Re: using QuickForm with $_GET variable for default id - when it processes there is no variable in URL so it throws error
| From: | Justin Patrin | Date: | Tue, 04 Jan 2005 19:27:23 +0000 |
| Subject: | Re: using QuickForm with $_GET variable for default id - when it processes there is no variable in URL so it throws error | ||
| References: | 1 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-16598@lists.php.net to get a copy of this message | ||
On Tue, 4 Jan 2005 07:26:36 -0800 (PST), l Burnerheimerton
<lburnerheimerton@yahoo.com> wrote:
> I need a URL var so I use the $_GET to get the ID I need. I use that ID to do a db query to
> get the user Name for the form.
>
> When the form processes, it apparently looks again for the &$_GET vcar and, since it'
> not there, throws an error and never gets to the actual processing of the form.
>
> Here's the firs par tof the form:
>
> <?php
> session_start();
> require_once("DB.php");
> require_once 'HTML/QuickForm.php';
> require('db_connectivity');
> //get ID
> $ID = ((get_magic_quotes_gpc()) ? $_GET['ident'] :
> addslashes($_GET['ident']));
*NO!*
$ID = ((get_magic_quotes_gpc()) ? stripslashes($_GET['ident']) :
$_GET['ident']);
Slashes should be added if and only if you need them. Outputting
slashes to HTML just makes things messy. Add the slashes when you send
the query to the DB. Use htmlentities when you ouput HTML. See my FAQ:
http://www.reversefold.com/tikiwiki/tiki-index.php?page=PHPFAQs#id239988
> if (!is_numeric($ID)) {
> $locID = $_SESSION['L_ID'];
> header("Location: ../?c=$L_ID");
> // exit;
> }
Good check here. If the ID isn't numeric (needs slashes) this will
obviously come into play. Still, it's useless to addslashes to it when
you only want numeric values anyway. In this case you might as well
take out all of the magic quotes and slashes stuff as you require it
to be numeric anyway.
> ?>
> <html>
> <head>
> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
> <title>Testing PEAR HTML_QuickForm</title>
> </head>
> <body>
> <?php
> $form = new HTML_QuickForm('new', 'post');
> //get class title
> $sql = 'SELECT lName FROM user WHERE U_ID = ' . $ID . '';
> $res = $db->query($sql);
> if (DB::isError($res)) {
> die($res->getMessage());
> }
> $row =& $res->fetchRow();
> $facName = $row[0];
> $form->addElement('html',"<tr><td>New
> User:</td><td><b>$facName</b></td></tr>");
....why? html elements should only be used in the direct of
circumstances. This should work fine as a static element.
$form->addElement('static', 'newUser', 'New User',
'<b>'.$facName.'</b>');
>
> .... element definition ...
If you want the ID to persist, set up a hidden element in the form
(this is probably your problem).
$form->addElement('hidden', 'ident', $ID);
Then use $_REQUEST above instead of $_GET (or use $_GET *or* $_POST).
>
> if ($form->validate()) {
> $form->process('process_data', false); //true means the form has a file to be
> uploaded
> header("Location: ../home.php");
> exit;
> }
> function process_data ($values) {
> var_dump($values); //for testing purposes
> }
>
--
Justin Patrin