Question

I’m getting the following two errors when loading my page:

Notice: Undefined variable: realtor in C:\Program Files\EasyPHP-5.3.9\www\cglst\images\addform.php on line 255

and

Notice: Undefined variable: phone in C:\Program Files\EasyPHP-5.3.9\www\cglst\images\addform.php on line 256

I do define both those variables, though, so I don’t understand why I’m getting these errors. Here is my code:

function addListing() {//if data was provided, insert it into database and confirm
    //this will allow everything to be sanitized properly
    require_once "sanitize.php";
    $submitted = false;

    //Checking if values were passed
    if (isset($_POST['area']) &&
        isset($_POST['price']) &&
        isset($_POST['address']) &&
        isset($_POST['bedrooms']) &&
        isset($_POST['fullbath']) &&
        isset($_POST['halfbath']) &&
        isset($_POST['sqft']))
        //if passed, sanitize and set variables accordingly
        {
            $area = sanitizeOne(get_post('area'), 'plain');
            $price = sanitizeOne(get_post('price'), 'int');
            $address = sanitizeOne(get_post('address'), 'plain');
            $bedrooms = sanitizeOne(get_post('bedrooms'), 'int');
            $fullbath = sanitizeOne(get_post('fullbath'), 'int');
            $halfbath = sanitizeOne(get_post('halfbath'), 'int');
            $sqft = sanitizeOne(get_post('sqft'), 'int');
            $submitted = true;
        }

    //optional fields
    if (isset($_POST['remarks']))
        {
            $remarks = sanitizeOne(get_post('remarks'), 'plain');
        }
    else
        {$remarks = ' ';}

    if (isset($_POST['realtor']))
        {
            $remarks = sanitizeOne(get_post('realtor'), 'plain');
        }
    else
        {$realtor = "Anne-Marie Pelletier";}

    if (isset($_POST['phone']))
        {
            $remarks = sanitizeOne(get_post('phone'), 'plain');
        }
    else
        {$phone = "201.710.5500";}

    if ($submitted) {
        $query = 'PREPARE statement FROM "INSERT INTO bix(area, price, address, bedrooms, 
                fullbath, halfbath, sqft, remarks, realtor, phone) VALUES(?,?,?,?,?,?,?,?,?,?)"';
        mysql_query($query);
        $query = 'SET 
                    @area = "' . $area . '"' .
                    '@price = "' . $price . '"' .
                    '@address = "' . $address . '"' .
                    '@bedrooms = "' . $bedrooms . '"' .
                    '@fullbath = "' . $fullbath . '"' .
                    '@halfbath = "' . $halfbath . '"' .
                    '@sqft = "' . $sqft . '"' .
                    '@remarks = "' . $remarks . '"' .
                    '@realtor = "' . $realtor . '"' . //line 255
                    '@phone = "' . $phone . '"'; //line 256
        mysql_query($query);
        $query = 'EXECUTE statement USING @area,@price,@address,@bedrooms,@fullbath,@halfbath,@sqft,@remarks,@realtor,@phone';
        mysql_query($query);
        $query = 'DEALLOCATE PREPARE statement';
        mysql_query($query);
        return true;
    }
}
function get_post($var)
{
    return mysql_real_escape_string($_POST[$var]);
}

This is simply adding an entry to a database if it was submitted (the page submits a form to itsself to do this)

Answer 1

Your problem is here, a cut’n’paste error;

if (isset($_POST['realtor']))
{
    $remarks = sanitizeOne(get_post('realtor'), 'plain');
}
else
    {$realtor = "Anne-Marie Pelletier";}

If realtor is set as a post parameter, you assign the post variable’s value to $remarks instead of to $realtor.

$phone has the exact same problem.