HTML to PHP Form Input and Submit

[Psionicsin]

The various HTML character codes in here have totally disoriented me, so I need some help. I'm trying to fit the following code into a PHP echo statement.

<form action ="/tally.php?sen_id=$row[sen_id]" method="post">
<input type="submit" name="submit" value="Vote" >
</form>

I've turned it into this, but think I've done somehing wrong as it's passing out errors all over.

<?php echo
"&lt;form action =&quot;/tally.php?sen_id=$row[sen_id]&quot; method=&quot;post&quot;&gt;
&lt;input type=&quot;submit&quot; name=&quot;submit&quot; value=&quot;Vote&quot; /&gt;
&lt;/form&gt;"
; ?>

Is there something that's missing, or that I forgot, or that I did wrong?

[Fou-Lu]

Why are you echoing out special characters? These will not be parsed by an HTML browser. They will instead be treated as a textual display within the html, so you could use it in something like a <textarea>, but not as an actual form.

Without seeing your errors, we cannot troubleshoot that problem. I presume one will be undefined variable $row, and another as undefined offset since what you have here doesn't construct a $row array.

[Psionicsin]

Why are you echoing out special characters? These will not be parsed by an HTML browser. They will instead be treated as a textual display within the html, so you could use it in something like a <textarea>, but not as an actual form.

Without seeing your errors, we cannot troubleshoot that problem. I presume one will be undefined variable $row, and another as undefined offset since what you have here doesn't construct a $row array.

I sorry, I wasn't aware of that. I'm trying to deconstruct, and reapply sections of coding that has been created for our original voting section in order to apply it to a mobile form of the page. The original coding is:

<?php

include("./templates/mysql_connect.php");

 //FOR LETTER: A

$query = "SELECT * FROM seniors WHERE last_name LIKE 'A%' ORDER BY last_name ASC";
$result = @mysql_query ($query);

echo '<table><tr>
  <td>
  <p><span class="style19"><u>-A-</u></span><br />';

while ($row = mysql_fetch_array ($result)){
        
        echo "<a href=\"$row[pic_url]\" rel=\"lightbox[seniors]\" 
title=\" &lt;form action =&quot;/sencha-tallyvote.php?sen_id=$row[sen_id]&quot; method=&quot;post&quot;&gt;

$row[first_name] $row[last_name] - $row[school] <br />

 &nbsp; &nbsp; &lt;input name=&quot;submit&quot; align=&quot;right&quot; type=&quot;submit&quot; value=&quot;Vote&quot; &gt;  
 
 &lt;/form&gt; \">$row[last_name], $row[first_name]</a><br/>";
        
    }
echo '</p>';
?>

I was trying to replicate what the other programmer did by viewing the code above, which is where I got the special characters from. So far I have everything but the vote button, and it's throwing me for a loop.

Code I have currently (constantly changing it to see what works) is:

<?php
require_once('templates/mysql_connect.php');
?>

<?php 
$query = "SELECT * FROM seniors WHERE sen_id=$_GET[sen_id]";
$result = mysql_query ($query);
$row = mysql_fetch_array ($result);
?>

<div class="contents">
    <h1><?php echo $row['first_name'], " ", $row['last_name']; ?></h1>
    <h4><?php echo $row['school']; ?></h4>
</div>

<?php echo
'<a href="sencha.php" class="bigmenu"><img src="images/backarrow.png" alt="Back to Senior Challenge Home" class="arrowleft indexicon" /><u>Back</u></a><br />'; ?>

<?php echo "<img src=\"http://www.rutholsonphoto.com" .$row['pic_url']. "\" width=\"100%\" />"; ?> <br />
<br />

<?php echo "<form action="tally.php?sen_id=$row[sen_id]" method="get">
<input type="submit" name="submit" value="Vote" />
</form>";
?>

[Fou-Lu]

The only thing wrong with this is the missing escape sequences.

<?php echo "<form action="tally.php?sen_id=$row[sen_id]" method="get">
<input type="submit" name="submit" value="Vote" />
</form>";
?>

Should be

<?php
echo '<form action="tally.php?sen_id=' . $row['sen_id'] . '" method="get">
<input type="submit" name="submit" value="Vote" />
</form>';
?>

// or
<?php echo "<form action=\"tally.php?sen_id={$row['sen_id']}\" method=\"get\">
<input type=\"submit\" name=\"submit\" value=\"Vote\" />
</form>";
?>

Edit:
Also, make sure you google up PHP sql injection prevention. You're code is wide open to attack.

[Psionicsin]

Edit:
Also, make sure you google up PHP sql injection prevention. You're code is wide open to attack.

Thanks for that. I'll get on that ASAP. However I tried to implement the example code and, although it created the button and link tot he page just fine, it seems to not be passing the data along to the next page as the fields remain blank and get the error:

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /hermes/web01/b829/moo.rophoto1/rop-mobile/tally.php on line 87

[Fou-Lu]

That error indicates that your query has failed. It could be caused for many different reasons.
Assuming that this code is not tally.php, you will need to post tally.php in order to diagnose the SQL error.

[Psionicsin]

That error indicates that your query has failed. It could be caused for many different reasons.
Assuming that this code is not tally.php, you will need to post tally.php in order to diagnose the SQL error.

<?php
require_once('templates/mysql_connect.php');

/////////////
function escape_data ($data)
{
    global $dbc;
    
    if(ini_get('magic_quotes_gpc'))
    $data = stripslashes($data);
    
    return mysql_real_escape_string($data, $dbc);    
}
////////////

$ip=$_SERVER['REMOTE_ADDR'];

$queryIP = "SELECT INET_NTOA('ip') FROM ips WHERE ip=INET_ATON('$ip')";
$resultIP = mysql_query ($queryIP);
$existIP = mysql_num_rows($resultIP);


if (isset($_COOKIE['vote']) || $existIP > 0)
{
    $message = "<b>You have already voted in this year's Senior Challenge!</b> <p>To view the rankings of the current Senior Challenge contestants, <a href=\"/top10.php\">CLICK HERE</a></p>";
}
else
{
    //Get Senior info
    $query = "SELECT * FROM seniors WHERE sen_id=$_GET[sen_id]";
    $result = mysql_query ($query);
    $row = mysql_fetch_array ($result);

    //Tally vote
    $votes = $row['votes'] + 1;
    $queryTally = "UPDATE seniors SET votes='$votes' WHERE sen_id=$_GET[sen_id] LIMIT 1";
    $resultTally = mysql_query ($queryTally);
    
    if(isset($resultTally))
    {
        $message = "<b>Your vote has been registered!</b>  <p>Thank you for participating in the 2012 Senior Challenge.  To view the rankings of the current Senior Challenge contestants, <a href=\"/top10.php\">click here</a></p>";
        
        //Set cookie + ip
    setcookie ("vote", "yes", time()+15552000);
    $queryInsertIP = "INSERT INTO ips (ip, person) VALUES(INET_ATON('$ip'), '$row[last_name]')";
    $resultInsertIP = mysql_query ($queryInsertIP);

    }
    else
    {
        $message = "<b>Error:  Vote was not counted!</b>  <p>You have encountered an error, and your vote was NOT tallied.  Please, <a href=\"/contact.html\">contact us</a> to tally your vote.</p>";
    }
}

?>

<?php 
$query = "SELECT * FROM seniors WHERE sen_id=$_GET[sen_id]";
$result = mysql_query ($query);
$row = mysql_fetch_array ($result);
?>

<h3><?php echo $row['first_name'], " ", $row['last_name'], " has <font style=\"color:#FF0000\">
$row[votes]</font> votes";?></h3>

<?php echo "<p>", $message. "</p>"?>

[Fou-Lu]

Change this line: $result = mysql_query ($query); to this: $result = mysql_query($query) or die(sprintf('MySQL error: %s, GET: <pre>%s</pre>', mysql_error(), print_r($_GET, true))); and post that result.

[Psionicsin]

Change this line: $result = mysql_query ($query); to this: $result = mysql_query($query) or die(sprintf('MySQL error: %s, GET: <pre>%s</pre>', mysql_error(), print_r($_GET, true))); and post that result.

Edit: Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /hermes/web01/b829/moo.rophoto1/rop-mobile/tally.php on line 86
has votes

You have already voted in this year's Senior Challenge!

To view the rankings of the current Senior Challenge contestants, CLICK HERE

[Fou-Lu]

The following messages indicate that its the first query that is failing. Change $resultIP = mysql_query ($queryIP); to $resultIP = mysql_query($queryIP) or die(sprintf('MySQL error: %s, GET: <pre>%s</pre>', mysql_error(), print_r($_GET, true)));

Edit:
Something's not right here. There is no fetch_* call before that line of output. The line numbers don't line up either, you don't have 87 lines of code in this.
Are you sure this is the correct script?

[Psionicsin]

The following messages indicate that its the first query that is failing. Change $resultIP = mysql_query ($queryIP); to $resultIP = mysql_query($queryIP) or die(sprintf('MySQL error: %s, GET: <pre>%s</pre>', mysql_error(), print_r($_GET, true)));

Edit:
Something's not right here. There is no fetch_* call before that line of output. The line numbers don't line up either, you don't have 87 lines of code in this.
Are you sure this is the correct script?

The full code, including the stuff for HTML is:

<!DOCTYPE html>
<html lang="en">

<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="viewport" content="width=device-width; initial-scale=1.0;" />
<meta name="author" content="Brandon Moner" />
<script type="text/javascript" type="text/javascript" src="js/jquery-1.6.1.min.js"></script>
<link rel="stylesheet" type="text/css" href="css/style.css" />

<title>Ruth Olson Photography</title>
</head>

<body>

<header>
    <div class="top">
        <div class="contents">
            <a href="index.php"><img src="/images/logo.png" width="100%" alt="Ruth Olson Photography" /></a>
            <!-- <h1><a href="index.php">Ruth Olson Photography</a></h1> -->
        </div>
    </div>
</header>

<div class="container">

<?php
require_once('templates/mysql_connect.php');

/////////////
function escape_data ($data)
{
    global $dbc;
    
    if(ini_get('magic_quotes_gpc'))
    $data = stripslashes($data);
    
    return mysql_real_escape_string($data, $dbc);    
}
////////////

$ip=$_SERVER['REMOTE_ADDR'];

$queryIP = "SELECT INET_NTOA('ip') FROM ips WHERE ip=INET_ATON('$ip')";
$resultIP = mysql_query ($queryIP);
$existIP = mysql_num_rows($resultIP);


if (isset($_COOKIE['vote']) || $existIP > 0)
{
    $message = "<b>You have already voted in this year's Senior Challenge!</b> <p>To view the rankings of the current Senior Challenge contestants, <a href=\"/top10.php\">CLICK HERE</a></p>";
}
else
{
    //Get Senior info
    $query = "SELECT * FROM seniors WHERE sen_id=$_GET[sen_id]";
    $result = mysql_query ($query);
    $row = mysql_fetch_array ($result);

    //Tally vote
    $votes = $row['votes'] + 1;
    $queryTally = "UPDATE seniors SET votes='$votes' WHERE sen_id=$_GET[sen_id] LIMIT 1";
    $resultTally = mysql_query ($queryTally);
    
    if(isset($resultTally))
    {
        $message = "<b>Your vote has been registered!</b>  <p>Thank you for participating in the 2012 Senior Challenge.  To view the rankings of the current Senior Challenge contestants, <a href=\"/top10.php\">click here</a></p>";
        
        //Set cookie + ip
    setcookie ("vote", "yes", time()+15552000);
    $queryInsertIP = "INSERT INTO ips (ip, person) VALUES(INET_ATON('$ip'), '$row[last_name]')";
    $resultInsertIP = mysql_query ($queryInsertIP);

    }
    else
    {
        $message = "<b>Error:  Vote was not counted!</b>  <p>You have encountered an error, and your vote was NOT tallied.  Please, <a href=\"/contact.html\">contact us</a> to tally your vote.</p>";
    }
}

?>

<?php 
$query = "SELECT * FROM seniors WHERE sen_id=$_GET[sen_id]";
$result = mysql_query ($query);
$row = mysql_fetch_array ($result);
?>

<h3><?php echo $row['first_name'], " ", $row['last_name'], " has <font style=\"color:#FF0000\">
$row[votes]</font> votes";?></h3>

<?php echo "<p>", $message. "</p>"?>

<br />

</div>

<footer class="contents">
    <p>&copy; Copyright 2003 - <?php echo date("Y") ?> Ruth Olson Photography</p>
</footer>

</body>

</html>

[Fou-Lu]

Ok, that's a little closer. Are you pulling that text off of the browser window or from the source? That error should come AFTER the text below it, so I'm thinking that this may be an HTML output and not source output.
What is the results of the modification to the ip check?

[Psionicsin]

Ok, that's a little closer. Are you pulling that text off of the browser window or from the source? That error should come AFTER the text below it, so I'm thinking that this may be an HTML output and not source output.
What is the results of the modification to the ip check?

I'm getting this directly from the actual backup file. Not viewing from any type of browser.

And the output from the IP change was the same as the other, unless you want me to post the source of the output.

[Fou-Lu]

I'm getting this directly from the actual backup file. Not viewing from any type of browser.

And the output from the IP change was the same as the other, unless you want me to post the source of the output.

So are you executing this via PHP and storing it into an html file? That kinda defeats the purpose of using PHP to dynamically create the data though.
What is the results of the ip query check?

[Psionicsin]

So are you executing this via PHP and storing it into an html file? That kinda defeats the purpose of using PHP to dynamically create the data though.
What is the results of the ip query check?

No. Everything is inside of a PHP file that has HTML inside of it. Since this is for mobile devices, I didn't want to be making too many server calls due to some people having capped data plans.

And the output that was displayed on the page for the IP query was

Edit: Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /hermes/web01/b829/moo.rophoto1/rop-mobile/tally.php on line 86
has votes

You have already voted in this year's Senior Challenge!

To view the rankings of the current Senior Challenge contestants, CLICK HERE