inserting data into mysql database using php

Question

I have a php order form named (order.php) and when the user clicks the (submit button "Next Step") it takes him to another page called (confirm-order.php)

The (confirm-order.php) shows the information that the user submitted from the (order.php) using the $_POST[] and by assigning each one of these to a variable.

Data showing on the (confirm-order.php) plain text like for example :

$itemName = $_POST['itemName'];
<?php echo $itemName; ?>

at the end of page there is a form contains only one element as (submit button)

How can i insert the $itemName data into mysql database only (after the submit button is clicked and the form actions take me to the confirmation page)?

I know how to insert data into mysql, but it didn't work with the isset() function

Do i have to write the isset function inside the form first? and below it the mysql database code?

order.php page:

<form class="form-horizontal well" action="confirm-order.php" method="POST">
    <fieldset>
      <legend>Personal Shopper Order Form</legend>
      <div class="control-group">
        <label class="control-label" for="select01">Choose a plan</label>
        <div class="controls">
          <select id="select01" name="plan">
            <option>Lite Plan $0 per order</option>
          </select>
        </div>
      </div>

      <div class="control-group">
        <label class="control-label" for="itemName">Item Name</label>
        <div class="controls">
          <input type="text" class="input-xlarge" id="itemName" name="itemName">
          <p class="help-block">Item name exapmle: iPad3 White 32GB wifi & 3G.</p>
        </div>
      </div>
       <div class="control-group">
        <label class="control-label" for="itemID">Item ID</label>
        <div class="controls">
          <input type="text" class="input-xlarge" id="itemID" name="itemID">
          <p class="help-block">example: Ebay Item ID, Amazon Item ID.</p>
        </div><br>
        <div class="control-group">
        <label class="control-label" for="itemURL">Item URL</label>
        <div class="controls">
          <input type="text" class="input-xxlarge" id="itemURL" name="itemURL">
          <p class="help-block">Direct web link to the item.</p>
        </div>
      </div>
      <div class="control-group">
        <label class="control-label" for="textarea">Item Details</label>
        <div class="controls">
          <textarea class="input-xlarge" id="textarea" name="itemDetails" rows="6"></textarea>
          <p class="help-block">Item details (name, color, specifications etc...)</p>
        </div>
      </div>
      <li id="li_3" data-pricefield="money_simple" data-pricevalue="0">
       <div class="input-prepend input-append">
        <label class="control-label" for="element_3_1">Item Price</label>
        <div class="controls">
        <span class="add-on">$</span>
          <input id="element_3_1" data-price-value="10.00"  name="element_3" type="text" class="element text large">
          <p class="help-block">Item exact price on the US online store.</p>
        </div>
      </div>
     </li>
     <li id="li_7" data-pricefield="money_simple" data-pricevalue="0">
       <div class="input-prepend input-append">
        <label class="control-label" for="element_7_1">Local Shipping Cost</label>
        <div class="controls">
        <span class="add-on">$</span>
          <input id="element_7_1" data-price-value="10.00"  name="element_7" type="text" class="element text large">
        </div>
        <p class="help-block">Local shipping fee from the US Store to Sky2ship (if applicable).</p>
      </div>
     </li>
     <li id="li_8" data-pricefield="radio" data-pricevalue="0">
     <div class="control-group">
      <div class="controls">
      <p class="help-block">Order Processing Service Fee.</p>
        <label class="radio">($0) Standard 2-3 days
        <input id="element_8_1" data-pricedef="00.00" name="element_8" class="element radio" type="radio" value="$0 Standard 2-3 Day">
        </label>
        <label class="radio">($10) Express 1 day
        <input id="element_8_2" data-pricedef="10.00" name="element_8" class="element radio" type="radio" value="$10 Express Same Day">

        </label>
      </div>
      </div>
      </li>
      <legend>Personal Information & Shipping Address</legend>
     <div class="control-group">
        <label class="control-label" for="input04">Full Name</label>
        <div class="controls">
          <input type="text" class="input-medium" id="fullName" name="fullName">
          <p class="help-block">First & last name.</p>
        </div>
      </div>
      <div class="control-group">
      <div class="controls">
        <label class="radio">Male
        <input type="radio" name="optionsRadios" id="optionsRadios1" value="option1" checked>
        </label>
        <label class="radio">
        <input type="radio" name="optionsRadios" id="optionsRadios2" value="option2">Female

        </label>
      </div>
      </div>
      <div class="input-prepend">
        <label class="control-label" for="prependedInput">Email Address</label>
        <div class="controls">
        <span class="add-on">@</span>
          <input type="text" class="span2" id="prependedInput" name="Email">
          <p class="help-block">Your email address.</p>
        </div>
      </div>
      <div class="control-group">
        <label class="control-label" for="input06">Address</label>
        <div class="controls">
          <input type="text" class="input-xxlarge" id="input06" name="streetAddress" placeholder="Street Address">
          <p class="help-block">Your shipping address.</p>
        </div>
      </div>
       <div class="control-group">
        <div class="controls controls-row">
          <input type="text" class="span2" id="City" name="City" placeholder="City">
          <input type="text" class="span3" id="State" name="State" placeholder="State / Province">

        </div>
      </div>
      <div class="control-group">
        <div class="controls controls-row">
          <input type="text" class="span2" id="PostalCode" name="PostalCode" placeholder="Postal Code">
          <input type="text" class="span3" id="Phone" name="Phone" placeholder="Phone Number">
        </div>
      </div>

      <div class="control-group">
        <label class="control-label" for="select01">Country</label>
        <div class="controls">
          <select id="select02" name="Country">
            <option>IRAQ</option>
            <option>JORDON</option>
          </select>
        </div>
      </div>
       <li class="total_payment" align="right" data-basetotal="0">

            <span>

                <h3 class="alert-success">&#36;<var>0</var></h3>

                <h5>Total</h5>

            </span>

        </li>   
      <div class="control-group">
        <label class="control-label" for="optionsCheckbox">Read & Agree</label>
        <div class="controls">
          <label class="checkbox">
            <input type="checkbox" id="optionsCheckbox" value="option1">
            <a href="#">I agree to the site's Terms of Service & Privacy Policy.</a>
          </label>
        </div>
      </div>

      <div class="form-actions">
        <button type="submit" class="btn btn-primary">Confirm Order</button>
        <button type="reset" class="btn">Cancel Order</button>
      </div>
    </fieldset>
  </form>

confirm-order.php page:

    <?php

$itemName = $_POST['itemName'];
$plan = $_POST['plan'];
$itemID = $_POST['itemID'];
$itemPrice = $_POST['element_3'];
$processService = $_POST['element_8'];
$itemDetails = $_POST['itemDetails'];
$streetAddress = $_POST['streetAddress'];
$City = $_POST['City'];
$State = $_POST['State'];
$PostalCode = $_POST['PostalCode'];
$Phone = $_POST['Phone'];
$Country = $_POST['Country'];
$fullName = $_POST['fullName'];
$Email = $_POST['Email'];
$itemURL = $_POST['itemURL'];
$itemLocalShipCost = $_POST['element_7'];

?>


 <?php
$db_host = "localhost";
$db_user = "root";
$db_pass = "000000";
$db_name = "dbname";
    if (isset($_POST['submit'])) {
  $db_connect = mysqli_connect($db_host,$db_user,$db_pass,$db_name);
  // Check connection
         if (mysqli_connect_errno())
  {
         echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }

  $sql ="INSERT INTO lite_order (lite_plan, lite_item_name)
        VALUES
  ('$plan','$item')";

          if (!mysqli_query($db_connect,$sql))
  {
          die('Error: ' . mysqli_error($db_connect));
  }
          echo "1 record added";
    }


?>
<address>
              <strong>Shipping Address.</strong><br>
              <?php echo $streetAddress; ?><br>
              <?php echo $City; ?>, <?php echo $State; ?>, <?php echo $PostalCode; ?><br><?php echo $Country; ?><br>
              <abbr title="Phone">P:</abbr><?php echo $Phone; ?>
            </address>
            <address>
              <strong><?php echo $fullName; ?></strong><br>
              <a href="mailto:#"><?php echo $Email; ?></a>
            </address>

            <table class="table">
              <thead>
                <tr>
                  <th>Plan</th>
                  <th>Item Name</th>
                  <th>Item ID</th>
                  <th>Local Shipping Cost</th>
                  <th>Item Price</th>
                  <th>Order Processing Fee</th>
                </tr>
              </thead>
              <tbody>
                <tr class="success">
                  <td><?php echo $plan; ?></td>
                  <td><?php echo $itemName; ?></td>
                  <td><?php echo $itemID; ?></td>
                  <td><?php echo "$" . $itemLocalShipCost; ?></td>
                  <td><?php echo "$" . $itemPrice; ?></td>
                  <td><?php echo $processService; ?></td
                ></tr>
              </tbody>
            </table>
            <strong>Item URL</strong><p class="alert alert-info"><?php echo $itemURL; ?></p>
            <pre class="pre-scrollable"><?php echo $itemDetails; ?></pre>
            <p>Your Total <h3 class="question"><?php echo "$" . $orderTotal; ?></h3></p>
                         <div class="form-actions"><form action="pending-order.php" method="post" name="confirmed-order">
                          <button type="submit" name="submit" class="btn btn-primary">Submit Order</button>
                          <button type="button" class="btn">Previous</button></form>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>

Whereto insert the mysql database code to insert all the variables into database after the submit button is clicked? where to place the isset() function? i tried it, it didn't insert any data into my table.

Answer 1

EDIT: a simple example

do <form> , validation and inserting in one file, say form.php :

<? // check if FORM has been posted

$posted = isset($_POST['submit']);

 if ($posted) { // form has been posted...

    // validate input

    if (!isset($_POST['item']) || strlen(trim($_POST['item'])) == 0)
        $error['item'] = "please insert an item-name!";

    if (!isset($_POST['price']) || !is_numeric($_POST['price']))
        $error['price'] = "please enter a valid price!";


    // ready for input?

    if (!isset($error)) { // no $error --> go insert!

        // I'll do the db-operation with PDO and a prepared statement.
        // this is cool, easy and safe. LEARN IT!

        $sql = "INSERT INTO table (item,price) VALUES (:item,:price)";

        $insert = $db->prepare($sql);
        $insert->execute(array(
            ':item' => $_POST['item'], 
            ':price' => $_POST['price']
            ));
    } // $error
 } // submit
?>

Now, in the <body> of the same page...

<? // check whether to display confirmation or form...

if ($posted && !isset($error)) { 

    // form was sent AND no error --> confirm
?>
<h1>Confirmed!</h1>
<p>Your data has been sent, thank you very much!</p>
<a href="somepage.php">go to somepage</a>
<?

} else {

    // form not sent or errors --> display form
?>

<h1>Please enter data</h1>

<? // display error-message, if there's one:
if (isset($error)) {
    $output = "";
    foreach ($error as $field => $msg) 
        $output .= (strlen($output) > 0?', ':'') . "[$field]: $msg";
    echo "<p>There were errors: $output</p>";
} // $error
?>

<form method="post">
    <!-- if the form has been sent, bring back the field's value from $_POST -->
    <p>item-name: <input type="text" name="item" 
        value="<?=($posted?$_POST['item']:'')?>" /></p>
    <p>price: <input type="text" name="price" 
        value="<?=($posted?$_POST['price']:'')?>" /></p>
    <p><input type="submit" name="submit" value="submit" /></p>
</form>

<?
} // submit & $error
?>

See the use of a ternary-operator for setting the value -attribute of the <input> -elements:

(<condition>?<what to do if true>:<what to do if false>)

Answer 2

There are two specific things I can contribute.

First, isset tests for null... which is different than empty. If you have a form field that is submitted empty , then set a local variable to that posted value, then test it with isset ; isset will return true because the value exists which is different than the variable not having been registered in the page load at all.

Second... ANYTHING can post to your form (think evil autonomous Korean hacker bots). Also, there are many ways a form can get submitted without having activated the submit button itself so there is no guarantee you will even see a submit key in your $_POST vars. What you need to define in your processing script is a "default action". What I mean by that is a very basic and SAFE behavior (like redirecting to a 'something is wrong' page) that kicks off by default such that the only way around it is to submit a correct form with all anticipated values correctly set .

If you do this, you can ignore the value of the submit button itself and instead focus on the contents of the POST. Did I receive everything I expected to receive? Was it all in the correct format? Was the user authenticated correctly? Only after all these questions have been tested to your satisfaction would you switch from the default behavior to a form processing behavior in which the posted data can be inserted into your database.

Example using your 3 page structure: reference: filter vars

Page 1:

<form action=./page2 method=POST>
<input type=text value=1234 name=numericValue />
<input type=text value="dummytext" name=stringValue />
<input type=submit value=submit name=submit />
</form>

Page 2:

<?php
$args = array('numericValue' => FILTER_VALIDATE_INT
             ,'stringValue' => FILTER_SANITIZE_STRING);

$clean_data = filter_input_array(INPUT_POST,$args);

if (is_array($clean_data))
{
  $_SESSION["saved_clean_data"] = $clean_data;
}
else 
{
  Header(<something wrong page>);
  die();
}
?>
<form action=./page3 method=POST>
<input type=submit name=submit value=No />
<input type=submit name=submit value=Yes />
</form>

Page 3:

<?php
if ($_POST["submit"] === "Yes")
{
   $cleanNum = $_SESSION["saved_clean_data"]["numericValue"];
   $cleanStr = $_SESSION["saved_clean_data"]["stringValue"];
   // DB insert Query, use advice from michi about PDO
   // parameterize your queries to help prevent sql injection
}
else
{
  Header(<somewhere for declined submits>);
  die();
}
?>

Answer 3

Well there are couple of ways about doing this:

1. Store all the data from the previous page ie from order.php in the $SESSION[] variables:
   Explaination: Setting it in Session will enable you to access the same variable from anywhere in the site until the session of the user. Means that after you store it in session you can access it in pending-order.php page.
   How to do it: In this page at the top, instead of setting the variables at top write the following:
   

   $SESSION['itemName'] = $_POST['itemName']

   then echo it using:

   echo $SESSION['itemName']

   and then in the pending-order.php you can assign a value to a variable like so:

   $itemName = $SESSION['itemName']

   and now you can store the variable in the db.

2. Put hidden fields inside the form of confirm-order.php page:
   Explaination: Create hidden input fields in confirm-order.php form and set the values that are in the variables. This way when you click the submit button you can access them in pending-order.php in the same way you are doing on confirm-order.php .
   How to do it: Simply put the variables in value attribute of the hidden input like so:

   <form action="pending-order.php" method="post" name="confirmed-order">
<input type="hidden" value="<?php $itemID ?>" id="someID">
</form>

Answer 4

Well we can do this in the following ways

1. You store all the data in session and use it in confirmation page and then on data insertion page. Do remember to update or delete it if user updates or cancel the order.

2. You can dynamically create the confirm order page using javascript and HTML and when user clicks confirm button then only we post it to the PHP page. This will also reduce a server call.

3. One other ways is to again send the collected posted values and keep it as hidden fields in the confirmation page and post it when clicked confirm.

Answer 5

Try

<button type="submit" class="btn btn-primary" NAME="submit">Confirm Order</button>

And use

IF (isset($_POST['submit]) {
$itemName = $_POST['itemName'];
$plan = $_POST['plan'];
$itemID = $_POST['itemID'];
$itemPrice = $_POST['element_3'];
$processService = $_POST['element_8'];
$itemDetails = $_POST['itemDetails'];
$streetAddress = $_POST['streetAddress'];
$City = $_POST['City'];
$State = $_POST['State'];
$PostalCode = $_POST['PostalCode'];
$Phone = $_POST['Phone'];
$Country = $_POST['Country'];
$fullName = $_POST['fullName'];
$Email = $_POST['Email'];
$itemURL = $_POST['itemURL'];
$itemLocalShipCost = $_POST['element_7'];

// your mysql INSERT codes here

}

EDIT 1: change <button type="submit" class="btn btn-primary">Confirm Order</button> TO <input type="submit" class="btn btn-primary" value="Confirm Order">

Answer 6

create a form and store variables in hidden fields , then create this submit button in the form

So clicking this form will store the info. See the exmple here

<form class="form-horizontal well" action="confirm-order.php" method="POST">
   <input type="hidden" value="<?php echo $itemName; ?>" />
   <input type="submit" value="Confirm Order" />
</form>

Answer 7

isset() function work when the input field type is submit.like

<input type="submit" value="Confirm Order" />

so update the code form

<div class="form-actions">
   <button type="submit" class="btn btn-primary">Confirm Order</button>
   <button type="reset" class="btn">Cancel Order</button>
</div>

to

 <div class="form-actions">
   <input type="submit" class="btn btn-primary" value="Confirm Order" />
   <input class="btn" type="reset" value="Cancel Order" />
 </div>