防止双重预订 PHP/MYSQL

Question

Hello I am having trouble with a appointment booking database. I have been stuck on this for 3 days and I cant figure out what to do. I have appointments with various lengths that I retrieve from a form using PHP POST. I then try to update the database with the values I received. I want to stop users from double booking appointments and booking appointments while another one is going on.

This is my DB MYSQL DB .

The lesson_date_time field is in DATETIME format with a max value of 6.

The form code

<form method="post" name="update" action="dtupp.php" /> 
    Email:<br>
    <input type="text" name="email" /><br>
    Lesson Length:<br>   
    <input type="text" name="length" /><br> 
    Start Date<br> 
    <input type="text" name="date"/><br>
    <input type="submit" name="Submit" value="update" /> 
</form> 

The values I pass into the form are

For Start Date: 2014-11-30 12:41:00

For Lesson Length: 60

For Email: Fake@aol.com

My processor statement

<?php 
$mins = $_POST["length"];
$date_start = $_POST["date"];
$date_end   = date("Y-m-d H:i:s", strtotime("$date_start + $mins minute"));
$emails = $_POST['emails']; 
mysql_connect("localhost", "dk1", "root1") or die("Connection Failed"); 
mysql_select_db("usersignup")or die("Connection Failed"); 
$query = " UPDATE bookings SET email = '$emails' WHERE lesson_date_time BETWEEN CAST('$date_start' AS DATETIME) AND CAST('$date_end' AS DATETIME) ";
if(!mysql_query($query)){
    die('Could not update data: ' . mysql_error());
}
else{
}
?>

For some reason I cannot get the values to into the database. MYSQL doesn't return ANY ERRORS. I checked if the error reporting is working by misplacing quotes and MYSQL immediately flags me. It wont return any errors but wont post anything into the database either.

Answer 1

The key thing you're missing here is having a condition that prevents over-writing previous bookings. In the current state of things that will take the form:

UPDATE bookings SET ... WHERE email IS NULL

This presumes email is initially NULL which it should be. Avoid setting it to obtuse things like 'none' or an empty string.

Note, you'll want to avoid violating the Zero, One or Infinity Rule and adhere to proper database normalization rules: Create a table that represents the individual making the booking. Even if this table only contains the email address at first, it's a huge step towards having proper database integrity.

Then you'd insert user_id instead, where that refers to a record in your users table. This way if a user changes their email address you only have to update one row, not N rows in who knows how many tables.

This establishes a proper "one-to-many" relationship between users and bookings. From there you can build out a very robust application.

Answer 2

Maybe there a no rows for your WHERE statement. For debugging check with SELECT if your WHERE statement returns anything.

You also could check the affected rows of your statement with mysql_affected_rows() .

I also wanted to mention that you should be aware of sql injections!