PHP form design best practice - php

I have been using PHP for a while now and I have always wondered how to represent a single form to handle updates and inserts into a database. At the present, I am using 2 seperate forms to do this and they both have basically the same information and textboxes, etc. I know there is a better way of handling this but I'm not sure what that is.
I have tried to use a single form in the past but the html mixed with the php looks terrible and is really hard to maintain. I am after "clean" and neat.
Can someone please put me on the right track.
One of the things that I have to use are POST values if the user submits the form and the validation didn't pass, the refresh should not wipe out the already entered values.

You could use a single form, with a hidden field for id. If this field is set - then you should update the $_POST['id'] record with the rest of the form. If the field is not set (that is, it has value=""), you should insert the form data to a new record.
You'll set the id field according to the action, for example /data/edit/1 will set the id field to , and/data/new` will not set value to it.
For example, your view could be
<form action="/data/edit/1">
<input type="hidden" value="<?php echo $data->id; ?>" />
<input type="text" value="<?php echo $data->name; ?>" />
</form>
In case of a new record, call your view with the following data
$data->id = '';
$data->name = '';
In case of a known record, simply init the $data object with the data
$data->id = $record_id;
$data->name = $record_name;

This is how I would probably do it without using any other frameworks/libraries etc. It is basically what Elazar Leibovich said.
<?php
//id is zero or a record id depending on whether updating or inserting
//an existing record could be edited using edit.php?id=10
//if the id GET parameter is omitted a new record will be created
$id = isset($_REQUEST['id']) ? (int) $_REQUEST['id'] : 0;
$error = '';
if ($id) {
//this array would be in the same format as the one below
$record = fetchRecordFromDb($id);
} else {
$record = array( 'field1' => 'default value', 'field2' => 'some other default' );
}
//allow POST data to override what is already in the form
foreach ($record as $key => $value) {
if (isset($_POST[$key])) {
$record[$key] = $_POST[$key];
}
}
if (isset($_POST['submit'])) {
if (!validateForm()) {
$error = 'Some form error';
} else {
if ($id) {
updateRecord($id, $record);
} else {
insertRecord($record);
}
//ok, redirect somewhere else
header('Location: http://somewhere');
exit();
}
}
?>
<form method="post">
<?php echo $error; ?>
<input type="hidden" name="id" value="<?php echo $id; ?>">
<input type="text" name="field1" value="<?php echo htmlspecialchars($record['field1']); ?>"><br />
<input type="text" name="field2" value="<?php echo htmlspecialchars($record['field2']); ?>"><br />
<input type="submit" name="submit">
</form>

Related

Multiple forms and multiple submissions with one submit button

At the moment, I'm using a loop to read the 'questions' and 'answers' fields from my postgresql "PDPC".considerations table and reflecting them on the form. I'd like to update them all with one submit button.
I refered to PHP MySQL Multiple Forms and Multiple Submits on single page and tried using the <input type="hidden">, arrays and while loop but the form either does not execute or it does not correctly update all the forms.
I think the error is around the $_POST (at the top) and the HTML form (at the bottom). (Sorry if the codes are messy, it is my first time with PHP, HTML and Postgres). Thank you!
<?php
// Include config file
require_once "config.php";
// Define variables and initialize with empty values
$question = $answer = "";
$question_err = $answer_err = "";
// Processing form data when form is submitted
if(isset($_POST["consideration_no"]) && !empty($_POST["consideration_no"])){
$counter = 0;
// Get hidden input value
//$consideration_no = $_POST['consideration_no'];
$dg_no = $_POST['dg_no'];
$consideration_no = $_POST['consideration_no'];
$answer = $_POST['answer'];
// Check input errors before inserting in database
if(empty($answer_err)){
while ($counter<5){
// Validate address address
$input_answer = trim($_POST["answer"]);
if(empty($input_answer)){
$answer_err = "Please enter an answer.";
} else{
$answer1[$counter] = $input_answer;
}
// Prepare an update statement
$sql = 'UPDATE "PDPC".consideration SET answer=:answer WHERE consideration_no = :consideration_no';
if($stmt = $pdo->prepare($sql)){
$stmt->bindParam(":answer", $param_answer);
$stmt->bindParam(":consideration_no", $param_consideration_no);
//Set Parameter
$param_answer = $answer1[$counter];
$param_consideration_no = $consideration_no[$counter];
// Attempt to execute the prepared statement
$stmt->execute();
$counter++;
}
}
if($stmt->execute()){
// Records updated successfully. Redirect to landing page
header("location: home1.php?dm_no=".$_GET["dm_no"]);
exit();
} else{
echo "Something went wrong. Please try again later.";
}
// Close statement
unset($stmt);
}
// Close connection
unset($pdo);
} else{
// Check existence of dg_no parameter before processing further
if(isset($_GET["dg_no"]) && !empty(trim($_GET["dg_no"]))){
// Get URL parameter
$dg_no = trim($_GET["dg_no"]);
// Prepare a select statement
$sql = 'SELECT * FROM "PDPC".consideration WHERE (dg_fkey = :dg_no AND code_no = 1)';
if($stmt = $pdo->prepare($sql)){
// Bind variables to the prepared statement as parameters
$stmt->bindParam(":dg_no", $param_no);
// Set parameters
//$param_no = $dg_no;
$param_no = trim($_GET["dg_no"]);
// Attempt to execute the prepared statement
if($stmt->execute()){
if($stmt->rowCount() > 0){
SubSection($subsection1_1); //Collection Purpose Section
while($row = $stmt->fetch()){
// Retrieve individual field value
$consideration_no = $row["consideration_no"];
$question = $row["question"];
$answer = $row["answer"];
echo "<a href='considerationupdate.php?consideration_no=". $row['consideration_no'] ."' title='Update Data Map' data-toggle='tooltip'><span class='glyphicon glyphicon-pencil'></span></a>";
//...time to show the questions and answers with the while loop...
?>
<form action="<?php echo htmlspecialchars(basename($_SERVER['REQUEST_URI'])); ?>" method="post">
<div class="form-group <?php echo (!empty($answer_err)) ? 'has-error' : ''; ?>">
<label><?php echo $question; ?></label>
<input type="text" name="answer" class="form-control" value="<?php echo $answer; ?>">
<span class="help-block"><?php echo $answer_err;?></span>
<input type="hidden" name="answer1[]" id = "$answer1" value="<?php echo $answer; ?>"/>
<input type="hidden" name="consideration_no[]" id = "consideration_no" value="<?php echo $consideration_no; ?>"/>
<input type="hidden" name="dg_no" value="<?php echo $dg_no; ?>"/>
</div>
<input type="submit" class="btn btn-primary" value="Submit">
<?php
}
?>
<input type="submit" class="btn btn-primary" value="Submit">
Cancel
</form>
</div>
<?php
}
}
else{
echo "Oops! Something went wrong. Please try again later.";
}
}
// Close statement
unset($stmt);
// Close connection
unset($pdo);
}
else{
// URL doesn't contain dg_no parameter. Redirect to error page
header("location: error.php");
exit();
}
}
?>
It should read the questions and answers from the DB table, show it on the forms as the label and text fields (working), and the user should be able to update the form after editing the text fields and clicking submit (Not working properly).
Since is your form and you are using SQL to get and the objective is to update the data with one submit?
Why not just use one form?. I belive you can do all you need with just one and multiple input.
Your branch if(isset($_GET["dg_no"]) && !empty(trim($_GET["dg_no"]))){ depends on get parameters, however, your <form method="post"> of <input type="hidden" name="dg_no" value="<?php echo $dg_no; ?>"/> uses post parameters.
Therefore the branch will never be executed unless the page is requested by another GET-request like a link or another form.
If the parameters can occur in both methods, POST and GET as well, you might want to check the $_REQUEST array instead. Be aware that the parameters listed in $_REQUEST can vary depending on the .ini settings request_order and variables_order.
According to your comment 'Because each form is for one table row.' in another answer, this might be an XY problem.
Consider to take the common way not generating multiple forms but array parameters similar as you did in
<input type="hidden" name="answer1[]" id = "$answer1" value="<?php echo $answer; ?>"/>
Here you rely on keys getting generated automatically. As well you can specify an individual key:
<input type="text" name="some_parameter[<?php echo $answer; ?>]">
Further more
There is an HTML line in the loop having a static id on an element:
<input type="hidden" name="consideration_no[]" id="consideration_no" value="<?php echo $consideration_no; ?>"/>
This will not break PHP, however, it is against the HTML specs saying an id has to be unique per document.
I have fixed the issue! It was the logical flow of the script. Specifically, the POST variable at the top should be changed to dg_no, add the dg_no parameters along with it, loop the parameters instead of the entire preparation script and include the execute script in the whie loop too.
Thanks for the help and guidance, they were much appreciated!

PHP Read default values from file

I'm having an issue with the way my script works. What is supposed to happen is: when the form loads, it reads the last-used data from a .json file and populates the fields. It works, but when new data is submitted it populates the form with old data and not the new data.
The first part reads the JSON file and builds the form
<?php $old = json_decode((file_get_contents(dirname(__FILE__)."/json.json")), true); ?>
<!--Building the form-->
<table>
<form action="edit.php" method="POST">
<label for="time">Time:</label>
<input type="text" name="time" id="time" value="<?php echo ($old['time']); ?>"></input>
<br />
<label for="event">Event:</label>
<input type="text" name="event" id="event" value="<?php echo ($old['event']); ?>"></input>
<br />
<label for="event">Notes:</label>
<input type="textarea" name="notes" id="notes" value="<?php echo ($old['notes']); ?>"></input>
<br />
<input type="submit" name="task" value="Go" />
<input type="submit" name="task" value="Clear" />
</form>
This next section decides what to do if the clear button is pressed
<?php if ($_POST['task'] == 'Clear'){
$time = '';
$event = '';
$notes = '';
$remainingtime = '';
$task = 'clear';}
else {
?>
This final section populates the new array and saves it as the JSON file.
<?php if ($old['time'] != $_POST['time']){
$time = preg_replace("/[^0-9]/","",$_POST['time']);
$remainingtime = ((microtime())+($timein*60)*1000);
$task = 'countdown';}
else {
$remainingtime = $old['time'];
}
$event = $_POST['event'];
$notes = $_POST['notes'];
$remainingtime = '';
$task = 'display';
}
$new = array ('time' => $time, 'event' => $event,'notes' => $notes , 'remainingtime' => $remainingtime , 'task' => $task);
file_put_contents((dirname(__FILE__).'/json.json'), json_encode($new));
}
?>
When the clear button is pressed repeatedly, the form is cleared and the JSON file is cleared.
When the Go button is pressed the form and JSON file alternate between the new form submission and what is in the JSON file.
Any help would be appreciated.
NB Time comparison doesn't work in my current code
You say "this final section" does the saving. If you load the data at the top of the page and save it at the bottom, after you've generated the form, it will always be the old data that displays because that's what you loaded. You don't update the file until after you've loaded the old data and displayed it.
To fix this, change your code from this basic structure:
load data
display form using old data
decide what to do if the clear button is pressed
populate the new array
save the new array as the json file
to this:
decide what to do if the clear button is pressed
if there's new data:
populate the new array
save the new array as the JSON file
otherwise, load the old data
display form using the data (whether it's new or old
By the way, your comparison to $post['time'] doesn't make sense. The code you shared doesn't define $post (which is not the same as the superglobal $_POST, but is confusing).
Your problem is that the $_POST data is still present. If you resubmit the form, the old data will be inserted once more. What you will need to do is redirect the page after writing your form data to your json file.
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
switch ($_POST['action']) {
case 'Clear':
// Do clear stuff
break;
case 'Go':
default:
// Do go stuff
break;
}
// Redirect
header("Location: ".$_SERVER['REQUEST_URI']);
exit;
}

Saving form values with php and calling cookie using SESSION

I am making a form in html. When a person clicks on submit, it checks if certain fields are filled correctly, so pretty simple form so far.
However, i want to save the text which is typed into the fields, if a person refreshes the page. So if the page is refreshed, the text is still in the fields.
I am trying to achieve this using php and a cookie.
// Cookie
$saved_info = array();
$saved_infos = isset($_COOKIE['offer_saved_info']) ? explode('][',
$_COOKIE['offer_saved_info']) : array();
foreach($saved_infos as $info)
{
$info_ = trim($info, '[]');
$parts = explode('|', $info_);
$saved_info[$parts[0]] = $parts[1];
}
if(isset($_SESSION['webhipster_ask']['headline']))
$saved_info['headline'] = $_SESSION['webhipster_ask']['headline'];
// End Cookie
and now for the form input field:
<div id="headlineinput"><input type="text" id="headline"
value="<?php echo isset($_SESSION['webhipster_ask']['headline']) ?
$_SESSION['webhipster_ask'] ['headline'] : ''; ?>"
tabindex="1" size="20" name="headline" /></div>
I am new at using SESSION within php, so my quesiton is:
Is there a simpler way of achieving this without using a cookie like above?
Or what have i done wrong in the above mentioned code?
First thing is I'm pretty sure you're echo should have round brackets around it like:
echo (isset($_SESSION['webhipster_ask']['headline']) ? value : value)
That's not really the only question your asking though I think.
If you're submitting the data via a form, why not validate using the form values, and use the form values in your html input value. I would only store them to my session once I had validated the data and moved on.
For example:
<?php
session_start();
$errors=array();
if($_POST['doSubmit']=='yes')
{
//validate all $_POST values
if(!empty($_POST['headline']))
{
$errors[]="Your headline is empty";
}
if(!empty($_POST['something_else']))
{
$errors[]="Your other field is empty";
}
if(empty($errors))
{
//everything is validated
$_SESSION['form_values']=$_POST; //put your entire validated post array into a session, you could do this another way, just for simplicity sake here
header("Location: wherever.php");
}
}
if(!empty($errors))
{
foreach($errors as $val)
{
echo "<div style='color: red;'>".$val."</div>";
}
}
?>
<!-- This form submits to its own page //-->
<form name="whatever" id="whatever" method="post">
<input type="hidden" name="doSubmit" id="doSubmit" value="yes" />
<div id="headlineinput">
<input type="text" id="headline" value="<?php echo $_POST['headline'];?>" tabindex="1" size="20" name="headline" />
<!-- the line above does not need an isset, because if it is not set, it will simply not have anything in it //-->
</div>
<input type="submit" value="submit" />
</form>

Two forms with multiple submit buttons in single PHP file

I am trying to write a dynamic form using PHP. I'd like to have a single webpage that contains two forms:
The upper form allows to search for an element in the mysql database, e.g., for a name
The lower form shows the data that is associated with this name in the database
If I press on the "Search" button of the upper form, then the the lower form is shown and the text fields are filled with data from the database that belong to this name. If I change the user name to some other value and press again "Search", then the data that is associated with the new record is shown and so on.
The lower form also has a button "Update" which allows to transfer changes made to the text boxes (in the lower part) to the database.
Now, I have the following problem: In my script I set initially the value of name (from the upper form) to "". When I then press the "Search" button, then the lower part of the form is shown and the corresponding data is shown in the lower part. When I then press the "Update" button, then the text field associated with name is set to the empty string. This is because in my script I set initially name to the "". I'd like that in this case the data entered in the upper form is not changed, i.e., it stays the same.
I guess, I am missing something here. There is probably an easy solution for this and I am doing something fundamentally wrong. It'd be great if you could help me.
That's what I tried... I deleted lots of details, but I guess that can give you an idea what I am trying to do. Notice that the whole code is in the file update.php.
<?php
function search_bus($mysql, $name)
{
// do some stuff here...
}
function update_bus($mysql, $b_id)
{
// do some stuff here...
}
// some global variables
$b_id = 0;
$username = ""; // username of business
// get b_id that corresponds to username
if (isset($_REQUEST['search']))
{
$b_id =0; // business id
if (isset($_POST['user']))
{
$username = $_POST['user'];
$b_id = search_bus($mysql, $username);
}
}
elseif(isset($_REQUEST['update']))
{
update_bus($mysql, $b_id);
}
?>
<h2>Search:</h2>
<form name="search_bus" method="post" action="<?php echo $_SERVER['PHP_SELF'];?>">
Username: <input type="text" name="user" value="<?= htmlentities($username) ?>"/>
<input type="submit" value="Suchen" name="search"/>
</form>
<?php
if($b_id != 0)
{
?>
<h2>Data:</h2>
<form name="business_design" method="post" action="<?php echo $_SERVER['PHP_SELF'];?>">
<-- some form follows here -->
<?php
}
?>
I think what you're missing is to create a HTML Hidden field to keep the value of Name variable.
<input type="hidden" name="name" value="<?php print $nameVar ?>" />
Add this input to both forms so you can keep the value no matter what button the user clicks.
Hope this helps.
Adding code to verify the
<h2>Search:</h2>
<form name="search_bus" method="post"
action="<?php echo $_SERVER['PHP_SELF'];?>">
Username: <input type="text" name="user" value="<?= htmlentities($username) ?>"/>
<input type="hidden" name="b_id" value="<?php print $b_id?>" />
<input type="submit" value="Suchen" name="search"/>
</form>
<?php if($b_id != 0) { ?>
<h2>Data:</h2>
<form name="business_design" method="post" action="<?php echo $_SERVER['PHP_SELF'];>">
<input type="hidden" name="b_id" value="<?php print $b_id?>" />
<-- some form follows here -->
<?php } ?>
Dont initialize $b_id if it already comes into the http request.
if (!isset($_POST['b_id']))
{
$b_id = 0;
}
else
{
$b_id = $_POST['b_id'];
}
This way you can alway remember the last selected value of b_id.
Hope this can help you.

Open page with Form pre-filled

I have an entry Form. When the page is loaded, it must check:
if ($_SESSION[WorkMode] == 'UPDATE')
Then fill the Form with values from the database, else open a blank Form.
If I fetch the results in a different PHP file and call this .php file on load, how to fill the Form.
Set the variables that hold the values for your form, then include the "template" of the form you're having.
File 1:
<?php
$res = mysql_query("..");
if($res) {
$row = mysql_fetch_assoc($res);
$name = $row['name'];
$birthday = $row['birthday'];
...
include('form.tpl');
}
File 2 (form.tpl)
<form action="">
<input type="text" name="username" value="<?php isset($name)?$name:""; ?>" />
.. and so on
</form>
Alternatetively you can use a full blown template engine like Smarty to do the job for you.
Best wishes,
Fabian
$formvalue = NULL;
if ($_SESSION[WorkMode] == 'UPDATE')
$formvalue = $some_database_value;
echo '<input type="text" name="myname" value="'.$formvalue .'" />';
I found out that the following did it for me, adding the variable after a column.
<label>Firstname : </label><input type="text" name="Firstname" value= "<?php echo (isset($_POST['firstname'])) ? htmlspecialchars($_POST['firstname']) : $firstname;?>"

Categories