add.php
Here is an outline of the code in add.php.
Most of the code in add.php is commented using //single line comments or /*multiple line comments*/ ( uncomment lines of code for debugging when desired) and it uses the following specific validation in the code in approximately this order:
1. Contains required fields.
2. Keeps an array of errror messages.
3. Checks the email format using PERL.
4. Checks the phone number format using PERL.
5. Checks the database name.
6. Checks to see if there are any warnings.
7. If there is at least one warning then the form is recalled (This is called recursion in programming.) and you must fix the errors. The error message is displayed beside each incorrect field on the form. This is repeated until the form is filled out correctly. The form is not cleared .
8. If there are no warnings then the form is processed and: The field variables are cleaned (checked for SQL injection). The username, password and database name you entered are compared to the values in the dbinfo.inc.php file. The connection is made to the database. The MySQL query is executed. The user is notified that the operation was a success.
In add.php, add the following code in the body:
<?php
include("dbinfo.inc.php");
$server="localhost";
mysql_connect($server,$username,$password);
// prevents SQL injection
function cleanQuery($string)
{
if(get_magic_quotes_gpc()) // prevents duplicate backslashes
{
$string = stripslashes($string);
}
if (phpversion() >= '4.3.0')
{
$string = mysql_real_escape_string($string);
}
else
{
$string = mysql_escape_string($string);
}
return $string;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="content-type" content="text/html; charset=iso-8859-1" />
<title>add.php</title>
</head>
<body>
<p> </p>
<p>Back to <b><a href="index.html">Main Page</a></b> </p>
<h2> </h2>
<h2>Add people to your database</h2>
<h1> </h1>
<hr size="1" />
<p>This page has an HTML part that you can see plus a PHP part that you can not see. It contains simple but standard PHP/MySQL/JavaScript security called AJAX. This prevents SQL injection plus unauthorized access. You would normally NOT furnish the login information, but this is for educational purposes. There are also restrictions placed on the guest users by the database administrator.</p>
<?php
// Field name labels
$required=array("first"=>"First Name",
"last"=>Last Name",
"phone"=>"Phone Number",
"email"=>"Email",
"street"=>"Street",
"city"=>"City",
"zip"=>"Zip",
"contact"=>"Contact",
"username1"=>"User Name",
"password1"=>"Password",
"database1"=>"Database Name");
foreach($required as $field=>$label)
{
if(!$_POST[$field])
{
$warnings[$field]="<=Required";
}
}
if($_POST["email"]&&!ereg("^[^@]+@([a-z0-9\-]+\.)+[a-z]{2,4}$", $_POST['email']))
$warnings["email"]="<=invalid Email";
if($_POST["phone"]&&!ereg("^\([[:digit:]]{3}\)[[:digit:]]{3}-[[:digit:]]{4}$", $_POST['phone']))
$warnings["phone"]="<=invalid Phone Number Must be in the form (555)555-5555";
$link = mysql_connect($server,$username,$password);
mysql_select_db("your database name", $link);
if(count($warnings)>0 )
{
?>
<center>
<H2>Add a Contact</H2>
</center>
<center>
<FORM ACTION="add.php" METHOD=POST>
<TABLE width="600" height="200 px" BORDER=5 cellpadding="5" cellspacing="5" bordercolor="#333333" bgcolor="#999999">
<TR>
<TD bgcolor="#CCCCCC"><span class="style3">First Name</span></TD>
<TD bgcolor="#CCCCCC"><input NAME="first" TYPE="text" VALUE="<?php echo $_POST["first"];?>" SIZE="50"></TD>
<TD bgcolor="#999999"><span class="style3"><font color="#FF0000"><?php echo $warnings["first"];?></span></TD>
</TR>
<TR bgcolor="#669999">
<TD bgcolor="#CCCCCC"><span class="style3">Last Name</span></TD>
<TD bgcolor="#CCCCCC"><input NAME="last" TYPE="text" VALUE="<?php echo $_POST["last"];?>" SIZE="50"></TD>
<TD bgcolor="#999999"><span class="style3"><font color="#FF0000"><?php echo $warnings["last"];?></span></TD>
</TR>
<TR bgcolor="#669999">
<TD bgcolor="#CCCCCC"><span class="style3">Phone Number</span></TD>
<TD bgcolor="#CCCCCC"><input NAME="phone" TYPE="text" VALUE="<?php echo $_POST["phone"];?>" SIZE="50"></TD>
<TD bgcolor="#999999"><span class="style3"><font color="#FF0000"><?php echo $warnings["phone"];?></span></TD>
</TR>
<TR bgcolor="#669999">
<TD bgcolor="#CCCCCC"><span class="style3">Email Address</span></TD>
<TD bgcolor="#CCCCCC"><input NAME="email" TYPE="text" VALUE="<?php echo $_POST["email"];?>" SIZE="50"></TD>
<TD bgcolor="#999999"><span class="style3"><font color="#FF0000"><?php echo $warnings["email"];?></span></TD>
</TR>
<TR bgcolor="#669999">
<TD bgcolor="#CCCCCC"><span class="style3">Street and Number</span></TD>
<TD bgcolor="#CCCCCC"><span class="style3">
<input TYPE="text" NAME="street" SIZE="50" VALUE="<?php echo $_POST["street"];?>">
</span></TD>
<TD bgcolor="#999999"><span class="style3"><font color="#FF0000"><?php echo $warnings["street"];?></span></TD>
</TR>
<TR bgcolor="#669999">
<TD bgcolor="#CCCCCC"><span class="style3">City and State</span></TD>
<TD bgcolor="#CCCCCC"><input NAME="city" TYPE="text" VALUE="<?php echo $_POST["city"];?>" SIZE="50"></TD>
<TD bgcolor="#999999"><span class="style3"><font color="#FF0000"><?php echo $warnings["city"];?></span></TD>
</TR>
<TR bgcolor="#669999">
<TD bgcolor="#CCCCCC"><span class="style3">Zip Code</span></TD>
<TD bgcolor="#CCCCCC"><input NAME="zip" TYPE="text" VALUE="<?php echo $_POST["zip"];?>" SIZE="50"></TD>
<TD bgcolor="#999999"><span class="style3"><font color="#FF0000"><?php echo $warnings["zip"];?></span></TD>
</TR>
<TR bgcolor="#CCCCCC">
<TD><span class="style3">Contact Type</span></TD>
<TD><span class="style3">
<SELECT NAME="contact">
<OPTION>Phone
<OPTION>Email
<OPTION>Mail
<OPTION>In Person
<OPTION>Do Not Contact
</SELECT>
</span></TD>
</TR>
<tr bgcolor="#999999">
<td bgcolor="#666666"><p class="style4"> </p>
<p class="style4 style5">You must enter the correct Username, Password and Database to complete the submission.</p>
<p class="style4"> </p></td>
<td bgcolor="#666666"><p class="style4">These values are all case sensitive.</p></td>
</tr>
<TR bgcolor="#66CC99">
<TD bgcolor="#666666"><span class="style3">User Name</span></TD>
<TD bgcolor="#666666"><input name="username1" type="password" value="<?php echo $_POST["username1"];?>" size="20" /></TD>
<TD bgcolor="#999999"><span class="style3"><font color="#FF0000"><?php echo $warnings["username1"];?></span></TD>
</TR>
<TR>
<TD bgcolor="#666666"><span class="style3">Password</span></TD>
<TD bgcolor="#666666"><input NAME="password1" TYPE="password" VALUE="<?php echo $_POST["password1"];?>" SIZE="20"></TD>
<TD><span class="style3"><font color="#FF0000"><?php echo $warnings["password1"];?></span></TD>
</TR>
<TR>
<TD bgcolor="#666666"><span class="style3">Database Name</span></TD>
<TD bgcolor="#666666"><input NAME="database1" TYPE="password" VALUE="<?php echo $_POST["database1"];?>" SIZE="20"></TD>
<TD><span class="style3"><font color="#FF0000"><?php echo $warnings["database1"];?></span></TD>
</TR>
</TABLE>
<INPUT TYPE="reset" VALUE="Clear Form">
<input type="Submit">
</FORM>
</center>
</div>
<?php
}
else
{
echo "Thank you.<br>";
/* Check all form inputs using cleanQuery function */
$first = cleanQuery($_POST['first'], "Enter your first name");
$last = cleanQuery($_POST['last'], "Enter your last name");
$phone = cleanQuery($_POST['phone'],"Enter your phone number");
$email = cleanQuery($_POST['email'],"Enter your email");
$street = cleanQuery($_POST['street'],"Enter your street and #");
$city = cleanQuery($_POST['city'],"Enter your city & state");
$zip = cleanQuery($_POST['zip'],"Enter your zip code");
$contact = cleanQuery($_POST['contact'], "Write your contact method");
//use for debugging
//echo("Here is the information you submitted<br>");
//echo("first=".$first."<br/> last=".$last."<br/> phone=".$phone."<br/> email=".$email."<br/> street=".$street."<br/> city=".$city."<br/> zip=".$zip."<br/>contact=".$contact );
//Save data to the database table
$username1=$_POST['username1'];
$password1=$_POST['password1'];
$database1=$_POST['database1'];
//use for debugging
//echo $username;echo $password;echo $database;
//echo $username1;echo $password1;echo $database1;
if($username==$username1 && $password==$password1 && $database==$database1)
{
@mysql_select_db($database) or die( "Unable to select database");
$query = "INSERT INTO contacts VALUES ('','$first','$last','$phone','$email','$street','$city','$zip','$contact')";
mysql_query($query);
mysql_close();
}
else
{
echo "<br>Sorry. Your username or password didn't match. Please try again!<br>";
}
?>
<p>You have successfully added a contact to your database.</p>
<p align="center">Back to the <a href="home.php" title="main menu"> Main Page</a></p>
<p> </p>
<?php
}
?>
</body>
</html>
This is almost impossible to read without the proper indentation. If you are using RapidPHP ro Dreamweaver then you can format the code for readability. Otherwise you may wish to get the code from add.pdf instead. |
