Error with Inserting Data Into a Database Using a HTML Form

Question

I am attempting to create a website in which an admin can view details about customers who shop at the store. The homepage lists the names of all of the customers, and when clicked, each name is directed to a page called CustomerDetails.php which provides more details about that particular customer. I am attempting to write some code which allows the admin to add notes to a particular customer. The two tables are as follows:

 CREATE TABLE PHPNotes(
 NoteID INT,
 NoteContent VARCHAR(100) NOT NULL,
 CustomerID INT,
 FOREIGN KEY (CustomerID) REFERENCES CustomerEnrolment(CustomerID),
 PRIMARY KEY(NoteID))ENGINE=InnoDB;

 CREATE TABLE CustomerEnrolment(
 CustomerID INT,
 Name VARCHAR(30),
 Email VARCHAR(30),
 PhotoURL VARCHAR(30),
 PRIMARY KEY(CustomerID)) ENGINE=InnoDB;

I am attempting to take data from a form (shown below) and insert this particular data into the database. However I am told there are errors with the code that I have written.

 <?php 

 $Name = $_GET['Name']; 
 $CustomerID = $_GET['CustomerID'];
 $sql1 ="SELECT * FROM CustomerEnrolment WHERE CustomerID='$CustomerID'";
 $sql2 ="SELECT c.*, e.CustomerID FROM CustomerNotes c, CustomerEnrolment e WHERE e.CustomerID=n.CustomerID AND Name='$Name'" ;


 if(! get_magic_quotes_gpc() ) {
    $NoteContent = addslashes ($_POST['NoteContent']);
 }

 else {
     $NoteContent = $_POST['NoteContent'];
 }

 $NoteID = $_POST['NoteID'];          
 $sql = "INSERT INTO CustomerNotes ". "(NoteID,NoteContent,CustomerID) ". "VALUES('$NoteID','$NoteContent','$CustomerID')";
 $result = mysql_query($sql);

 if(! $result ) {
    die('Could not enter data: ' . mysql_error());
 }

 echo "Entered data successfully\n"; 

 ?>

 <p> Add New Customer Record </p>   

 <form method = "post" action = "<?php $_PHP_SELF ?>">
 <table id="Add Record">
 <tr> <td> Note ID </td> 
 <td> <input name = "NoteID" type="text" id="NoteID"></td>
 <td> <input name = "NoteContent" type="text" id="NoteContent"></td> </tr>
 <tr> <td>  <input type="hidden" name="CustomerID" value="$CustomerID"></td> </tr>
 <tr> <td> <input name = "Add Customer Note" type = "submit" id = "Add Customer Note"  value = "Add Customer Note"> </td> </tr>
 </table>
 </form>

The errors are :

 Notice: Undefined index: CustomerID 
 Notice: Undefined index: NoteContent
 Notice: Undefined index: NoteID 
 Could not enter data: Duplicate entry '0' for key 'PRIMARY'

Some advice as to where I am going on would be great!

Answer 1

One thing - your query has issues - it should be :

 $sql = "INSERT INTO CustomerNotes (NoteID,NoteContent,CustomerID) VALUES('".$NoteID."','".$NoteContent."','".$CustomerID."')";

and the same could be said for your first 2 queries as well.

And you are mixing php and html and not in a good way :))

<tr> 
   <td>  
      <input type="hidden" name="CustomerID" value="$CustomerID">
   </td> 
</tr>

should be :

<tr> 
   <td>  
      <input type="hidden" name="CustomerID" value="<?php echo $CustomerID; ?>">
   </td> 
</tr>

Also you are not closing your inputs - they should be like?

<input name = "NoteID" type="text" id="NoteID" />

and also - given that noteID is your primary key - you should consider having this autoincrement and therefore you wouldn't need to have any input called "noteID" - cos without autoincrementation you need a validation mechanism to check that there is not already a note in there with that id.

Answer 2

Use POST function,

$Name = $_POST['Name']; 

Your form is used POST method.

Answer 3

Another issue you may have:

<tr> <td>  <input type="hidden" name="CustomerID" value="$CustomerID"></td> </tr>

If you want to display the var $CostumerID you should use php tags <?php $CostumerID ?> or <?= $CostumerID ?> .

Answer 4

1) Change

 $sql = "INSERT INTO CustomerNotes ". "(NoteID,NoteContent,CustomerID) ". "VALUES('$NoteID','$NoteContent','$CustomerID')";

To

$sql = "INSERT INTO CustomerNotes(NoteID,NoteContent,CustomerID) VALUES('$NoteID','$NoteContent','$CustomerID')";

2) Change

<input type="hidden" name="CustomerID" value="$CustomerID">

To

<input type="hidden" name="CustomerID" value="<?php echo $CustomerID;?>">