php validation correct but still allowing data entry even when flagged

[codeblock]

Hello everybody,
I really need someones help. The problem is my if else statement. My if else conditions will block the first two int values but then allow the rest of the form data into the DB even if flagged as empty. if you look at the comments that i have written it should explain more. If i have a bug would downloading and re-installing xampp again help? or may be there is a patch i could download? Thanks.

[size=2]
<?php 

session_start(); 
require("config.php");
require("functions.php"); 

$db = mysql_connect($dbhost, $dbuser, $dbpassword);
mysql_select_db($dbdatabase, $db);
 
$propertytype = $_POST['propertytype'];
$age = $_POST['age']; 
$grade = $_POST['grade']; 
$style = $_POST['style']; 
$nofl = $_POST['nofl']; 
$adres = $_POST['adres'];
$startingprice = $_POST['startingprice']; 

if(isset($_SESSION['USERNAME']) == FALSE) 
{
header("Location: " . $config_basedir . "/login.php?ref=newitem");
} 
if($_POST['submitted']) 
{ 
$validdate = checkdate($_POST['month'], $_POST['day'], $_POST['year']); if($validdate == TRUE) {$concatdate = $_POST['year']
. "-" . sprintf("%02d", $_POST['month'])
. "-" . sprintf("%02d", $_POST['day']) 
. " " . $_POST['hour']
. ":" . $_POST['minute']
. ":00";
$itemsql = "INSERT INTO items(user_id,propertytype,age,grade,style,nofl,adres,startingprice,dateends) 
VALUES(
". $_SESSION['USERID']. ",
'" . addslashes($_POST['propertytype']). "', 
" . $_POST['age'] . ", 
'" . addslashes($_POST['grade']) . "', 
'" .addslashes( $_POST['style']) . "', 
" . $_POST['nofl']
. ",'" . addslashes($_POST['adres']) . "', 
" . $_POST['startingprice'] . ", 
'" . $concatdate. "');";
mysql_query($itemsql);
$itemid = mysql_insert_id(); 
header("Location: " . config_basedir . "/addimages.php?id=" . $itemid); 
}
if (empty($_POST['age']) ) // int value. Validates correctly and returns to page 
{ 
header("Location: " . $config_basedir . "/newitem.php?error=age"); 
} 
if (empty($_POST['grade']) ) // string 
{ 
header("Location: " . $config_basedir . "/newitem.php?error=grade"); 
} 
if (empty($_POST['style']) ) // string 
{ 
 header("Location: " . $config_basedir . "/newitem.php?error=style"); 
} 
if (empty($_POST['nofl']) ) // int value. Validates correctly and returns to page 
{ 
header("Location: " . $config_basedir . "/newitem.php?error=nofl"); 
} 
if (empty($_POST['adres']) || $_POST['adres']==" ") // string value. Validates correctly and returns to page but still allows value of the above variables to go into DB, this shou;d not happen. 
{ 
header("Location: " . $config_basedir . "/newitem.php?error=adres"); 
 }
} 
else{
require("header.php");
?>
<table width="447"class="abc"> 
<strong>Step 1- Add your project details. </strong> 
</table>
<?php // All messages flags correctly
switch($_GET['error']) { 
case "date":
echo "<strong>Invalid date - please choose another!</strong>";
break;
case "age": // flags as empty
echo "<strong>Invalid age - please enter the age of the property!</strong>";
break;
case "grade": // flags as empty
echo "<strong>Invalid grade - please enter the grade of the property!</strong>";
break;
case "style": // flags as empty
echo "<strong>Invalid style - please enter the style of the property!</strong>";
break;
case "nofl": // flags as empty
echo "<strong>Invalid nofl - please enter the nofl of the property!</strong>";
break;
case "adres": // flags as empty
echo "<strong>Invalid nofl - please enter the adres of the property!</strong>";
break;
}
?>
[/size]

[Readie]

Welcome to Webmaster World Codeblock

For form validation, I tend to do something like this:

Page:

echo $alert . '<p><form method="post">Entry one<br />
<input type="text" name="entry_one" /><br />
Entry two<br />
<input type="text" name="entry_two" /><br />
<input type="submit" name="subbut" value="Submit" />
</form></p>';

Validation:

$entry_one = $_POST['entry_one'];
$entry_two = $_POST['entry_two'];
$subbut = $_POST['subbut'];

if(isset($subbut) && $subbut == "Submit") {
$ec = 0;
$mess = '';
if(!isset($entry_one) || $entry_one == "") {
$ec += 1;
$mess .= '<br />Please give a value for entry one.';
} elseif(!is_numeric($entry_one)) {
$ec += 1;
$mess .= '<br />Entry one must be numeric.';
}
if(!isset($entry_two) || $entry_two == "") {
$ec += 1;
$mess .= '<br />Please give a value for entry two.';
}
if($ec != 0) {
$alert = '<p class="error">Error:' . $mess . '</p>';
} else {
$alert = '<p>Database updated.</p>';
// mysql_query etc...
}
}

[edited by: Readie at 9:55 pm (utc) on Feb 26, 2010]

[codeblock]

Thanks, i'll try it.