php form issues

Question

I have a form with which I am trying to display a form with checkboxes, and then insert into a database whether or not those checkboxes are checked. Then, each time the page is called, check the value and append information to the html form to appropriate display the checkbox as checked or not.

I have modified the below code example to make it short, and I am aware that I am assigning the checked value to 'value', which won't do anything.

The approach of

<input type="checkbox" name="notice"  value="checked" checked/>

to display a checkbox as checked, while not valid html, works in every browser, and is based on the example here. I would prefer to stick with this approach.

Now, I don't see what is wrong with my code.

The first steps should be to retrieve the values from the database, of which onyl one row will be retrieved, as article_no is a primary key. If nothing is retrieved, then the variables are simply assigned "", which results in the checkbox being unchecked.

As the value is checked, if it is selected, this should be inserted into the database, and will show as checked upon next viewing of the page.

Now, as it is, this code compeltely fails. firebug does not show anything being sent or received in the console, no erros are recorded either with php or mysql, nothing appears in the database despite the fields and such being correct, no mysql errors are reported...

What is the problem?

The code:

<?php

error_reporting(E_ALL);
if (isset($_GET["cmd"]))

  $cmd = $_GET["cmd"];

else
if (isset($_POST["cmd"]))

  $cmd = $_POST["cmd"];


  if (isset($_GET["pk"]))

  { $pk = $_GET["pk"];}
  if (isset($_POST["deleted"]))
  { $deleted = $_POST["deleted"];}
  if (isset($_POST["notice"]))
  { $notice = $_POST["notice"];}

$con = mysqli_connect("localhost","user","pass", "db");

if (!$con) {

   echo "Can't connect to MySQL Server. Errorcode: %s\n". mysqli_connect_error();

   exit;

}
$con->set_charset("utf8");
$getformdata = $con->query("select * from TEST where ARTICLE_NO = '$pk'");

$checkDeleted = "";
$checkNotice = "";


  while ($row = mysqli_fetch_assoc($getformdata))

  {

    $checkDeleted = $row['deleted'];

    $checkNotice = $row['notice'];

   } 
if($cmd=="submitinfo"){
$statusQuery = "INSERT INTO TEST VALUES (?, ?, ?)";

if ($statusInfo = $con->prepare($statusQuery)) {

    $statusInfo->bind_param("sss", $pk, $deleted, $notice);

   $statusInfo->execute();

   $statusInfo->close();
} else {

print_r($con->error);

}
}

echo "<form name=\"statusForm\" action=\"x.php\" method=\"post\" enctype=\"multipart/form-data\">

<h1>Editing information for auction: ".$pk."</h1>
Löschung Ebay:
<input type=\"checkbox\" name=\"deleted\" value=\"checked\" ".$checkDeleted." align=\"right\"/>
<br />
Abmahnung:
<input type=\"checkbox\" name=\"notice\"  value=\"checked\" ".$checkNotice."  align=\"left\"/>
<br />
<input type=\"hidden\" name=\"cmd\" value=\"submitinfo\" />
<input name=\"Submit\" type=\"submit\" value=\"submit\" />
</form>";

In the actual form/page, I have appropriate sanitization in place.

A big problem is that nothing is being inserted into the database and no errors are being returned at all!

Answer 1

It's important to remember that unchecked checkbox does not contribute any values to a form when it is sent. When the deleted box is unchecked, there is no $_POST['deleted'] value set.

With that in mind, it looks like you don't actually set the value of $deleted if the checkbox is cleared. Use an idiom like this.

$deleted = isset($_POST["deleted"]) ? 1: 0;

Substitute the 1 and 0 with whatever values you want in your database table for the checked and unchecked states (in your case, "checked" and "")

Answer 2

I thought checkboxes should be done this way:

<input type="checkbox" name="notice1"  value="value1" checked="checked"/>
<input type="checkbox" name="notice2"  value="value2" checked="checked"/>

Answer 3

Along the same lines as Paul Dixon's answer, I've done this at times:

<input type="hidden" name="notice" value="not checked" />
<input type="checkbox" name="notice" value="checked" checked="checked" />

If the user unchecks the checkbox, the hidden input's value gets sent instead. This way, $_POST['notice'] is always sent to your script.