Database validation required for PHP

Report · Feb 09, 2010

I've built the page to update the database with the users record and it works fine if the fields are filled in, and I've also got it to check for a unique username and load a suitable message. I'm using Server Behaviors as per a CS4 Help tutorial.

What doesn't work is if any of the form is empty. The database specifies that certain fields must be completed. I get a blank webpage with just the message 'Column 'first_name' cannot be null' at the top (or similar for the missing filed name). Can you help please? Thanks.

I understand from David Powers (thank you) that Dreamweaver server behaviors provide only basic functionality and that I need to build my own validation logic into the pages to handle the situation.

E.G. "wrap the code for the Insert Record server behavior in a conditional statement that uses empty() to check if any of the fields are blank. If any values are missing, skip the Insert Record server behavior, and redisplay the form with a suitable error message".

Can someone assist please??

Many thanks

The code I have is....

$editFormAction = $_SERVER['PHP_SELF'];

if (isset($_SERVER['QUERY_STRING'])) {

$editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);

}

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {

$insertSQL = sprintf("INSERT INTO IT_db_users (first_name, last_name, email, pass, Phone) VALUES (%s, %s, %s, %s, %s)",

GetSQLValueString($_POST['first_name'], "text"),

GetSQLValueString($_POST['last_name'], "text"),

GetSQLValueString($_POST['email'], "text"),

GetSQLValueString($_POST['password'], "text"),

GetSQLValueString($_POST['telephone'], "text"));

mysql_select_db($database_Name, $Name);

$Result1 = mysql_query($insertSQL, $Name) or die(mysql_error());

$insertGoTo = "register_02.php";

if (isset($_SERVER['QUERY_STRING'])) {

$insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";

$insertGoTo .= $_SERVER['QUERY_STRING'];

}

header(sprintf("Location: %s", $insertGoTo));

}

Report · Feb 09, 2010

There are many ways of doing it. One way you could do it is this (assuming all fields are required):

$missing = false;
if (empty($_POST['first_name']) || empty($_POST['last_name']) ||
  empty($_POST['email'] || empty($_POST['password'] || empty($_POST['telephone'])) {
    $missing = true;
}
if (!$missing) {
  // all the existing insert record code goes here
}

In the page itself:

<?php if ($missing) { ?>
<p class="warning">Not all fields were filled in.</p>
<?php } ?>