多页会话存储在数据库中

Question

i'm trying to set up a simple multipage form, with the use of sessions to be later stored in a database in multiple tables.

however, i seem to have run into a problem. while the values of the last page get posted to the database, the session variables do not.

please, keep in mind.. me and my project partner are complete newbies to php/sql and might not have payed as much attention in class as we should have. most of the code is pretty much thrown together randomly. and identifying problems does not seem to be our strong suit.

first page / b_tickets.php (simple html form with the values 'ticket_a', 'ticket_k' and 'ticket_vip')

second page / b_rooms.php

    <?php
session_start();

$_SESSION['ticket_a'] = $_POST['ticket_a'];
$_SESSION['ticket_k'] = $_POST['ticket_k'];
$_SESSION['ticket_vip'] = $_POST['ticket_vip'];
?>

third page / b_ucp.php

<?php
session_start();

$_SESSION['room_s'] = $_POST['room_s'];
$_SESSION['room_s_extra'] = $_POST['room_s_extra'];
$_SESSION['room_d'] = $_POST['room_d'];
$_SESSION['room_d_extra'] = $_POST['room_d_extra'];
$_SESSION['room_3'] = $_POST['room_3'];
$_SESSION['room_3_extra'] = $_POST['room_3_extra'];
$_SESSION['room_10'] = $_POST['room_10'];
$_SESSION['room_10_extra'] = $_POST['room_10_extra'];
$_SESSION['pension'] = $_POST['pension'];
?>

which leads to

insert_ucp.php

(at this point an echo §_SESSION of the previous variables reveals that they are in fact still stored.)

<?php
session_start();

$con = mysql_connect("localhost","XX","XX");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("fatcity", $con);



$sql="INSERT INTO tickets (ticket_a, ticket_k, ticket_vip)
VALUES
('$_SESSION[ticket_a]','$_SESSION[ticket_k]','$_SESSION[ticket_vip]')";

$sql="INSERT INTO rooms (room_s, room_s_extra, room_d, room_d_extra, room_3, room_3_extra, room_10, room_10_extra, pension)
VALUES
('$_SESSION[room_s]','$_SESSION[room_s_extra]','$_SESSION[room_d]','$_SESSION[room_d_extra]','$_SESSION[room_3]','$_SESSION[room_3_extra]','$_SESSION[room_10]','$_SESSION[room_10_extra]','$_SESSION[pension]')";


$sql="INSERT INTO ucp (title, name, n_family, adress, a_housenumber, continent, country, province, region, city, telephone, email, password,  payment, client, comment)
VALUES
('$_POST[title]','$_POST[name]','$_POST[n_family]','$_POST[adress]','$_POST[a_housenumber]','$_POST[continent]','$_POST[country]','$_POST[province]','$_POST[region]','$_POST[city]','$_POST[telephone]','$_POST[email]','$_POST[password]','$_POST[payment]','$_POST[client]','$_POST[comment]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

mysql_close($con);
?>

at this point the question is not in fact about how terrible we are when it comes to php/sql- thank you.. we already figured that out. with only pretty much three days to our deadline..

but why exactly the session variables aren't saved to the database. what exactly are we overlooking?

thank you very much in advance..

Answer 1

RUN query every time!!!

You create variable, then overwrite it 2 times than execute it

should be:

$sql = 'smth';
mysql_query($sql);
$sql = 'smth';
mysql_query($sql);
$sql = 'smth';
mysql_query($sql);

you have

$sql = 'smth';
$sql = 'smth';
$sql = 'smth';
mysql_query($sql);

And as I've said do not use mysql_*. And your code allows sql injection

Answer 2

First problem I see, is that $sql variable gets overriden 2 times in the last piece of code. So, only the last query gets executed.

Second, you should use this syntax to inject non-tribial vars into strings: "INSERT ... ${someArray[someKey]} ..." - note curly braces. This is not required here, but it will save you from troubles in the future.

Third, sanitize all the input data! You will have SQL injection in the last code example.

Last, no need to session_start() in each file - just place it once in bootstrapping file and require_once it.

Answer 3

I agree with E_p in that only one of your queries is ever going to be executed. doing what he suggested will allow all your queries to execute.

You may also want to take a look at your tables, just from looking at your query structure I see nothing wrong with them, but you may end up having a hard time getting the info you want back out. I could be wrong since you didn't post your table structures nor was your question really regarding this, but its just something I noticed and figured I would share. Your tables do not look like they are connected to each other by any foreign keys. This may not be needed for your project, but if you needed to pull all the form data related to all ticket_a entries then you would only get a list of sessionIDs corresponding to the ticket_a column, without any info from your 'rooms' or 'upc' tables. If that is what you are going for then its fine, otherwise you may want to look into it.