PHP - get checkbox value and change it if checked in database

Question

Table

id  name            level   delete_user

1   visitor         1       N
2   user            2       N
3   moderator       3       N
4   administrator   4       Y

Then I fetch array from database:

$groups = array (
    array ( 'id' => 1, 'name' => 'visitor', 'level' => 1, 'delete_user' => 'N'),
    array ( 'id' => 2, 'name' => 'user', 'level' => 2, 'delete_user' => 'N'),
    array ( 'id' => 3, 'name' => 'moderator', 'level' => 3, 'delete_user' => 'N'),
    array ( 'id' => 4, 'name' => 'administrator', 'level' => 4, 'delete_user' => 'Y')
);

Then I create simple FORM to show actual settings of groups.

<form action="" method="post">
    <table class="groups">
        <thead>
            <tr>
                <td>name</td>
                <td>level</td>
                <td>delete user</td>
            </tr>
        </thead>
        <tbody>
            <?php foreach ($groups as $group) { ?>
                <?php 
                    $checkbox['delete_user_' . $group['id']] = 'N';
                    $checked = ($group['delete_user'] === 'Y') ? 'checked="checked"' : '';
                ?>    
                <tr>
                    <td><?php echo $group['name']; ?></td>
                    <td><?php echo $group['level']; ?></td>
                    <td>
                        <input type="checkbox" name="delete_user_<?php echo $group['id']; ?>" <?php echo $checked; ?> value="Y">
                    </td>
                </tr>
                <?php
            }
            ?>
        </tbody>    
    </table>
    <input type="submit" name="save_groups" value="Save" class="save_button">
</form>

Question: How to check if checkbox checked or not, and if checked then change it in database?

My work:

This is raw idea, but not pretty ...

<?php
if (isset($_POST['save_groups'])) {

    foreach ($_POST as $k => $v) {
        if (array_key_exists($k, $checkbox)) {
            $checkbox[$k] = $v;
        }
    }
    echo 'NEW';
    print_r($checkbox);
    echo '<hr>';
    foreach($checkbox as $k => $v) {
        $id = str_replace('delete_user_', '', $k);
        echo 'changing '. $id . ' to '. $v. '<br>';
        // changing value
        /**
         * $id int - id of group
         * $v string - value in delete_user ('Y' / 'N')
         */
        $this->change_value($id, $v);
    }

}

Answer 1

While unchecked checkboxes will not be serialized during form submission, you can simply take advantage of this very common trick:

To determine whether checkbox is checked or not, you can prepend <input type="hidden" /> before a checkbox itself, like this:

<input type="hidden" name="foo" value="0" />
<input type="checkbox" name="foo" value="1" />

So if a checkbox is checked, $_POST['foo'] will contain 1 , and if its not checked, then $_POST['foo'] will contain 0

Answer 2

One approach would be to make the checkbox into an array and change it so it returns the group ID, not just a "Y". UPDATE : Based on Anthony's comment below, you need to track the existing check state too:

<td>
    <?php if ($group['delete_user'] === 'Y') { ?>
    <input type="hidden" name="existing[]" value="<?php echo <?php echo $group['id']; ?>">
    <?php } ?>
    <input type="checkbox" name="delete_user[]" <?php echo $checked; ?> value="<?php echo <?php echo $group['id']; ?>">
</td>

Now all you have to do in your POST code is:

<?php
$previously_checked = $_POST['existing'];
$group_ids = $_POST['delete_user'];
$updated_state = array();

// Check if previously-selected checkbox has been unchecked
foreach($previously_checked as $group_id) {
   if (!in_array($group_id, $group_ids)) {
      $updated_state[] = array('group_id' => $group_id, 'delete_user' => 'N');
   }
}
// Check for currently-selected checkbox was previously unchecked
foreach($group_ids as $group_id) {
   if (!in_array($group_id, $previously_checked)) {
      $updated_state[] = array('group_id' => $group_id, 'delete_user' => 'Y');
   }
}

// Do the update...

Answer 3

Don't do what @Scorpion, @Ken, or what I wrote earlier. Simply give all your checkbox input controls their own name based on the id (primary key) (like you started out doing) and during your input validation, use isset($_POST['yourKeyHere']) to detrmine if the record's checkbox has been successfully submitted or not. If so, run a "positive" UPDATE on the associated record. If not, run a "negative" update on the record. Simple and sweet, if not a bit wasteful. This method does not compromise the security of your form application, but it may run unnecessary updates on your table (because the field is already either 'N' or 'Y').

You don't want to invite people to submit garbage to your app. Oh, there's a way to do that simply by changing the HTML, but when the checkbox is unchecked, I do not want my backend to receive anything for that input control!