PHP Checkbox Form Validation with SQL

Question

I have mySQL table containing rows of user reviews of films. All columns a are functional except for the 'liked' column. The 'liked' column is a boolean value. This

The table must be displayed on my website, converting the boolean to a 'yes' or 'no'. Here is the code for the table:

while($review = $reviews->fetch_object("Review")) {
    $liked =  $review->liked;
    $convert = ($liked) ? 'yes' : 'no' ;
    echo "<tr> <td>{$review->reviewer} </td> ";
    echo "<td>{$review->comment} </td>";
    echo "<td> $convert </td></tr>";

As you can see the conversion is functional.

The page also contains a form where users can submit their reviews. Using a checkbox, users 'check' if they like the film, or don't check if they don't.

<div class="form-group">
                    <label for="liked" class="col-xs-2 c">Did you like this film?:</label>
                    <div class="col-xs-10">
                    <input name="liked" type="checkbox" value="1" > Tick yes if you did
                    </div>
                </div>

In a seperate PHP file; 'Process-review', I use an INSERT query to insert new rows into the table.

if(isset($_POST['name']) && isset($_POST['comment']) && isset($_POST['film_id']))
{
$reviewer = $_POST['name'];
$comment = $_POST['comment'];
$film_id = $_POST['film_id'];
    if(isset($_POST['liked']))
    {
    $liked = $_POST['1'];
    }
    else 
    {
    $liked = $_POST['0'];
    }

$db->query("INSERT INTO review (film_id, reviewer, liked, comment) VALUES('$film_id', '$reviewer', '$liked', '$comment')");
header('Location: show-film.php?id='.$film_id);
}
else{       
    $name = null;
    echo "no name supplied";
}

All other fields work except for the 'liked' field. As you can see I have tried using an if statement within the initial if statement to return a '1' if the checkbox is ticked and '0' if the checkbox isn't ticked. Yet when I check the box, the table still returns a 'no'. Even if i change the $convert so both values are 'yes' it still returns no which begs the question where is it getting the 'no' from.

Here is an image of the table to give you a visual representation of what I'm working with here

meda · Accepted Answer · 2016-01-05 14:48:54Z

1

You're trying to insert values that don't exist.

Replace your if condition with:

if(isset($_POST['liked']) && $_POST['liked'] == 1)
{
$liked = 1;
}
else 
{
$liked = 0;
}

Aside from that, you're opening yourself up to an injection attack.

You should use prepared statements.

At the very least run every variable you're passing to the database through mysqli_real_escape_string.

edited Jan 5, 2016 at 14:48

meda

45.5k14 gold badges96 silver badges123 bronze badges

answered Jan 5, 2016 at 14:38

Geoff Atkins

1,7031 gold badge17 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP Checkbox Form Validation with SQL

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related