Probleem met update script
- Ik ben me bewust van de lekke beveiliging. De website draait intern dus maak me hier (nog niet) druk om.
- Ik ben beginnend scripter dus fouten zullen er vast in zitten..
Toch bedankt voor het lezen en de eventuele hulp :)
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
<style type="text/css">
td.kleur1 {
background-color: #000000;
color: white;
font-weight: bold;
}
td.kleur2 {
background-color: #ADFF2F;
font-weight: bold;
}
</style>
<?php
$host="localhost"; // Host name
$username="*****"; // Mysql username
$password="*****"; // Mysql password
$db_name="viewit"; // Database name
// Connect to server and select databse.
mysql_connect($host, $username, $password)or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
//Query starten
$query = "SELECT *
FROM vervangingen
WHERE Identificatie = '" . mysql_real_escape_string($_POST["edit"]) . "'";
$result = mysql_query($query);
$row = mysql_fetch_assoc($result);
?>
<?php
if (!isset($_POST['submit'])) { // if page is not submitted to itself echo the form
$update = "UPDATE vervangingen SET Status = '" . mysql_real_escape_string($_POST["status"]) . "' WHERE Identificatie = '" . mysql_real_escape_string($_POST["edit"]) . "'";
mysql_query($update) or die (mysql_error());
}
?>
<form action="http://viewit/update.php" method="post">
<table width="300" border="1" align="left" cellpadding="5" cellspacing="3"RULES="NONE" FRAME="BOX" bordercolor="#000000">
<tr>
<td class="kleur1"><h3> <?php echo $row['Identificatie'] ;?> </h3></td>
<td class="kleur1"> </td>
</tr>
<tr>
<td class="kleur2"> </td>
<td> </td>
</tr>
<tr>
<td class="kleur2"> Status:</td>
<td>
<select name="status">
<option value="Openstaand">Openstaand</option>
<option value="Afgehandeld">Afgehandeld</option>
</select>
</td>
</tr>
<tr>
<td class="kleur2"> Prioriteit:</td>
<td>
<select name="prioriteit">
<option value="Laag">Laag</option>
<option value="Normaal" selected>Normaal</option>
<option value="Verhoogd">Verhoogd</option>
<option value="Hoog">Hoog</option>
</td>
</tr>
<tr>
<td class="kleur2"> IT Medewerker:</td>
<td>
<?php
$query = "SELECT naam, stafcode FROM afdelingit WHERE rechten=1";
// Execute it, or return the error message if there's a problem.
$result2 = mysql_query($query) or die(mysql_error());
$dropdown = "<select name='itmedewerker'>";
while($row2 = mysql_fetch_assoc($result2)) {
$dropdown .= "\r\n<option value='{$row2['naam']} {$row2['stafcode']}'>{$row2['naam']} {$row2['stafcode']}</option>";
}
$dropdown .= "\r\n</select>";
echo $dropdown;
?></td>
</tr>
<tr>
<td class="kleur2"> Pc nummer:</td>
<td> <?php echo $row['Identificatie'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Eigenaar:</td>
<td> <?php echo $row['Eigenaar'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Gebr. specifiek:</td>
<td> <?php echo $row['Gebr_specificatie'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Objectsoort:</td>
<td> <?php echo $row['Objectsoort'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Merk:</td>
<td> <?php echo $row['Merk'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Type:</td>
<td> <?php echo $row['Type'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Serienummer:</td>
<td> <?php echo $row['Serienummer'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Asset Tag:</td>
<td> <?php echo $row['Asset_Tag']; ?></td>
</tr>
<tr>
<td class="kleur2"> Operating System:</td>
<td> <?php echo $row['Operating_system'] ;?></td>
</tr>
<tr>
<td class="kleur2"> </td>
<td> </td>
</tr>
<tr>
<td class="kleur1"> </td>
<td class="kleur1"><pre align="right"><input type="submit" value=" Sla de wijzingen op! " name="submit" /></pre></td>
</tr>
</form>
</table>
td.kleur1 {
background-color: #000000;
color: white;
font-weight: bold;
}
td.kleur2 {
background-color: #ADFF2F;
font-weight: bold;
}
</style>
<?php
$host="localhost"; // Host name
$username="*****"; // Mysql username
$password="*****"; // Mysql password
$db_name="viewit"; // Database name
// Connect to server and select databse.
mysql_connect($host, $username, $password)or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
//Query starten
$query = "SELECT *
FROM vervangingen
WHERE Identificatie = '" . mysql_real_escape_string($_POST["edit"]) . "'";
$result = mysql_query($query);
$row = mysql_fetch_assoc($result);
?>
<?php
if (!isset($_POST['submit'])) { // if page is not submitted to itself echo the form
$update = "UPDATE vervangingen SET Status = '" . mysql_real_escape_string($_POST["status"]) . "' WHERE Identificatie = '" . mysql_real_escape_string($_POST["edit"]) . "'";
mysql_query($update) or die (mysql_error());
}
?>
<form action="http://viewit/update.php" method="post">
<table width="300" border="1" align="left" cellpadding="5" cellspacing="3"RULES="NONE" FRAME="BOX" bordercolor="#000000">
<tr>
<td class="kleur1"><h3> <?php echo $row['Identificatie'] ;?> </h3></td>
<td class="kleur1"> </td>
</tr>
<tr>
<td class="kleur2"> </td>
<td> </td>
</tr>
<tr>
<td class="kleur2"> Status:</td>
<td>
<select name="status">
<option value="Openstaand">Openstaand</option>
<option value="Afgehandeld">Afgehandeld</option>
</select>
</td>
</tr>
<tr>
<td class="kleur2"> Prioriteit:</td>
<td>
<select name="prioriteit">
<option value="Laag">Laag</option>
<option value="Normaal" selected>Normaal</option>
<option value="Verhoogd">Verhoogd</option>
<option value="Hoog">Hoog</option>
</td>
</tr>
<tr>
<td class="kleur2"> IT Medewerker:</td>
<td>
<?php
$query = "SELECT naam, stafcode FROM afdelingit WHERE rechten=1";
// Execute it, or return the error message if there's a problem.
$result2 = mysql_query($query) or die(mysql_error());
$dropdown = "<select name='itmedewerker'>";
while($row2 = mysql_fetch_assoc($result2)) {
$dropdown .= "\r\n<option value='{$row2['naam']} {$row2['stafcode']}'>{$row2['naam']} {$row2['stafcode']}</option>";
}
$dropdown .= "\r\n</select>";
echo $dropdown;
?></td>
</tr>
<tr>
<td class="kleur2"> Pc nummer:</td>
<td> <?php echo $row['Identificatie'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Eigenaar:</td>
<td> <?php echo $row['Eigenaar'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Gebr. specifiek:</td>
<td> <?php echo $row['Gebr_specificatie'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Objectsoort:</td>
<td> <?php echo $row['Objectsoort'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Merk:</td>
<td> <?php echo $row['Merk'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Type:</td>
<td> <?php echo $row['Type'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Serienummer:</td>
<td> <?php echo $row['Serienummer'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Asset Tag:</td>
<td> <?php echo $row['Asset_Tag']; ?></td>
</tr>
<tr>
<td class="kleur2"> Operating System:</td>
<td> <?php echo $row['Operating_system'] ;?></td>
</tr>
<tr>
<td class="kleur2"> </td>
<td> </td>
</tr>
<tr>
<td class="kleur1"> </td>
<td class="kleur1"><pre align="right"><input type="submit" value=" Sla de wijzingen op! " name="submit" /></pre></td>
</tr>
</form>
</table>
Voeg dit bovenaan toe:
error_reporting(E_ALL);
@Mark Thxs, ik zie het inderdaad. Ik krijg alleen niet duidelijk wat ik anders moet doen of een goede tutorial vinden waar ik hetzelfde doel haal.
Code (php)
Als je je eigen commentaar leest, staat daar dat binnen de accolades het formulier moet worden getoond.
Aangezien je exact het tegenovergestelde doet ... haal die ! weg voor de isset.
Wat echter nog een beter idee is: vervang lijn 33 door
Gewijzigd op 29/08/2012 16:25:04 door Kris Peeters
Toevoeging op 29/08/2012 16:31:27:
Zo ff een code update gedaan
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
<style type="text/css">
td.kleur1 {
background-color: #000000;
color: white;
font-weight: bold;
}
td.kleur2 {
background-color: #ADFF2F;
font-weight: bold;
}
</style>
<?php
$host="localhost"; // Host name
$username="**"; // Mysql username
$password="**"; // Mysql password
$db_name="viewit"; // Database name
// Connect to server and select databse.
mysql_connect($host, $username, $password)or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
//Query starten
$query = "SELECT *
FROM vervangingen
WHERE Identificatie = '" . mysql_real_escape_string($_POST["edit"]) . "'";
$result = mysql_query($query);
$row = mysql_fetch_assoc($result);
?>
<?php
if($_SERVER['REQUEST_METHOD'] === 'POST') {
$update = "UPDATE vervangingen SET Status = '" . mysql_real_escape_string($_POST["status"]) . "' WHERE Identificatie = '" . mysql_real_escape_string($_POST["edit"]) . "'";
mysql_query($update) or die (mysql_error());
}
?>
<form action="http://viewit/update.php" method="post">
<table width="300" border="1" align="left" cellpadding="5" cellspacing="3"RULES="NONE" FRAME="BOX" bordercolor="#000000">
<tr>
<td class="kleur1"><h3> <?php echo $row['Identificatie'] ;?> </h3></td>
<td class="kleur1"> </td>
</tr>
<tr>
<td class="kleur2"> </td>
<td> </td>
</tr>
<tr>
<td class="kleur2"> Status:</td>
<td>
<select name="status">
<option value="Openstaand">Openstaand</option>
<option value="Afgehandeld">Afgehandeld</option>
</select>
</td>
</tr>
<tr>
<td class="kleur2"> Prioriteit:</td>
<td>
<select name="prioriteit">
<option value="Laag">Laag</option>
<option value="Normaal" selected>Normaal</option>
<option value="Verhoogd">Verhoogd</option>
<option value="Hoog">Hoog</option>
</td>
</tr>
<tr>
<td class="kleur2"> IT Medewerker:</td>
<td>
<?php
$query = "SELECT naam, stafcode FROM afdelingit WHERE rechten=1";
// Execute it, or return the error message if there's a problem.
$result2 = mysql_query($query) or die(mysql_error());
$dropdown = "<select name='itmedewerker'>";
while($row2 = mysql_fetch_assoc($result2)) {
$dropdown .= "\r\n<option value='{$row2['naam']} {$row2['stafcode']}'>{$row2['naam']} {$row2['stafcode']}</option>";
}
$dropdown .= "\r\n</select>";
echo $dropdown;
?></td>
</tr>
<tr>
<td class="kleur2"> Pc nummer:</td>
<td> <?php echo $row['Identificatie'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Eigenaar:</td>
<td> <?php echo $row['Eigenaar'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Gebr. specifiek:</td>
<td> <?php echo $row['Gebr_specificatie'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Objectsoort:</td>
<td> <?php echo $row['Objectsoort'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Merk:</td>
<td> <?php echo $row['Merk'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Type:</td>
<td> <?php echo $row['Type'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Serienummer:</td>
<td> <?php echo $row['Serienummer'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Asset Tag:</td>
<td> <?php echo $row['Asset_Tag']; ?></td>
</tr>
<tr>
<td class="kleur2"> Operating System:</td>
<td> <?php echo $row['Operating_system'] ;?></td>
</tr>
<tr>
<td class="kleur2"> </td>
<td> </td>
</tr>
<tr>
<td class="kleur1"> </td>
<td class="kleur1"><pre align="right"><input type="submit" value=" Sla de wijzingen op! " name="submit" /></pre></td>
</tr>
</form>
</table>
td.kleur1 {
background-color: #000000;
color: white;
font-weight: bold;
}
td.kleur2 {
background-color: #ADFF2F;
font-weight: bold;
}
</style>
<?php
$host="localhost"; // Host name
$username="**"; // Mysql username
$password="**"; // Mysql password
$db_name="viewit"; // Database name
// Connect to server and select databse.
mysql_connect($host, $username, $password)or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
//Query starten
$query = "SELECT *
FROM vervangingen
WHERE Identificatie = '" . mysql_real_escape_string($_POST["edit"]) . "'";
$result = mysql_query($query);
$row = mysql_fetch_assoc($result);
?>
<?php
if($_SERVER['REQUEST_METHOD'] === 'POST') {
$update = "UPDATE vervangingen SET Status = '" . mysql_real_escape_string($_POST["status"]) . "' WHERE Identificatie = '" . mysql_real_escape_string($_POST["edit"]) . "'";
mysql_query($update) or die (mysql_error());
}
?>
<form action="http://viewit/update.php" method="post">
<table width="300" border="1" align="left" cellpadding="5" cellspacing="3"RULES="NONE" FRAME="BOX" bordercolor="#000000">
<tr>
<td class="kleur1"><h3> <?php echo $row['Identificatie'] ;?> </h3></td>
<td class="kleur1"> </td>
</tr>
<tr>
<td class="kleur2"> </td>
<td> </td>
</tr>
<tr>
<td class="kleur2"> Status:</td>
<td>
<select name="status">
<option value="Openstaand">Openstaand</option>
<option value="Afgehandeld">Afgehandeld</option>
</select>
</td>
</tr>
<tr>
<td class="kleur2"> Prioriteit:</td>
<td>
<select name="prioriteit">
<option value="Laag">Laag</option>
<option value="Normaal" selected>Normaal</option>
<option value="Verhoogd">Verhoogd</option>
<option value="Hoog">Hoog</option>
</td>
</tr>
<tr>
<td class="kleur2"> IT Medewerker:</td>
<td>
<?php
$query = "SELECT naam, stafcode FROM afdelingit WHERE rechten=1";
// Execute it, or return the error message if there's a problem.
$result2 = mysql_query($query) or die(mysql_error());
$dropdown = "<select name='itmedewerker'>";
while($row2 = mysql_fetch_assoc($result2)) {
$dropdown .= "\r\n<option value='{$row2['naam']} {$row2['stafcode']}'>{$row2['naam']} {$row2['stafcode']}</option>";
}
$dropdown .= "\r\n</select>";
echo $dropdown;
?></td>
</tr>
<tr>
<td class="kleur2"> Pc nummer:</td>
<td> <?php echo $row['Identificatie'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Eigenaar:</td>
<td> <?php echo $row['Eigenaar'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Gebr. specifiek:</td>
<td> <?php echo $row['Gebr_specificatie'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Objectsoort:</td>
<td> <?php echo $row['Objectsoort'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Merk:</td>
<td> <?php echo $row['Merk'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Type:</td>
<td> <?php echo $row['Type'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Serienummer:</td>
<td> <?php echo $row['Serienummer'] ;?></td>
</tr>
<tr>
<td class="kleur2"> Asset Tag:</td>
<td> <?php echo $row['Asset_Tag']; ?></td>
</tr>
<tr>
<td class="kleur2"> Operating System:</td>
<td> <?php echo $row['Operating_system'] ;?></td>
</tr>
<tr>
<td class="kleur2"> </td>
<td> </td>
</tr>
<tr>
<td class="kleur1"> </td>
<td class="kleur1"><pre align="right"><input type="submit" value=" Sla de wijzingen op! " name="submit" /></pre></td>
</tr>
</form>
</table>
Gewijzigd op 29/08/2012 16:32:10 door T T
- Ten eerste: escapen helpt niet enkel tegen hackers. Het helpt ook tegen mensen die speciale tekens gebruiken, zoals ' en ". Neem nu iemand die ergens het woord foto's gebruikt.
Intern of niet ... dit is geen geldig argument.
- Je structuur moet anders. Een post verwerking doe je niet tussen je HTML.
Je zorgt voor zo'n geraamte:
Code (php)
1
2
3
4
5
6
7
8
9
10
11
2
3
4
5
6
7
8
9
10
11
Ook het lezen van records zou ik bovenaan doen. Sla die op in een variabele en gebruik ze waar nodig.
Nadat je <doctype> naar de client stuurt, zou je eigenlijk geen enkele logica meer mogen hebben. Geen if's , geen while's, ...
(Eventueel wel de ternary operator)
Als je dit doet, zal alles ook veel duidelijker worden voor jezelf en vind je fouten ook gemakkelijker
Gewijzigd op 29/08/2012 16:40:30 door Kris Peeters
Gewijzigd op 29/08/2012 16:47:21 door N K
edit: N.K. was net wat sneller.
Had je zelf ook kunnen zien/testen door te debuggen: echo een query naar het scherm en kijk of er dat staat wat je verwacht.
Code (php)
1
<form action="http://viewit/update.php" method="post">
Is dit een goede verwijzing naar update.php? Zonder www en zonder extensie?
Gewijzigd op 29/08/2012 16:52:13 door Obelix Idefix