Use PHP Variables between pages: Session, URL, or Get

Report · Jun 12, 2009

Hi,

For our association, I have developed a registration page. The registration pages insert a record into a mysql database, using php. After the user submits the form (using $post), I would like to be redirected to the confirmation page where a query of the mysql database is executed to retrieve the record the member just added.

To pass the variable, I have developed the following pages using a session variable.

Registration page : http://www.aosweb.org/member_dues.php

Confirmation page: http://www.aosweb.org/member_view.php

Although I have applied some recent changes to the code, it did work at one time. The forum was helpful getting the information I needed. At this point, the redirect and passing of the session variable is not working. It appears the session variable available on the member_view page is from the previous record inserted. Thus, the query executed on member_view does not return a result.

I have checked some of forum posts, such as:

- php url parameters

- how to pass form parameters to the confirm page ....

- php registration page help!

My outstanding questions are as follows:

1. Have I placed the command to set the $_session('sv_mem_num') at the correct location.

2. Should I consider another method such as passing a URL parameter or using the Get method.

Thanks.

George

Report · Jun 12, 2009

Have I placed the command to set the $_session('sv_mem_num') at the correct location.

Impossible to say. PHP is a server-side language, so giving links to the pages you have created tells us nothing. All that can be seen is the HTML output, not the PHP code.

However, part of your problem could be the incorrect use of code. It might just be the way you typed things in here, but $post is simply the name of a variable you have created yourself. I presume you are referring to $_POST. The underscore and capital letters are vital. Similarly, you refer to $_session('sv_mem_num'). This is meaningless. It should be $_SESSION['sv_mem_num']. Note the uppercase spelling of SESSION, and the use of square brackets instead of parentheses.

Report · Jun 12, 2009

David,

Here are selected section of the code. I have the SESSION AND $_POSTING coding correct. From a php / html coding perspective, is the code in red in the corret position? Should it be below the code in blue? Or, doesn't it matter?

Thanks.

<?php
SESSION_START();
if (isset($_POST['Member_Num'])) {
$_SESSION['SV_Mem_Num'] = $_POST['Member_Num'];}
?>

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {
$insertSQL = sprintf("INSERT INTO Member (Member_Num, Active, Created_BY, RCRD_DTTS, LAST_UPDATED_BY, UPDATE_DTTS, FIRST_NAME, LAST_NAME, ADDRESS_1, ADDRESS_2, CITY, `STATE`, ZIP_CODE, SPORT, FB_Level, BB_Level, email, email_Secondary, Member_Since, HOME_PHONE, CELL_PHONE, WORK_PHONE, Fax) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
                       GetSQLValueString($_POST['Member_Num'], "text"),
                       GetSQLValueString($_POST['Active'], "text"),
                       GetSQLValueString($_POST['Created_BY'], "text"),
                       GetSQLValueString($_POST['RCRD_DTTS'], "date"),
                       GetSQLValueString($_POST['LAST_UPDATED_BY'], "text"),
                       GetSQLValueString($_POST['UPDATE_DTTS'], "date"),
                       GetSQLValueString($_POST['FIRST_NAME'], "text"),
                       GetSQLValueString($_POST['LAST_NAME'], "text"),
                       GetSQLValueString($_POST['ADDRESS_1'], "text"),
                       GetSQLValueString($_POST['ADDRESS_2'], "text"),
                       GetSQLValueString($_POST['CITY'], "text"),
                       GetSQLValueString($_POST['STATE'], "text"),
                       GetSQLValueString($_POST['ZIP_CODE'], "text"),
                       GetSQLValueString($_POST['SPORT'], "text"),
                       GetSQLValueString($_POST['FB_Level'], "text"),
                       GetSQLValueString($_POST['BB_Level'], "text"),
                       GetSQLValueString($_POST['email'], "text"),
                       GetSQLValueString($_POST['email_Secondary'], "text"),
                       GetSQLValueString($_POST['Member_Since'], "date"),
                       GetSQLValueString($_POST['HOME_PHONE'], "text"),
                       GetSQLValueString($_POST['CELL_PHONE'], "text"),
                       GetSQLValueString($_POST['WORK_PHONE'], "text"),
                       GetSQLValueString($_POST['Fax'], "text"));

mysql_select_db($database_aosuser, $aosuser);
$Result1 = mysql_query($insertSQL, $aosuser) or die(mysql_error());

$insertGoTo = "Mem_view.php";
if (isset($_SERVER['QUERY_STRING'])) {
$insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
$insertGoTo .= $_SERVER['QUERY_STRING'];
}
header(sprintf("Location: %s", $insertGoTo));
}

mysql_select_db($database_aosuser, $aosuser);
$query_rs_members = "SELECT * FROM Member";
$rs_members = mysql_query($query_rs_members, $aosuser) or die(mysql_error());
$row_rs_members = mysql_fetch_assoc($rs_members);
$totalRows_rs_members = mysql_num_rows($rs_members);
?>

Report · Jun 13, 2009

It's in the correct place.

Report · Jun 13, 2009

David,

I was bad. I had SESSION_START in capitals. I have since changed it to lower case and retested it. The session variable SV_Mem_Num still is not being transferred to my the Insert Go To page.

Since this page is intended to be for registration / inserts only to the mysql database, do I really need the select statement in blue (below); would the select statement overlay the content in the $_POST('Member_Num') field.

Thanks.

<?php require_once('Connections/aosuser.php'); ?>
<?php
session_start();
if (isset($_POST['Member_Num'])) {
$_SESSION['SV_Mem_Num'] = $_POST['Member_Num'];}

$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
$editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {
$insertSQL = sprintf("INSERT INTO Member (Member_Num, Active, Created_BY, RCRD_DTTS, LAST_UPDATED_BY, UPDATE_DTTS, FIRST_NAME, LAST_NAME, ADDRESS_1, ADDRESS_2, CITY, `STATE`, ZIP_CODE, SPORT, FB_Level, BB_Level, email, email_Secondary, Member_Since, HOME_PHONE, CELL_PHONE, WORK_PHONE, Fax) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
                       GetSQLValueString($_POST['Member_Num'], "text"),
                       GetSQLValueString($_POST['Active'], "text"),
                       GetSQLValueString($_POST['Created_BY'], "text"),
                       GetSQLValueString($_POST['RCRD_DTTS'], "date"),
                       GetSQLValueString($_POST['LAST_UPDATED_BY'], "text"),
                       GetSQLValueString($_POST['UPDATE_DTTS'], "date"),
                       GetSQLValueString($_POST['FIRST_NAME'], "text"),
                       GetSQLValueString($_POST['LAST_NAME'], "text"),
                       GetSQLValueString($_POST['ADDRESS_1'], "text"),
                       GetSQLValueString($_POST['ADDRESS_2'], "text"),
                       GetSQLValueString($_POST['CITY'], "text"),
                       GetSQLValueString($_POST['STATE'], "text"),
                       GetSQLValueString($_POST['ZIP_CODE'], "text"),
                       GetSQLValueString($_POST['SPORT'], "text"),
                       GetSQLValueString($_POST['FB_Level'], "text"),
                       GetSQLValueString($_POST['BB_Level'], "text"),
                       GetSQLValueString($_POST['email'], "text"),
                       GetSQLValueString($_POST['email_Secondary'], "text"),
                       GetSQLValueString($_POST['Member_Since'], "date"),
                       GetSQLValueString($_POST['HOME_PHONE'], "text"),
                       GetSQLValueString($_POST['CELL_PHONE'], "text"),
                       GetSQLValueString($_POST['WORK_PHONE'], "text"),
                       GetSQLValueString($_POST['Fax'], "text"));

mysql_select_db($database_aosuser, $aosuser);
$Result1 = mysql_query($insertSQL, $aosuser) or die(mysql_error());

$insertGoTo = "member_view.php";
if (isset($_SERVER['QUERY_STRING'])) {
$insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
$insertGoTo .= $_SERVER['QUERY_STRING'];
}
header(sprintf("Location: %s", $insertGoTo));
}

mysql_select_db($database_aosuser, $aosuser);
$query_rs_members = "SELECT * FROM Member";
$rs_members = mysql_query($query_rs_members, $aosuser) or die(mysql_error());
$row_rs_members = mysql_fetch_assoc($rs_members);
$totalRows_rs_members = mysql_num_rows($rs_members);

Report · Jun 13, 2009

No, you don't need the select query. It simply pulls out all members registered in the DB. And it wouldn't overwrite the $_POST variable. The question is: where does Member_Num come from? Normally, you would use an auto_increment column to generate the number automatically. Unless a number is being entered into the form field, it will be empty.

If you're trying to get the number from the database using mysql_insert_id(), you need to run that after the member's details have been inserted. mysql_insert_id() gives you the ID of the previous query.

Report · Jun 13, 2009

I don't quite understand. I see you transferring the POST variable "Mem_Number" to a SESSION variable with the same name at the top of the script, but I don't see you using the SESSION variable afterwards. In your code, it looks as if you are trying to retain any passed GET variables (set in the "action" attribute of the insert form, maybe?), but the Mem_Number variable is being passed by way of POST, not GET. Also, what is that query in red? You are fetching every member in the database with that query. Are you trying to pull up the newly entered membership information for display on the second page? If so, you'll need to change the query. And pass it a variable, such as Mem_Number.

Look, I'm sure I can help you once I understand what you are trying to accomplish. Right away I can assure you that it isn't necessary to initialize a SESSION variable to do what you are doing. I can also tell you there should be a little form field validation on the server-side, too, in case the user doesn't have javascript turned on in their browser. Maybe you could just put the code aside for a moment and just describe in words what you want to do in a more abstract way, and then we will figure out the code part...

Report · Jun 14, 2009

Applebiter,

The form I have is for registration. On the first page / form1, the user enters membership information. On this page, they enter the Member_Num. After the entry in the form is complete, they user submits the form and a record is inserted into a mysql db. I want to pass the Member_Num to the second page via the session variable SV_Mem_Num to execute a query against the mysql database as a confirmation the record was added.

1. Using the code below, I am not able to set the SV_Mem_Num session variable. Any ideas???

THANKS

Other questions

1. From some of the code I have reviewed, some keywords are encompassed by single quotes and others double quotes. Is my use of double quotes correct?

Code from first page

<?php $_SESSION["SV_Mem_Num"] = $_POST["Member_Num"];
if (isset($_POST["Member_Num"])) {
    $_SESSION["SV_Mem_Num"] = $_POST["Member_Num"];}
   $_SESSION["test"] = "test99"; (I added this just for testing purposes to validate the session variable was being passed between pages- which it is.

    ?>

            <form method="post" name="form1" action="<?php echo $editFormAction; ?>">
              <table width="95%" id="Form">
                <tr valign="baseline">
                  <td align="right" nowrap> </td>
                  <td><span class="style1">(R) = Required (O)= Optional Fields</span></td>
                </tr>
                <tr valign="baseline">
                  <td align="right" nowrap>IHSA ID:</td>
                  <td><span id="sprytextfield1">
                  <input type="text" name="Member_Num" value="" size="5" maxlength="5">

Report · Jun 14, 2009

As Mr. Powers said, in these situations we typically let the database

tell us what the user's unique ID is rather than allowing a user to

enter any old value. If you allow users to enter their own ID, then it

should not be the primary key column in your member table. What happens

if a user accidentally enters an ID that is already being used by

another member? If you succeed in fetching a user record matching the

given ID, which record will it be? The one just entered or the one

already in the database having that ID?

There needs to be a primary key column that is set to auto-increment -

that is, to look for the next available unused numeric row index, and to

set that as the new row's id. 'Primary key' means that the database

server arranges itself to more efficiently search the given table by

that column's values.

if (isset($_POST['submit'])) {
     $query = sprintf("INSERT INTO members ".
          "(mem_num, first_name, last_name) ".
          "VALUES ".
          "(%s, %s, %s)",
          GetSQLValueString($_POST['mem_num'], "text"),
          GetSQLValueString($_POST['first_name'], "text"),
          GetSQLValueString($_POST['last_name'], "text"));
     if (!$result = mysql_query($query, $connection)) {
          header("Location: error_page.php");
          exit;
     }
     // If the insert is successful, you should be able to fetch from the 
database the auto-increment value it just produced for your new record
     $new_id = mysql_insert_id();
     if (!$new_id||empty($new_id)) {
          header("Location: error_page.php");
          exit;
     }
     header("Location: confirmation_page.php?id=$new_id");
     exit();
}

I'm leaving out validation and error handling for this example. But this

is pretty much how an insert works. As you can see, we are not passing a

SESSION variable from one page to the next. We're passing the id that

the database understands as a sane primary key. There's no need to check

before inserting a new record to be sure there is no clash of IDs.

So the confirmation page will listen for the id it will use to fetch the

record...

$id = (isset($_GET['id'])) ? $_GET['id'] : "-1";
$query = sprintf("SELECT * ".
          "FROM members ".
          "WHERE id = %d",
          GetSQLValueString($id, "int"));
if (!$result = mysql_query($query, $connection)) {
     header("Location: error_page.php");
     exit;
}
if (@mysql_num_rows($result) < 1) {
     header("Location: resource_not_found_page.php");
     exit;
}
$row = mysql_fetch_assoc($result);

Now "$row" contains all of the information your user just entered into

the database.

Report · Jun 14, 2009

Applebiter,

Thanks for your quick response.

I am actually using an internal member_id that is the primary key and auto-incremented. This id just is not on for form as there is no real purpose for the user to view it. The membership number is also unique but user entered. Originally, I was hoping to combine the best of both worlds ($_GET and $_POST) and be able to directly capture a member number entered on for form; save it in a server variable; and use the server variable in another page. It seems that is not possible. What did confuse me a little, is that I created a form and used the insert form wizard using DW functionality.

Based on your response, which I believe is correct. I need to replace the following code generated by DW with the code you provided. The biggest impact is that the $insertGOTO logic goes away with your changes.

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {
$insertSQL = sprintf("INSERT INTO Member (Member_Num, Active, Created_BY, RCRD_DTTS, LAST_UPDATED_BY, UPDATE_DTTS, FIRST_NAME, LAST_NAME, ADDRESS_1, ADDRESS_2, CITY, `STATE`, ZIP_CODE, SPORT, FB_Level, BB_Level, email, email_Secondary, Member_Since, HOME_PHONE, CELL_PHONE, WORK_PHONE, Fax) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
                       GetSQLValueString($_POST['Member_Num'], "text"),
                       GetSQLValueString($_POST['Active'], "text"),
                       GetSQLValueString($_POST['Created_BY'], "text"),
                       GetSQLValueString($_POST['RCRD_DTTS'], "date"),
                       GetSQLValueString($_POST['LAST_UPDATED_BY'], "text"),
                       GetSQLValueString($_POST['UPDATE_DTTS'], "date"),
                       GetSQLValueString($_POST['FIRST_NAME'], "text"),
                       GetSQLValueString($_POST['LAST_NAME'], "text"),
                       GetSQLValueString($_POST['ADDRESS_1'], "text"),
                       GetSQLValueString($_POST['ADDRESS_2'], "text"),
                       GetSQLValueString($_POST['CITY'], "text"),
                       GetSQLValueString($_POST['STATE'], "text"),
                       GetSQLValueString($_POST['ZIP_CODE'], "text"),
                       GetSQLValueString($_POST['SPORT'], "text"),
                       GetSQLValueString($_POST['FB_Level'], "text"),
                       GetSQLValueString($_POST['BB_Level'], "text"),
                       GetSQLValueString($_POST['email'], "text"),
                       GetSQLValueString($_POST['email_Secondary'], "text"),
                       GetSQLValueString($_POST['Member_Since'], "date"),
                       GetSQLValueString($_POST['HOME_PHONE'], "text"),
                       GetSQLValueString($_POST['CELL_PHONE'], "text"),
                       GetSQLValueString($_POST['WORK_PHONE'], "text"),
                       GetSQLValueString($_POST['Fax'], "text"));

mysql_select_db($database_aosuser, $aosuser);
$Result1 = mysql_query($insertSQL, $aosuser) or die(mysql_error());

$insertGoTo = "member_view.php";
if (isset($_SERVER['QUERY_STRING'])) {
$insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
$insertGoTo .= $_SERVER['QUERY_STRING'];
}
header(sprintf("Location: %s", $insertGoTo));
}

And since my page is only used for inserts, I probably do not need the following code

mysql_select_db($database_aosuser, $aosuser);
$query_rs_members = "SELECT * FROM Member";
$rs_members = mysql_query($query_rs_members, $aosuser) or die(mysql_error());
$row_rs_members = mysql_fetch_assoc($rs_members);
$totalRows_rs_members = mysql_num_rows($rs_members);

Report · Jun 14, 2009

Okay, well one little change to the code will send you to the

confirmation page with the information you need to fetch the new record.

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {
   $insertSQL = sprintf("INSERT INTO Member (Member_Num, Active, 
Created_BY, RCRD_DTTS, LAST_UPDATED_BY, UPDATE_DTTS, FIRST_NAME, 
LAST_NAME, ADDRESS_1, ADDRESS_2, CITY, `STATE`, ZIP_CODE, SPORT, 
FB_Level, BB_Level, email, email_Secondary, Member_Since, HOME_PHONE, 
CELL_PHONE, WORK_PHONE, Fax) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, 
%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
     GetSQLValueString($_POST['Member_Num'], "text"),
     GetSQLValueString($_POST['Active'], "text"),
     GetSQLValueString($_POST['Created_BY'], "text"),
     GetSQLValueString($_POST['RCRD_DTTS'], "date"),
     GetSQLValueString($_POST['LAST_UPDATED_BY'], "text"),
     GetSQLValueString($_POST['UPDATE_DTTS'], "date"),
     GetSQLValueString($_POST['FIRST_NAME'], "text"),
     GetSQLValueString($_POST['LAST_NAME'], "text"),
     GetSQLValueString($_POST['ADDRESS_1'], "text"),
     GetSQLValueString($_POST['ADDRESS_2'], "text"),
     GetSQLValueString($_POST['CITY'], "text"),
     GetSQLValueString($_POST['STATE'], "text"),
     GetSQLValueString($_POST['ZIP_CODE'], "text"),
     GetSQLValueString($_POST['SPORT'], "text"),
     GetSQLValueString($_POST['FB_Level'], "text"),
     GetSQLValueString($_POST['BB_Level'], "text"),
     GetSQLValueString($_POST['email'], "text"),
     GetSQLValueString($_POST['email_Secondary'], "text"),
     GetSQLValueString($_POST['Member_Since'], "date"),
     GetSQLValueString($_POST['HOME_PHONE'], "text"),
     GetSQLValueString($_POST['CELL_PHONE'], "text"),
     GetSQLValueString($_POST['WORK_PHONE'], "text"),
     GetSQLValueString($_POST['Fax'], "text"));


   mysql_select_db($database_aosuser, $aosuser);
   $Result1 = mysql_query($insertSQL, $aosuser) or die(mysql_error());


   $insertGoTo = sprintf("member_view.php?mem_id=%d", mysql_insert_id());
   if (isset($_SERVER['QUERY_STRING'])) {
     $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
     $insertGoTo .= $_SERVER['QUERY_STRING'];
   }
   header(sprintf("Location: %s", $insertGoTo));
}

...just make sure that the SELECT statement on the confirmation page is

searching for the right value. It really doesn't matter whether or not

the user "needs to see" that user id. The point is that the database

needs to see that id. That's what it's supposed to do! No need to try

reinventing the wheel.

Report · Jun 15, 2009

Richard,

Thanks for your help. I changed my code and tested it. On the following statement,

$insertGoTo = "member_confirm.php?memid=" $newid;

I received a parse error. So, I changed it to the code below. The page executes and passes the following parameter:

http://aosweb.org/member_confirm.php?memid=74&

The target page and record set is not executing the query with this passess parameter. I suspect the & should not be there. How can I change the following code?

Thanks. George

mysql_select_db($database_aosuser, $aosuser);
$Result1 = mysql_query($insertSQL, $aosuser) or die(mysql_error() );

$newid = mysql_insert_id();
$insertGoTo = "member_confirm.php?memid=".$newid."";

if (isset($_SERVER['QUERY_STRING'])) {
$insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
$insertGoTo .= $_SERVER['QUERY_STRING'];
}
header(sprintf("Location: %s", $insertGoTo));

Report · Jun 15, 2009

Are u sure that no data were displayed? Try check your recordset in that member_confirm.php page and make it filtered by Member_Num > URL Parameter > memid in each respective field as below.

Report · Jun 16, 2009

Richard, David, and Q,

Thanks for your help. The issue is resolved.

George

Report · Jun 14, 2009

Just try like this, at the insertGoTo where the line is $insertGoTo = "member_view.php"; change the code $insertGoTo = "member_view.php?num=" . $_POST['Member_Num'] . ""; . Meanwhile, at the page member_view.php, create a recordset whereby filtered is with Member_Num > URL Parameter > num. It is better if u passed the id created by mysql but as long as u assure the value entered by user is unique, then u can try method as above.

Report · Jun 15, 2009

Hi,

Thanks for the input. I changed the code the way you suggested and it returns a '&' at the end of the url parameter

http://aosweb.org/member_confirm.php?memid=99998&

I think this is causing the query on the target page not to return results. Here is code on the source page. What do I need to change?

$insertGoTo = "member_confirm.php?memid=" .$_POST['Member_Num']."";

if (isset($_SERVER['QUERY_STRING'])) {
$insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
$insertGoTo .= $_SERVER['QUERY_STRING'];
}

Report · Jun 15, 2009

$insertGoTo = "member_confirm.php?memid=" .$_POST['Member_Num']."";
if (isset($_SERVER['QUERY_STRING'])) {
$insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
$insertGoTo .= $_SERVER['QUERY_STRING'];
}

What's happening is that the Dreamweaver code is looking for an existing query string, and adding it. The problem is that you're putting a query string in your redirect page, which results in the ampersand being added at the end. This is how I would change it:

// set the redirect to the target page without a query string
// then let Dreamweaver check for an existing query string
$insertGoTo = "member_confirm.php;
 if (isset($_SERVER['QUERY_STRING'])) {
 $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
 $insertGoTo .= $_SERVER['QUERY_STRING'];
 }
// if a query string has been added, add the memid at the end
// otherwise, create a query string to add memid
if (strpos($insertGoTo, '?')) {
 $insertGoTo .= '&memid=' . $_POST['Member_Num'];
} else {
 $insertGoTo .= '?memid=' . $_POST['Member_Num'];
}

Use PHP Variables between pages: Session, URL, or Get

1 Correct answer

Photos