mysql - PHP SQL Insert text value into database -
i working on online shopping cart project, requires me able add custom text input field each item added shopping cart. however, when attempt insert information each item in card database, cannot figure out how pass itemtext value insert statement. how go being able pass itemtext value initial item list database orderitems? itemtext input on line 170, , want pass insert statement seen on line 83.
<?php session_start(); $user = $_session['user']; if(!isset($user)) { header("location:userlogin.php"); } $cart = $_cookie['wsc']; if(isset($_post['clear'])) { $expire = time() -60*60*24*7*365; setcookie("wsc", $cart, $expire); header("location:order.php"); } if($cart && $_get['id']) { $cart .= ',' . $_get['id']; $expire = time() +60*60*24*7*365; setcookie("wsc", $cart, $expire); header("location:order.php"); } if(!$cart && $_get['id']) { $cart = $_get['id']; $expire = time() +60*60*24*7*365; setcookie("wsc", $cart, $expire); header("location:order.php"); } if($cart && $_get['remove_id']) { $removed_item = $_get['remove_id']; $arr = explode(",", $cart); unset($arr[$removed_item-1]); $new_cart = implode(",", $arr); $new_cart = rtrim($new_cart, ","); $expire = time() +60*60*24*7*365; setcookie("wsc", $new_cart, $expire); header("location:order.php"); } if(isset($_post['placeorder'])) { $email = $user; $orderdate = date('m/d/y'); $ordercost = $_post['ordercost']; $ordertype = $_post['ordertype']; $downcost = $_post['downcost']; $cardtype = $_post['cardtype']; $cardnumber = $_post['cardnumber']; $cardsec = $_post['cardsec']; $cardexpdate = $_post['cardexpdate']; $orderstatus = "pending"; if($ordertype=="") { $ordertypemsg = "<br><span style='color:red;'>you must enter order type.</span>"; } if($cardtype=="") { $cardtypemsg = "<br><span style='color:red;'>you must enter card type.</span>"; } if($cardnumber=="") { $cardnumbermsg = "<br><span style='color:red;'>you must enter card number.</span>"; } if($cardsec=="") { $cardsecmsg = "<br><span style='color:red;'>you must enter security code.</span>"; } if($cardexpdate=="") { $cardexpdatemsg = "<br><span style='color:red;'>you must enter expiration date.</span>"; } else { include ('includes/dbc_admin.php'); $sql = "insert orders (email, orderdate, ordercost, ordertype, downcost, cardtype, cardnumber, cardsec, cardexpdate, orderstatus) values ('$email', '$orderdate', '$ordercost', '$ordertype', '$downcost', '$cardtype', '$cardnumber', '$cardsec', '$cardexpdate', '$orderstatus')"; mysql_query($sql) or trigger_error("whoa! ".mysql_error()); $sql = "select orderid orders"; $result = mysql_query($sql) or die("invalid query: " . mysql_error()); while($row=mysql_fetch_assoc($result)) { $myid = $row[orderid]; } $itemnumber = 1; $items = explode(',', $cart); foreach($items $item) { $sql = "select * catalog id = '$item'"; $result = mysql_query($sql) or die("invalid query: " . mysql_error()); while($row=mysql_fetch_assoc($result)) { $itemtext = $_post['itemtext']; $sql= "insert orderitems (orderid, itemnumber, itemid, itemtype, media, itemtext, price) value ('$myid', '$itemnumber', '$row[itemid]', '$row[itemtype]', '$row[media]', '$itemtext[itemnumber]', '$row[price]')"; mysql_query($sql) or trigger_error("whoa! ".mysql_error()); } $itemnumber++; } $inserted = "<h2>thank you!</h2> <h3>your order has been placed.</h3>"; } } ?> <!doctype html> <html> <head> <title>williams specialty company</title> <link href="style.css" rel="stylesheet" type="text/css" /> <script type="text/javascript"> function validateform() { var ordercost = document.form1.ordercost.value; var downcost = document.form1.downcost.value; var ordertype = document.form1.ordertype.value; var cardtype = document.form1.cardtype.value; var cardnumber = document.form1.cardnumber.value; var cardsec = document.form1.cardsec.value; var cardexpdate = document.form1.cardexpdate.value; var ordertypemsg = document.getelementbyid('ordertypemsg'); var cardtypemsg = document.getelementbyid('cardtypemsg'); var cardnumbermsg = document.getelementbyid('cardnumbermsg'); var cardsecmsg = document.getelementbyid('cardsecmsg'); var cardexpdatemsg = document.getelementbyid('cardexpdatemsg'); if(ordertype == ""){ordertypemsg.innerhtml = "you must enter order type."; return false;} if(cardtype == ""){cardtypemsg.innerhtml = "you must enter card type."; return false;} if(cardnumber == ""){cardnumbermsg.innerhtml = "you must enter card number."; return false;} if(cardsec == ""){cardsecmsg.innerhtml = "you must enter security code."; return false;} if(cardexpdate == ""){cardexpdatemsg.innerhtml = "you must enter expiration date."; return false;} } </script> </head> <body> <?php include('includes/header.inc'); ?> <?php include('includes/nav.inc'); ?> <div id="wrapper"> <?php include('includes/aside.inc'); ?> <section> <h2>my cart</h2> <table width="100%"> <tr> <th>catalog id</th> <th>item name</th> <th>price</th> <th>item text</th> <th>actions</th> </tr> <?php $cart = $_cookie['wsc']; if ($cart) { $i = 1; $ordercost; include('includes/dbc.php'); $items = explode(',', $cart); foreach($items $item) { $sql = "select * catalog id = '$item'"; $result = mysql_query($sql) or die("invalid query: " . mysql_error()); while($row=mysql_fetch_assoc($result)) { echo '<tr>'; echo '<td align="left">'; echo $row['itemid']; echo '</td>'; echo '<td align="left">'; echo $row['itemname']; echo '</td>'; echo '<td align="left">'; echo $row['price']; $ordercost+=$row['price']; $downcost = $ordercost / 10; echo '</td>'; echo '<td align="left">'; echo '<p><input type="text" id= "itemtext" name="itemtext"></p>'; echo '</td>'; echo '<td align="left">'; echo '<a href="order.php?remove_id='.$i.'">remove cart</a>'; echo '</td>'; echo '</tr>'; } $i++; } } ?> </table><br /> <form method="post" action="<?php $_server['php_self'];?>"> <input type="submit" name="clear" value="empty shopping cart"> </form> <?php if(isset($inserted)) {echo $inserted;} else{ ?> <form method="post" action="<?php echo $server['php_self'] ?>" name="form1" onsubmit="return validateform()"> <p>total price: <?php echo $ordercost;?> <input type="hidden" id="ordercost" name="ordercost" value="<?php echo $ordercost;?>"> </p> <p>down cost: <?php echo number_format((float)$downcost, 2, '.', '');?> <input type="hidden" id="downcost" name="downcost" value="<?php echo number_format((float)$downcost, 2, '.', '');?>"> </p> <p><label>order type:</label><br> <input type="text" id="ordertype" name="ordertype"> <?php if(isset($ordertypemsg)) {echo $ordertypemsg;} ?> <br /><span id="ordertypemsg" style="color:red"></span> </p> <p><label>card type:</label><br> <input type="text" id="cardtype" name="cardtype"> <?php if(isset($cardtypemsg)) {echo $cardtypemsg;} ?> <br /><span id="cardtypemsg" style="color:red"></span> </p> <p><label>card number:</label><br> <input type="text" id="cardnumber" name="cardnumber"> <?php if(isset($cardnumbermsg)) {echo $cardnumbermsg;} ?> <br /><span id="cardnumbermsg" style="color:red"></span> </p> <p><label>card security code:</label><br> <input type="text" id="cardsec" name="cardsec"> <?php if(isset($cardsecmsg)) {echo $cardsecmsg;} ?> <br /><span id="cardsecmsg" style="color:red"></span> </p> <p><label>card expiration date:</label><br> <input type="text" id="cardexpdate" name="cardexpdate"> <?php if(isset($cardexpdatemsg)) {echo $cardexpdatemsg;} ?> <br /><span id="cardexpdatemsg" style="color:red"></span> </p> <p><input type="submit" name="placeorder" value="place order"></p> </form><?php }?> </section> </div> <?php include('includes/footer.inc'); ?> </body> </html>
update: answer: change '$itemtext[itemnumber]' '$itemtext'
this going wrong because of way use quotes. (not answer might want think ;-) )
$sql = "insert orders (email, orderdate, ordercost, ordertype, downcost, cardtype, cardnumber, cardsec, cardexpdate, orderstatus) values ('$email', '$orderdate', '$ordercost', '$ordertype', '$downcost', '$cardtype', '$cardnumber', '$cardsec', '$cardexpdate', '$orderstatus')"; you should not use '$email' -for example- ...values ('".$email."',...
learn more here: what difference between single-quoted , double-quoted strings in php?
on note, code not safe. please use: http://php.net/manual/en/function.mysql-real-escape-string.php
example:
...values ('".mysql_real_escape_string($email)."',...
Comments
Post a Comment