Question

I’m trying to implement a two-step registration form for my site wherein I used 2 separate pages in order to get the information from the user.

First Step:

if($submit)
{
    $connect = mysql_connect("localhost","root","");
    mysql_select_db("mydb");
    $queryreg = mysql_query("INSERT INTO volunteerbio VALUES (<my insert values>)");
}
//gets the latest id added
$query = mysql_query("SELECT MAX(volunteerID) FROM volunteerbio");
$numrows = mysql_num_rows($query);

if($numrows!=0)
{
    while($row = mysql_fetch_assoc($query))
    {
        $dbaccountID = $row['volunteerID'];
    }
    header("Location: http://localhost/RedCrossCaloocan/registration2_volunteer.php");
    $_SESSION['volunteerID']=$dbaccountID;
}
}
?>

What the first step does is that it creates a complete table row wherein the values needed for the second step will be temporarily left with blank values until they are updated in the next step.

Second Step:

<?php
  session_start();
  $idnum = @$_SESSION['volunteerID'];
  $connect = mysql_connect("localhost","root","");
  mysql_select_db("mydb");

if($submit)
{
  $updateSkills = mysql_query("

     UPDATE volunteerbio
     SET medicalSkillRating = $medicalRating,
         electronicsSkillRating = $electronicRating,
         errandSkillRating = $errandRating,
         childCareSkillRating = $childCareRating,
         counsellingSkillRating = $counsellingRating,
         officeSkillRating = $officeRating,
         communicationSkillRating =$communicationRating,
         carpentrySkillRating = $carpentryRating
     WHERE volunteerID = $idnum;

     ");
  }
?>

The second step basically updates the fields which where filled with blank values during the first step in order to complete the registration.

The first step already works and is able to add the values to the database however, I am having a problem on updating the blank values through the second step.

I have a feeling that there may be a problem regarding my usage of sessions in order to get the newly generated ID from the first step, but I just can’t figure it out.

Answer 1

You are doing:

header("Location: http://localhost/RedCrossCaloocan/registration2_volunteer.php");
$_SESSION['volunteerID']=$dbaccountID;

The second line MAY never get executed, because you do a redirect before it. I say MAY because it MAY get executed. You have to add exit(); after all redirects to prevent further execution of the script.

Another thing:

Never suppress warnings in PHP using @. The @ is almost never needed. So instead of doing:

@$_SESSION['volunteerID'];

You should do:

if (isset($_SESSION['volunteerID'])) {
    $idnum = $_SESSION['volunteerID'];
} else {
    // something went wrong???
}

I can’t see it in your example, but do prevent SQLi vulnerabilities?