wrong? – Dave S Nov 07 '21 at 21:39
  • After `session_start` in the update form, add a `var_dump($_GET);` to see what is being received. Also, the quoting for the `updateform` hyperlink looks odd. Browser inspect the page after it loads and check the link in the html to ensure proper quoting and that the link output appears to be correct. – Paul T. Nov 07 '21 at 22:35
  • @PaulT. This is what is being received: `array(1) { ["tracker_placement_id"]=> string(7) "".$row[" }`Is this caused by the formatting in the `updateform` hyperlink? If so, what should be the correct format? – Dave S Nov 07 '21 at 22:59
  • Try with: `` – Paul T. Nov 07 '21 at 23:23
  • There we go, it was the formatting on the hyperlink. What you suggested worked, thanks so much Paul you rock! – Dave S Nov 08 '21 at 00:02

0 Answers0