php form transfer to second page using header location method and back

Question

okay guys..

i have two pages

page1 contains a form

<form id="Form1" name="Form1" method="post" action="form1.php">
    //form1.php is the page1 where this form is.. i have redirected to the
    same page because this page contains the php validation code <input
        type="text" class="input" name="txtName"
        value="<?php if(isset($name)){echo $name;} ?>"
        <?php if(isset($flag) && $flag == 1){echo "div style = 'border:2px solid red;'". "/div";}?>>
    <input type="submit" name="submit" value="Submit" class="button3">
</form>

I send the data to page2 using php header-location method

php page1 code

if(NO ERRORS)) // in the form there is actual code
{
    // insert into database
    $result = mysql_query ( $insert );
    if ($result) {
        echo ("<br>Input data is succeed");
        $lastInsertedId = mysql_insert_id ();
        header ( 'Location:form1_conf.php?id=' . $lastInsertedId ); // form1_conf.php is the name of 2nd page
    } else {
        $message = "The data cannot be inserted.";
        $message .= "<br />" . mysql_error ();
    }
}

now comes page2

the page2 name is form1_conf.php & is used to display the form data to user so that he may check the form for error and if anything is wrong he can click on edit and go back to main form (page1) and re-enter the data and resubmit the form.

here is the page2 code

here i use php to receive the data from page1 as:

if (isset ( $_GET ['id'] )) {
    $lastInsertedId = $_GET ['id'];
}
$query = "SELECT * FROM db_purchase_form WHERE id=$lastInsertedId";
$result = mysql_query ( $query );
while ( $row = mysql_fetch_row ( $result ) ) {
    $name = $row [1];
}

and here is the html code to display this

<div id="DisplayForm">
    <div class="dispText">
    <?php echo $name; ?>
    </div>
</div>

<a
    href="form1.php?id=<?php echo $lastInsertedId; ?>&name=<?php echo $name; ?>"
    class="button3">Edit</a>

Now when user cliks on this Edit button on page2 he is taken to page1.

Now i have two questions

1. when user clicks on edit and reaches back to page1, the field of name is vacant, while i already have used the php code to fill the data in that name field.

copied from above, form1 page1 code.

<input type="text" class="input" name="txtName" value="<?php if(isset($name)){echo $name;} ?>"<?php if(isset($flag) && $flag == 1){echo "div style = 'border:2px solid red;'". "/div";}?>> 

how can i achieve this? that when user clicks on edit and reaches back to page1 then he can see the value he filled earlier in that form1 stays in the form field.

1. when the user is transferred to page2, after he submits the form, the url of page2 is somehting like this..

   http://mydomainnane.com/site1/form1_conf.php?id=36

now the issue is this when i change the value from 36 to any number say 34 or 24, those values are pulled out from db which are on that location and is displayed. How can i prevent this unauthorized view of DB values by just changing the values in url?

Thanks a lot for all your help guys.

Answer 1

In form1.php define at the top:

if(isset($GET['name']) && $GET['name'] != ""){
    $name = $GET['name'];    
}