Hoe lang duurt het voo..
checkbox
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
<?php session_start();
function quote_smart($value) {
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
if(version_compare(phpversion(),"4.3.0") == "-1") {
return mysqli_escape_string($value);
} else {
return mysqli_real_escape_string($value);
}
}
if(isset($_POST['submit'])){
// code for check server side validation
if(empty($_SESSION['captcha_code'] ) || strcasecmp($_SESSION['captcha_code'], $_POST['captcha_code']) != 0){
$msg="<span style='color:red'>The Validation code does not match!</span>";// Captcha verification is incorrect.
}else{// Captcha verification is Correct. Final Code Execute here!
$msg="<span style='color:green'>The Validation code has been matched.</span>";
$servername = "a";
$username = "b";
$password = "c";
$dbname = "d";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$collection= array('orange', 'apple', 'grapefruit', 'banana', 'watermelon');
$fruit = array('orange', 'apple', 'grapefruit', 'banana', 'watermelon');
if(isset($_POST['submit']))
{ $fruit = $_POST['fruit'];
$values = array($collection);
foreach($collection as $selection )
{ if(in_array($selection, $fruit))
{ $values[ $selection ] = 1; }
else
{ $values[ $selection ] = 0; }
}
$sql = "INSERT INTO guessing (student_name, student_email, student_city, orange, apple, grapefruit, banana, watermelon)
VALUES(
'".$conn->real_escape_string($_POST["student_name"])."',
'".$conn->real_escape_string($_POST["student_email"])."',
'".$conn->real_escape_string($_POST["student_city"])."',
{$values['orange']}, {$values['apple']}, {$values['grapefruit']}, {$values['banana']}, {$values['watermelon']})";
if ($conn->query($sql) === TRUE) {
echo "<script type= 'text/javascript'>alert('New record created successfully');</script>";
} else {
echo "<script type= 'text/javascript'>alert('Error: " . $sql . "<br>" . $conn->error."');</script>";
}
// end of foreach.
// MySQL statement.
// MySQL statement to execute the INSERT statement above.
mysqli_query($conn, $sql) or die('<br/>Error reading database: '.mysqli_error($conn));
mysqli_close($conn);
} // End of, if statement from the button check
;
}
}
?>
<html>
<head>
<meta charset="utf-8">
<title>Testwebsite</title>
<script type='text/javascript'>
function refreshCaptcha(){
var img = document.images['captchaimg'];
img.src = img.src.substring(0,img.src.lastIndexOf("?"))+"?rand="+Math.random()*1000;
}
</script>
</head>
<body>
<form action="" method="post" name="form1" id="form1" >
<input type="checkbox" name="fruit[Orange]" value="orange"> Orange
<input type="checkbox" name="fruit[Apple]" value="apple"> Apple
<input type="checkbox" name="fruit[Grapefruit]" value="grapefruit"> Grapefruit
<input type="checkbox" name="fruit[Banana]" value="banana"> Banana
<input type="checkbox" name="fruit[Watermelon]" value="watermelon"> Watermelon
<br>
<label>Student Name :</label>
<input type="text" name="student_name" id="name" required="required" placeholder="Please Enter Name"/><br /><br />
<label>Student Email :</label>
<input type="email" name="student_email" id="email" required="required" placeholder="[email protected]"/><br/><br />
<label>Student City :</label>
<input type="text" name="student_city" id="city" required="required" placeholder="Please Enter Your City"/><br/><br />
<meta charset="utf-8">
<script type='text/javascript'>
function refreshCaptcha(){
var img = document.images['captchaimg'];
img.src = img.src.substring(0,img.src.lastIndexOf("?"))+"?rand="+Math.random()*1000;
}
</script>
<?php if(isset($msg)){?>
<?php echo $msg;?></td>
<?php } ?>
Validation code:
<img src="captcha.php?rand=<?php echo rand();?>" id='captchaimg'><br>
<label for='message'>Enter the code above here :</label>
<br>
<input id="captcha_code" name="captcha_code" type="text">
<br>
Can't read the image? click <a href='javascript: refreshCaptcha();'>here</a> to refresh.</td>
<input name="submit" type="submit" value="submit">
</form>
</body>
</html>
function quote_smart($value) {
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
if(version_compare(phpversion(),"4.3.0") == "-1") {
return mysqli_escape_string($value);
} else {
return mysqli_real_escape_string($value);
}
}
if(isset($_POST['submit'])){
// code for check server side validation
if(empty($_SESSION['captcha_code'] ) || strcasecmp($_SESSION['captcha_code'], $_POST['captcha_code']) != 0){
$msg="<span style='color:red'>The Validation code does not match!</span>";// Captcha verification is incorrect.
}else{// Captcha verification is Correct. Final Code Execute here!
$msg="<span style='color:green'>The Validation code has been matched.</span>";
$servername = "a";
$username = "b";
$password = "c";
$dbname = "d";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$collection= array('orange', 'apple', 'grapefruit', 'banana', 'watermelon');
$fruit = array('orange', 'apple', 'grapefruit', 'banana', 'watermelon');
if(isset($_POST['submit']))
{ $fruit = $_POST['fruit'];
$values = array($collection);
foreach($collection as $selection )
{ if(in_array($selection, $fruit))
{ $values[ $selection ] = 1; }
else
{ $values[ $selection ] = 0; }
}
$sql = "INSERT INTO guessing (student_name, student_email, student_city, orange, apple, grapefruit, banana, watermelon)
VALUES(
'".$conn->real_escape_string($_POST["student_name"])."',
'".$conn->real_escape_string($_POST["student_email"])."',
'".$conn->real_escape_string($_POST["student_city"])."',
{$values['orange']}, {$values['apple']}, {$values['grapefruit']}, {$values['banana']}, {$values['watermelon']})";
if ($conn->query($sql) === TRUE) {
echo "<script type= 'text/javascript'>alert('New record created successfully');</script>";
} else {
echo "<script type= 'text/javascript'>alert('Error: " . $sql . "<br>" . $conn->error."');</script>";
}
// end of foreach.
// MySQL statement.
// MySQL statement to execute the INSERT statement above.
mysqli_query($conn, $sql) or die('<br/>Error reading database: '.mysqli_error($conn));
mysqli_close($conn);
} // End of, if statement from the button check
;
}
}
?>
<html>
<head>
<meta charset="utf-8">
<title>Testwebsite</title>
<script type='text/javascript'>
function refreshCaptcha(){
var img = document.images['captchaimg'];
img.src = img.src.substring(0,img.src.lastIndexOf("?"))+"?rand="+Math.random()*1000;
}
</script>
</head>
<body>
<form action="" method="post" name="form1" id="form1" >
<input type="checkbox" name="fruit[Orange]" value="orange"> Orange
<input type="checkbox" name="fruit[Apple]" value="apple"> Apple
<input type="checkbox" name="fruit[Grapefruit]" value="grapefruit"> Grapefruit
<input type="checkbox" name="fruit[Banana]" value="banana"> Banana
<input type="checkbox" name="fruit[Watermelon]" value="watermelon"> Watermelon
<br>
<label>Student Name :</label>
<input type="text" name="student_name" id="name" required="required" placeholder="Please Enter Name"/><br /><br />
<label>Student Email :</label>
<input type="email" name="student_email" id="email" required="required" placeholder="[email protected]"/><br/><br />
<label>Student City :</label>
<input type="text" name="student_city" id="city" required="required" placeholder="Please Enter Your City"/><br/><br />
<meta charset="utf-8">
<script type='text/javascript'>
function refreshCaptcha(){
var img = document.images['captchaimg'];
img.src = img.src.substring(0,img.src.lastIndexOf("?"))+"?rand="+Math.random()*1000;
}
</script>
<?php if(isset($msg)){?>
<?php echo $msg;?></td>
<?php } ?>
Validation code:
<img src="captcha.php?rand=<?php echo rand();?>" id='captchaimg'><br>
<label for='message'>Enter the code above here :</label>
<br>
<input id="captcha_code" name="captcha_code" type="text">
<br>
Can't read the image? click <a href='javascript: refreshCaptcha();'>here</a> to refresh.</td>
<input name="submit" type="submit" value="submit">
</form>
</body>
</html>
Als ik nu deze data op sla in mijn database krijg ik bijvoorbeeld:
banaan : 1
orange : 0
enzv...
Dit is een probleem, omdat ik 200 mogelijk heden dus heb en de database laat er maar 100 toe.
Kan het niet zo gemaakt worden dat je een lijst krijgt met wat diegene heeft gekozen
gekozen : banaan, appel.
Code (php)
1
<input type="checkbox" name="fruit[]" value="orange"> Orange
In $_POST['fruit'] zit dan een array met je gekozen keuzes. Deze kan je met foreach uitlezen.
Verdiep je eens in database-normalisatie.
Toevoeging op 06/12/2015 10:18:40:
Wat is hier fout aan (Ik heb de lange regels met alle soorten fruit weggelaten)
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
<?php session_start();
function quote_smart($value) {
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
if(version_compare(phpversion(),"4.3.0") == "-1") {
return mysqli_escape_string($value);
} else {
return mysqli_real_escape_string($value);
}
}
if(isset($_POST['submit'])){
// code for check server side validation
if(empty($_SESSION['captcha_code'] ) || strcasecmp($_SESSION['captcha_code'], $_POST['captcha_code']) != 0){
$msg="<span style='color:red'>The Validation code does not match!</span>";// Captcha verification is incorrect.
}else{// Captcha verification is Correct. Final Code Execute here!
$msg="<span style='color:green'>The Validation code has been matched.</span>";
$servername = "";
$username = "";
$password = "";
$dbname = "";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$collection= array(alle fruit soorten);
$fruit = array(alle fruit soorten);
if(isset($_POST['submit']))
{ $fruit = $_POST['fruit'];
$values = array($collection);
foreach($collection as $selection )
{ if(in_array($selection, $fruit))
{ $values[ $selection ] = 1; }
else
{ $values[ $selection ] = 0; }
}
$sql = "INSERT INTO guessing (student_name, student_email,)
VALUES(
'".$conn->real_escape_string($_POST["student_name"])."',
'".$conn->real_escape_string($_POST["student_email"])."',
en het fruit)";
if ($sql->query($sql) === TRUE) {
echo "<script type= 'text/javascript'>alert('New record created successfully');</script>";
} else {
echo "<script type= 'text/javascript'>alert('Error: " . $sql . "<br>" . $dbconnect->error."');</script>";
}
// end of foreach.
// MySQL statement.
// MySQL statement to execute the INSERT statement above.
mysqli_query($conn, $sql) or die('<br/>Error reading database: '.mysqli_error($conn));
mysqli_close($conn);
} // End of, if statement from the button check
;
}
}
?>
function quote_smart($value) {
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
if(version_compare(phpversion(),"4.3.0") == "-1") {
return mysqli_escape_string($value);
} else {
return mysqli_real_escape_string($value);
}
}
if(isset($_POST['submit'])){
// code for check server side validation
if(empty($_SESSION['captcha_code'] ) || strcasecmp($_SESSION['captcha_code'], $_POST['captcha_code']) != 0){
$msg="<span style='color:red'>The Validation code does not match!</span>";// Captcha verification is incorrect.
}else{// Captcha verification is Correct. Final Code Execute here!
$msg="<span style='color:green'>The Validation code has been matched.</span>";
$servername = "";
$username = "";
$password = "";
$dbname = "";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$collection= array(alle fruit soorten);
$fruit = array(alle fruit soorten);
if(isset($_POST['submit']))
{ $fruit = $_POST['fruit'];
$values = array($collection);
foreach($collection as $selection )
{ if(in_array($selection, $fruit))
{ $values[ $selection ] = 1; }
else
{ $values[ $selection ] = 0; }
}
$sql = "INSERT INTO guessing (student_name, student_email,)
VALUES(
'".$conn->real_escape_string($_POST["student_name"])."',
'".$conn->real_escape_string($_POST["student_email"])."',
en het fruit)";
if ($sql->query($sql) === TRUE) {
echo "<script type= 'text/javascript'>alert('New record created successfully');</script>";
} else {
echo "<script type= 'text/javascript'>alert('Error: " . $sql . "<br>" . $dbconnect->error."');</script>";
}
// end of foreach.
// MySQL statement.
// MySQL statement to execute the INSERT statement above.
mysqli_query($conn, $sql) or die('<br/>Error reading database: '.mysqli_error($conn));
mysqli_close($conn);
} // End of, if statement from the button check
;
}
}
?>
De enige en beste manier in dit script om SQL-injection tegen te gaan, is door $conn->real_escape_string te gebruiken.
Verder is het raadzaam om als controle of een formulier verstuurd is (regel 12) om te bouwen naar:
Code (php)
1
if($_SERVER['REQUEST_METHOD']=="POST") {
En verder ben ik benieuwd waarom je twee array's hebt met fruitsoorten? ($collection en $fruit).
Op lijn 31 controleer je wederom of je formulier verstuurd is. Die controle had je immers al eerder gedaan.
En tenslotte onderaan gebruik je opeens procedurele code, terwijl je OO gebruikt.
Waarom overschrijven en waarom die $_post waarde in een variabele zetten?
Hoe los ik dit op?
in_array() verwacht dat parameter 2 een array is, er is een NULL (niks) gegeven.
Je voert in_array dus de verkeerde soort gegevens die blijkbaar geen array is.
Gewijzigd op 08/12/2015 17:20:04 door - Ariën -
Als ik in jouw code kijk, moet je deze niet overschrijven door $_POST['fruit']
in_array
Maar als ik je code zie, vraag ik me af of het niet zinvoller is om dit weg te gooien, en opnieuw te beginnen. Waarom twee dezelfde array's etc...?
Gewijzigd op 09/12/2015 16:07:58 door - Ariën -