PHP - PDO - Form Validation - Insert statement gets executed even when errors exist

Question

I didn't notice it until I finished the validation but I realized that even when my errors appear on top of my form box I then go to phpmyadmin and I look at the data, and even if I purposely added errors the form will be submitted.

Then my second problem including the one stated above, no matter what I do the student Id or "anum" is not posting. it continues to give me a "0" value in the students table in my database.

This is the entire code:

 9) {
            $errors[] = 'A number is incorrect!';
        }
        if (ctype_alpha($first) === false) {
            $errors[] = 'First mame must only contain alphabetical characters!';
        }
        if (ctype_alpha($last) === false) {
            $errors[] = 'Last name must only contain alphabetical characters!';
        }
        if (empty($why))
            $errors[] = 'Please make sure to select the proper reasoning for your vistit today!';

        elseif ($why === 'Other') {

            if (empty($comments))
                $errors[] = 'Please explain the nature of your visit in the comments box!';

            else {

                if (strlen($comments) < 15)
                    $errors[] = 'Your explaination is short, please revise!';

                if (strlen($comments) > 45)
                    $errors[] = 'Your explaintion is to long, please revise!';

            }

        }

        if (empty($errors) === false) {
            header('location: signedin.php');
            exit();
        }

        // Validations ends here

        $host     = "localhost"; // Host name
        $username = "root"; // Mysql username
        $password = "testdbpass"; // Mysql password
        $db_name  = "test"; // Database name

        // Connect to server via PHP Data Object
        $dbh = new PDO("mysql:host=localhost;dbname=test;", $username, $password);
        $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        try {
            $query = $dbh->prepare("INSERT INTO `students` (anum, FIRST, LAST, why, comments)
                                   VALUES (:anum, :FIRST, :LAST, :why, :comments)");

            $query->execute(

                array(
                    'anum'     => $_POST['anum'],
                    'first'    => $_POST['first'],
                    'last'     => $_POST['last'],
                    'why'      => $_POST['why'],
                    'comments' => $_POST['comments']
                ));
        } catch (PDOException $e) {
            error_log($e->getMessage());
            die($e->getMessage());
        }
        $dbh = null;

    }

}
?>



Student Signin Form
';
            foreach ($errors as $error) {
                echo '', $error, '';
            }

            echo '';
        }
        ?>
    
        

    
        
            Student Signin FormStudent ID Number:  />

                
First Name:  />

                
Last Name:  />

                
How may we help you? 
                    


                    


                
If other please describe the issue you are having.
>

Rixhers Ajazi · Accepted Answer

After more digging up and more understanding of what I was actually doing (the wrong way) I came up with my solution. Pretty much I had to make it so that the Mysql insert statements were a part of the error validation not stand-a-lone. If you look at my prior code the PDO statements had no real place in the code, it was just there. The cause of this was

if (empty($errors) === false) {
        header('location: signedin.php');
        exit();
    }

What this was doing was even if there were errors I had to still redirect to the "signedin.php" that is not the desired affect. What had to be done was first change it from false to true.

if (empty($errors) === true) {
        header('location: signedin.php');
        exit();
    }

Then after doing so you must then input your PDO statements in between the {}.

So then what this means is that if the script has picked up errors it will NOT run the PDO insert.

However if it is TRUE that there are no errors it will run the insert script with a error check for that script, then if it inserts correctly it will then redirect the user to the next page.

Example :

if (empty($errors) === true) 
{
            $host="localhost"; // Host name
            $username="root"; // Mysql username
            $password="testdbpass"; // Mysql password
            $db_name="test"; // Database name


            $dbh = new PDO("mysql:host=localhost;dbname=test;", $username, $password);
            $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

                    try 
        {
                            $query = $dbh->prepare("INSERT INTO `students` (anum, first, last, why, comments) 
                                   VALUES (:anum, :first, :last, :why, :comments)");

                            $query->execute(
                                                array(
                                                        'anum'      => $_POST['anum'],
                                                        'first'     => $_POST['first'],
                                                        'last'      => $_POST['last'],
                                                        'why'       => $_POST['why'],
                                                        'comments'  => $_POST['comments']
                                                        )); 
        }
                catch (PDOException $e) 
        {
                error_log($e->getMessage());
                die($e->getMessage());
        }
   $dbh = null;    

        header('location: signedin.php');
        exit(); 
}

Hopefully some one will find this of any use.

PHP - PDO - Form Validation - Insert statement gets executed even when errors exist

Answers (2)

Related Questions