PHP & MySQL question

regarding $_POST

[naiquevin]

I am making a phonebook application kind of a thing just for learning purpose.. but am not able to figure out one thing

This is how the site works

1st page (index.php) has a drop down list with 4 options -
(user1, user2,user3,user4) and a submit button

2nd page (mainpage.php) uses the name of the user selected in page1 to display a message "Welcome userName" using following script

Welcome <?php echo "$_POST['user']"; ?>

2nd page also displays two forms - having 1 submit button each which are "Add new contact" and "Search for contacts"

What I want is a separate database for the 4 users, and the the contact must be added to and searched from only that database which corresponds to the user selected on Page1

How can I carry forward the user selected on Page1 to Page3 and 4 ie. "Add contact" and "Search" ?

Thanks!

[penders]

How can I carry forward the user selected on Page1 to Page3 and 4 ie. "Add contact" and "Search" ?

You need to store the user in either a session [uk.php.net] variable or a cookie in order to maintain state between page requests.

[wheelie34]

Hi, add a hidden filed to each form and populate it with the username value, you could also start a session I think but as you are only learning do it the easy way so you understand it.

<input name="user" type="hidden" value="<?echo $user?>">

HTH

[coopster]

You are learning about HTTP now, naiquevin. And HTTP is a stateless protocol, which means each request is made to a server, the server accepts a connection and processes the request and then disconnects. It does not retain any information from that request unless you tell it to do so. So, how do you maintain state? Another way to say that is, "how do I keep track of what has been entered and used so far?" There are a number of ways but one of the most popular is session handling [php.net].

<added>
Cookies, hidden form input, query string are indeed other options, didn't mean to discount them. Determine the best solution for your particular application. You'll likely find yourself using one or more of them for different applications.
</added>

[naiquevin]

The hidden form input method worked. Thanks everyone..

I used a series of if and else if statements so that each user inputs data only into his separate table(whose name is same as that of the user)..
Just out of curiosity and to reduce coding, is it possible to directly refer to the table using $_POST["user"]..
the name of the user and the name of the table being the same

As in something like this-

$sql="INSERT INTO $_POST["user"] (... )VALUES ( ....)";

Also, there is a text field to accept an email address.. the column type in mysql table is varchar. But the email column in Mysql rremains NULL even if some email address is entered. What can be the problem here?

[coopster]

NEVER trust user-supplied data. Your sql statement is very dangerous and insecure. What if I passed you "mysql" in the $_POST["user"] field? Now you are potentially allowing me to insert my own information into your MySQL system security table!

You likely have your code incorrect for the email issue. Dump the query and/or the data back to your browser after you have assembled the sql query and before you execute it.

[naiquevin]

On my first page, i have a drop down list with 4 usernames..(fixed) so I dont think 'mysql' can be passed in anyway ( or can it still be passed? )
I am coding this application just for understanding purpose... but thanks for the valid point regarding security issues.. completely ignored them so far.

And Sorry but didnt get your solution for the email issues.. what is meant by 'dumping the query to the browser' ?

[coopster]

You can view your query before you execute it like this ...

<?php 
$myValue = mysql_real_escape_string($_POST['userSuppliedData']); 
$sql = "SELECT * FROM table WHERE myColumn = '$myValue'"; 
    // Dump the query to the browser: 
    print $sql; exit; 
$rows = mysql_query($sql); 
...

[penders]

i have a drop down list with 4 usernames..(fixed) so I dont think 'mysql' can be passed in anyway ( or can it still be passed? )

Yes, it could still be passed... in a live environment, a hacker (or even an automated robot/script) would probably bypass your form completely and send a POST request directly to your script (all client side HTML/JavaScript would be bypassed).