include_once '../incluedes/conn_cms.php';//session started here
if(isset($_GET['submit_post'])){
$date = date('Y-m-d');
$fabric=$_GET['fabric'];
$size=$_GET['size'];
$desenho=$_GET['desenho'];
$numero=$_GET['numero'];
$vari=$_GET['vari'];
$qnty=$_GET['qnty'];
$cost=$_GET['cost'];
$subT=$_GET['subtotal'];
$pedido=$date." ".$_SESSION['userName']."-".$_SESSION['userLName'];
$query = "SELECT * FROM almofadas WHERE id_price='$fabric'";
$result = mysqli_query($conn,$query);
while($rows = mysqli_fetch_assoc($result)){
$tecido=$rows['tecido'];
}
$ins_sql = "INSERT INTO orders (fabric,size,product_quantity,order_id,product_img,product_title,variante,product_cost,product_subtotal)
VALUES ('$tecido', '$size' , '$qnty', '$pedido', '$desenho', '$numero', '$vari', '$cost', '$subT')";
if ($conn->query($ins_sql) === TRUE) {
echo "New record created successfully";
} else {
echo "Error: " ;
}
$conn->close();
}
<form action="postOrder.php" method="GET" enctype="multipart/form-data" class="form-horizontal">
<div class="container">
<div class="row">
<table class="table table-striped table-hover" id="myTable">
<thead>
<h4></h4>
<tr>
<th>Image</th>
<th>Produto</th>
<th>Fabric</th>
<th>Size</th>
<th>Qntd</th>
<th>Cost</th>
<th>sub.total</th>
</tr>
</thead>
<tbody >
<?php cart(); ?>
</tbody>
</table>
<div class="form-group">
<input name="submit_post" class="first" type="submit" >
</div>
</form>
jQuery("input.second").click(function(){
jQuery("input.first").trigger('click');
return false;
});
<?php
include_once '../incluedes/conn_cms.php';//session started here
// YOU MUST NOT USE A GET-METHOD REQUEST TO UPDATE A DATABASE
if(isset($_GET['submit_post'])){
$date = date('Y-m-d');
$fabric=$_GET['fabric'];
$size=$_GET['size'];
$desenho=$_GET['desenho'];
$numero=$_GET['numero'];
$vari=$_GET['vari'];
$qnty=$_GET['qnty'];
$cost=$_GET['cost'];
$subT=$_GET['subtotal'];
$pedido=$date." ".$_SESSION['userName']."-".$_SESSION['userLName'];
// YOU MUST NOT USE EXTERNAL DATA IN A QUERY STRING - IT MUST BE ESCAPED
$query = "SELECT * FROM almofadas WHERE id_price='$fabric'";
$result = mysqli_query($conn,$query);
// YOU MUST NOT USE $result UNTIL YOU HAVE TESTED FOR SUCCESS
while($rows = mysqli_fetch_assoc($result)){
// EACH ITERATION THROUGH THE WHILE LOOP OVERWRITES THE VALUE IN $tecido
$tecido=$rows['tecido'];
}
// YOU MUST NOT USE EXTERNAL DATA IN A QUERY STRING - IT MUST BE ESCAPED
$ins_sql = "INSERT INTO orders (fabric,size,product_quantity,order_id,product_img,product_title,variante,product_cost,product_subtotal)
VALUES ('$tecido', '$size' , '$qnty', '$pedido', '$desenho', '$numero', '$vari', '$cost', '$subT')";
if ($conn->query($ins_sql) === TRUE) {
echo "New record created successfully";
} else {
// YOU MIGHT WANT TO LOG ERROR INFORMATION, SO IT CAN BE USED TO FIX THE ERROR
echo "Error: " ;
}
$conn->close();
}
if(isset($_POST['submit_post']))
{
$stmt = $conn->prepare("INSERT INTO orders (size, desenho, numero) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $size, $desenho, $numero);
foreach ($_POST['product'] as $key => $product) {
extract($product);
$stmt->execute();
}
}
<?php
include_once '../incluedes/conn_cms.php';
if(isset($_POST['submit_post']))
{
$date = date('Y-m-d');
$size = isset($_POST['size']) ? $_POST['size'] : array();
$numero = isset($_POST['numero']) ? $_POST['numero'] : array();
$vari = isset($_POST['vari']) ? $_POST['vari'] : array();
$desenho = isset($_POST['desenho']) ? $_POST['desenho'] : array();
$fabric = isset($_POST['fabric']) ? $_POST['fabric'] : array();
$size = isset($_POST['size']) ? $_POST['size'] : array();
$qnty = isset($_POST['qnty']) ? $_POST['qnty'] : array();
$cost = isset($_POST['cost']) ? $_POST['cost']: array();
$subtotal = isset($_POST['subtotal']) ? $_POST['subtotal'] : array();
$total = isset($_POST['total']) ? $_POST['total'] : array();
$all_products = isset($_POST['all_products']) ? $_POST['all_products'] : array();
$pedido=$date." ".$_SESSION['userName']."-".$_SESSION['userLName'];
$query = "SELECT * FROM almofadas WHERE id_price='$fabric'";
$result = mysqli_query($conn,$query);
while($rows = mysqli_fetch_assoc($result)){
$tecido=$rows['tecido'];
$fabric=$tecido;
}
$stmt = $conn->prepare("INSERT INTO orders (fabric,size,product_quantity,order_id,product_img,product_title,variante,product_cost,product_subtotal)
VALUES ('$fabric', '$size' , '$qnty', '$pedido', '$desenho', '$numero', '$vari', '$cost')");
$stmt->bind_param($fabric, $size , $qnty, $pedido, $desenho, $numero, $vari, $cost);
foreach ($_POST['product'] as $key => $product) {
extract($product);
$stmt->execute();
}
}
i get these errors (the lines match code above)Notice: Array to string conversion in C:\xampp\htdocs\system\clientes\gall ery\postOr der.php on line 20
Notice: Array to string conversion in C:\xampp\htdocs\system\clientes\gall ery\postOr der.php on line 29
Notice: Array to string conversion in C:\xampp\htdocs\system\clientes\gall ery\postOr der.php on line 29
Notice: Array to string conversion in C:\xampp\htdocs\system\clientes\gall ery\postOr der.php on line 29
Notice: Array to string conversion in C:\xampp\htdocs\system\clientes\gall ery\postOr der.php on line 29
Notice: Array to string conversion in C:\xampp\htdocs\system\clientes\gall ery\postOr der.php on line 29
Notice: Array to string conversion in C:\xampp\htdocs\system\clientes\gall ery\postOr der.php on line 29
Notice: Array to string conversion in C:\xampp\htdocs\system\clientes\gall ery\postOr der.php on line 29
Fatal error: Uncaught Error: Call to a member function bind_param() on boolean in C:\xampp\htdocs\system\clientes\gall ery\postOr der.php:30 Stack trace: #0 {main} thrown in C:\xampp\htdocs\system\cli entes\gall ery\postOr der.php on line 30
$date = date('Y-m-d');
$size = isset($_POST['size']) ? $_POST['size'] : array();
$numero = isset($_POST['numero']) ? $_POST['numero'] : array();
$vari = isset($_POST['vari']) ? $_POST['vari'] : array();
$desenho = isset($_POST['desenho']) ? $_POST['desenho'] : array();
$fabrics= isset($_POST['fabric']) ? $_POST['fabric'] : array();
$size = isset($_POST['size']) ? $_POST['size'] : array();
$qnty = isset($_POST['qnty']) ? $_POST['qnty'] : array();
$cost = isset($_POST['cost']) ? $_POST['cost']: array();
$subtotal = isset($_POST['subtotal']) ? $_POST['subtotal'] : array();
$total = isset($_POST['total']) ? $_POST['total'] : array();
$all_products = isset($_POST['all_products']) ? $_POST['all_products'] : array();
$pedido=$date." ".$_SESSION['userName']."-".$_SESSION['userLName'];
foreach ($fabrics as $fabric)
{
$index = array_search($fabric, $fabrics);
$query = "SELECT * FROM almofadas WHERE id_price='$fabrics[$index]'";
$result = mysqli_query($conn,$query);
while($rows = mysqli_fetch_assoc($result)){
$tecido=$rows['tecido'];
}
$ins_sql = "INSERT INTO orders (fabric,size,product_quantity,order_id,product_img,product_title,variante,product_cost,product_subtotal)
VALUES ('$tecido', '$size[$index]' , '$qnty[$index]', '$pedido', '$desenho[$index]', '$numero[$index]', '$vari[$index]', '$cost[$index]', '$subtotal[$index]')";
if ($conn->query($ins_sql) === TRUE) {
echo "New record created successfully";
} else {
echo "Error: " ;
}
}
$conn->close();
my <td> tags with names[]I don't understand
so i used hidden inputs to hold some data,What data?
because ajax can get the values from my <td> tags correct?AJAX is a means for communicating with the server - it is a bit of a misnomer as it standards for Asynchronous Javascript and XML - we don't use XML much mostly JSON so should probably be named AJAJ?.
<td name="qnty[]" class="product'.$id.' " value="'.$value.'">'.$value.'</td>
<input type="hidden" name="qnty[]" value="'.$value.'"/>
1. Your While statement does not have a closing }
2. Look at this code
Open in new window
<options> don't have a name attribute3. You appear to be looping through your products creating the table but using the same names each time around (see below)
4. You are using $_GET - not a good idea - there is a limit on the length of a URL (GET) - which could become problematic if you have a lot of products you are moving. It also means your submission is not safe if you submit twice - you can end up adding product twice
5. You are not santizing your form variables - trusting that
a) they are present
b) They contain valid data
Is a security watchit
You should consider making your form variables arrays
Open in new window
Instead ofOpen in new window
That way when you doOpen in new window
$size will be an array of sizes$size[0] will be the size for product 1
$size[1] will be the size for product 2
etc
Example
Look at this example to see what is in the $_POST using arrays as form variables
http://www.marcorpsa.com/ee/t1737.html