从另一个表单添加数据时，$ _ POST / $ _ GET与在同一页面上提交数据的$ _POST / $ _ GET

Question

I have the following situation:

I have created a code for a Search box that allows the user to do some advanced search and created a prepared mysql statement. The form target is the same page.

I have also created another form that allows sorting. The form target is the same page.

The problem is that if I search for something and then I sort the data, it gets back to the default query (without the parameters set on the search box) so it sorts the whole data.

They work perfect isolated, but I would love to make them work together and I really can't figure out how.

Here is the PHP code for the Search box and the sorting:

<?php

require 'connect.php';
if(isset($_POST['cauta'])){
$cauta=$_POST['cauta'];}
$clause = " WHERE ";
$query1="SELECT nume, prenume, email, functie, denumire FROM contacte_companii cc LEFT JOIN companii c
ON cc.com_id=c.id";

if(isset($_POST['submit'])){
if(isset($_POST['keyword'])){
    foreach($_POST['keyword'] as $c){
        if(!empty($c)){
           $base_query=$query1 .= $clause." ".$c." LIKE '%".$cauta."%'";//
            $clause = " OR ";//Change  to OR after 1st WHERE
        }   
    }
}
echo $base_query;
}
else {
$base_query="SELECT nume, prenume, email, functie, denumire FROM contacte_companii cc
LEFT JOIN companii c
ON cc.com_id=c.id";
echo $base_query;
}
?>

    if(isset($_POST['ASC'])){
        $query  = $base_query . " ORDER BY prenume ASC"
    ;
    }

    // Descending Order
    elseif (isset ($_POST['DESC'])) {
              $query = $base_query . " ORDER BY prenume DESC";
        }

     else {
         $query = $base_query;
    }


    $result=$db->query($query);

    // Associative arrays of strings - for each row - stops at NULL;
    while($row=$result->fetch_assoc())
    {

    ?>
        <tr>
        <td><?php echo $row["prenume"]. " " .$row["nume"]; ?></td>
        <td><?php echo $row["email"]; ?></td>
        <td><?php echo $row["functie"]; ?></td>
        <td><?php echo $row["denumire"]; ?></td>
        </tr>

        <?php
    }


    $db->close();
    ?>

Here is the form for the Search box:

<form action="<?PHP echo htmlspecialchars($_SERVER['PHP_SELF']); ?>" method="post">
        <input type="checkbox" name="keyword[]" value="nume" checked> Nume
        <input type="checkbox" name="keyword[]" value="prenume" checked> Prenume
        <input type="checkbox" name="keyword[]" checked value="email"> Email
        <input type="checkbox" name="keyword[]" value="denumire"> Companie
        <input type="checkbox" name="keyword[]" value="telefon_b"> Telefon
        <input type="checkbox" name="keyword[]" hidden value="telefon_m">
        <input type="text" name="cauta">
        <input type="submit" name="submit" value="Cauta">

</form>

And here is how the sort button looks like in HTML:

<form action="<?PHP echo htmlspecialchars($_SERVER['PHP_SELF']); ?>" method="post">


th>Nume <button class="btn" type="submit" name="ASC" > 
<img src="icons\09.png" width="20" height="20" style="margin:3.5px 3px" align="right"/>
</button></th>


</form>

Answer 1

It's not a perfect solution but you could add at the second form as much hidden input and then make your test by keyword

 <form action="<?PHP echo htmlspecialchars($_SERVER['PHP_SELF']); ?>" method="post"> <input type="hidden" name="keyword[]" value=<? echo $_POST['Num'];?> > <input type="hidden" name="keyword[]" value=<? echo $_POST['prenume'];?> > <input type="hidden" name="keyword[]" value=<? echo $_POST['Email'];?> > <input type="hidden" name="keyword[]" value=<? echo $_POST['Companie'];?> > <input type="hidden" name="keyword[]" value=<? echo $_POST['Telefon'];?> > th>Nume <button class="btn" type="submit" name="ASC" > <img src="icons\\09.png" width="20" height="20" style="margin:3.5px 3px" align="right"/> </button></th> </form> 

Answer 2

First of all if you use a database query class you should use its prepared statements functionality, because otherwise you are vulnerable to SQL injection.

For example if I type in for the last keyword[] something like this "123'; SELECT * FROM users ;--". An attacker could exploit this in many ways, as he can write queries that your database will execute because it has no reason to doubt their validity.

Another thing to do is to sanitize the input you get from the forms.

And for the answer to your problem, you can combine the forms and add a checkbox or something to identify if you want to search or to order data. Because I see in your code that have a condition for the $_POST['cauta'].

Or you could combine the forms then you can add this to your query:

if(isset($_POST['cauta'])){
$cauta=$_POST['cauta'];}
$clause = " WHERE ";
$query1="SELECT nume, prenume, email, functie, denumire FROM contacte_companii cc LEFT JOIN companii c
ON cc.com_id=c.id";

if(isset($_POST['submit'])){
if(isset($_POST['keyword'])){
foreach($_POST['keyword'] as $c){
    if(!empty($c)){
       $base_query=$query1 .= $clause." ".$c." LIKE '%".$cauta."%'";//
        $clause = " OR ";//Change  to OR after 1st WHERE
    }   
}

   if(isset($_POST['ASC'])){
       $base_query  .= " ORDER BY prenume ASC";
   }

   // Descending Order
    elseif (isset ($_POST['DESC'])) {
         $base_query .= " ORDER BY prenume DESC";
    }
}
echo $base_query;
}

Answer 3

The problem is that you are using 2 different forms.

So, when you send any of the forms it only sends the parameters contained in that form, not the ones in the other form, so it will "forget" what the other form sent.

Solutions: (many ways actually, here are some)

• Enclose all the parameters in only one form instead of 2, that way it will send always all the information. ** (I think this would be the easiest)

• Add the parameters from the search form as hidden fields into the sort form and viceversa.

• Use the session or cookie to keep track of the last options used (if you do this you need to consider a way to "clear" the options, like a Clear button that removes everything from the session or cookie)