Question

This is really bugging me and I can’t figure it out. I have a form with a few options being sent by POST:

<form method="POST" action="scripts/submit.php"><strong>
    To User: <input type="text" name="ID" size="21" /><br />
    Short Description: <input type="text" name="Item" size="21" /><br />
    Link: <input type="text" name="Link" size="21" /><br />
    Points: <select name="Points">
    <option value="1" selected="selected">1</option>
    <option value="0">0</option><option value="-1">-1</option>
    </select> (1 = Positive, 0 = Neutral, -1 = Negative)<br />
    Text: <br /><textarea name="Text" rows="5" cols="50"/></textarea></strong><br />
    <input type="submit" value="Send" />
</form>

And here is the portion of submit.php that is giving me trouble:

<?php
include('functions.php');
Connect();

if(!isset($_SESSION)) 
{ 
session_start(); 
} 
$id_from = $_SESSION['SESS_MEMBER_ID'];
$id_to = Sanitize($_POST['ID']);
$item = Sanitize($_POST['Item']);
$link = Sanitize($_POST['Link']);
$points= Sanitize($_POST['points']);
$text = Sanitize($_POST['Text']);

Does anyone see an issue here? I am getting undefined index’s from all of the variables except the session one.

Thanks in advance.

edit: If i just have this:

<?php
include('functions.php');
Connect();
if(!isset($_SESSION)) 
{ 
session_start(); 
} 

$id_from = $_SESSION['SESS_MEMBER_ID'];
$id_to = Sanitize($_POST['ID']);
$item = Sanitize($_POST['Item']);
$link = Sanitize($_POST['Link']);
$points = Sanitize($_POST['points']);
$text = Sanitize($_POST['Text']);

?>

The variables populate just fine. If I add:

 $id_query=mysql_query("SELECT ID FROM tbl_users WHERE Username = '$id_to'");

 $count=mysql_num_rows($id_query);

 $id_row=mysql_fetch_array($id_query);
 $id_to=$id_row['ID'];

 if ($points> 1 || $points< -1) {
     echo "Nice try";
     exit();
 } else {

 if(!($id_to == $id_from))
 {
 if($count==1)
 {
 mysql_query("INSERT INTO tbl_data (Item, Link, Points, Text, ID_To, ID_From) VALUES ('$item', '$link', '$points', '$text', '$id_to','$id_from')");
 header('Location:?id=submit');
 }
 else
 {
 echo "Nice try1";
 }
 }
 else
 {
 echo "Nice try2";
 }
 }

Answer 1

I just took your code over at my dev server at tried to test run it. Since I don’t know what your Sanitize() do, I can’t be sure what is going on inside this function.

If you try to remove the Sanitize(), I’m pretty sure it would work and you will have to look inside this to find the bug.

I’m guessing you might be missing something like ($var, str) for sanitize a string. Can you please tell a little more about this function ?

edit: some minor spelling errors.

Edit: Did some more test and made the error happen and the two codes shows it. The 1st works, while the 2nd gives me a empty var_dump.

This one gives me a full var_dump();

<?
function Sanitize($String) { 
$output = mysql_real_escape_string(stripslashes($String));
return $output;
}
if(!isset($_SESSION)) 
{ 
session_start(); 
} 
?>
<form method="post" action=""><strong>
To User: <input type="text" name="ID" size="21" /><br />
Short Description: <input type="text" name="Item" size="21" /><br />
Link: <input type="text" name="Link" size="21" /><br />
Points: <select name="Points"><option value="1" selected="selected">1</option><option value="0">0</option><option value="-1">-1</option></select> (1 = Positive, 0 = Neutral, -1 = Negative)<br />
Text: <br /><textarea name="Text" rows="5" cols="50"/></textarea></strong><br />
<input type="submit" value="Send" />
</form>

<?

$id_from = $_SESSION['SESS_MEMBER_ID'];
$id_to = Sanitize($_POST['ID']);
$item = Sanitize($_POST['Item']);
$link = Sanitize($_POST['Link']);
$points= Sanitize($_POST['points']);
$text = Sanitize($_POST['Text']);


var_dump($_POST);

echo $text;

?>

This one gives me an empty var_dump

<?
if(!isset($_SESSION)) 
{ 
session_start(); 
} 
?>
<form method="post" action=""><strong>
To User: <input type="text" name="ID" size="21" /><br />
Short Description: <input type="text" name="Item" size="21" /><br />
Link: <input type="text" name="Link" size="21" /><br />
Points: <select name="Points"><option value="1" selected="selected">1</option><option value="0">0</option><option value="-1">-1</option></select> (1 = Positive, 0 = Neutral, -1 = Negative)<br />
Text: <br /><textarea name="Text" rows="5" cols="50"/></textarea></strong><br />
<input type="submit" value="Send" />
</form>

<?

$id_from = $_SESSION['SESS_MEMBER_ID'];
$id_to = Sanitize($_POST['ID']);
$item = Sanitize($_POST['Item']);
$link = Sanitize($_POST['Link']);
$points= Sanitize($_POST['points']);
$text = Sanitize($_POST['Text']);


var_dump($_POST);

echo $text;

?>