|
Hello I recently created a module for my site with an accompanying form. I would like to know if anyone knew how i could validate my form before I send the data to the database.
Below is the code for my module: (Currently it takes whatever information the user enters and upon the clicking 'submit' the information is sent to the database)
[code]
<?php
class userForm
{
function index()
{
section_content('
<form>
Gender
<input type="radio" name="gender" value="male" /> Male
<input type="radio" name="gender" value="female" /> Female <br/>
First Name <br/>
<input type="text" name="firstName"><br/>
Last Name <br/>
<input type="text" name="lastName"><br/>
City<br/>
<input type="text" name="city"><br/>
State<br/>
<input type="text" name="state"><br/>
Ethnicity<br/>
<input type="text" name="ethnicity"><br/>
Feet<br/>
<input type="text" name="feet"><br/>
Inches<br/>
<input type="text" name="inches"><br/>
Age<br/>
<input type="text" name="age"><br/>
Earrings <br/>
<input type="radio" name="earrings" value="Y" /> Yes
<input type="radio" name="earrings" value="N" /> No <br/>
Tattoos<br/>
<input type="radio" name="tattoos" value="Y" /> Yes
<input type="radio" name="tattoos" value="N" /> No <br/>
<input type="submit" name="Submit" value="Submit">
</form>
');
}
}
?>
<?php
$link = mysqli_connect(
'localhost', / The host to connect to /
'user', / The user to connect as /
'password', / The password to use /
'database'); / The database to query /
if (!$link)
{
printf("Can't connect to MySQL Server. Errorcode: %s\n", mysqli_connect_error());
exit;
}
if(isset($_GET['Submit']))
{
$userId = client('fullname');
$firstName = mysql_real_escape_string($_GET['firstName']);
$lastName = mysql_real_escape_string($_GET['lastName']);
$gender = mysql_real_escape_string($_GET['gender']);
$age = mysql_real_escape_string($_GET['age']);
$feet = mysql_real_escape_string($_GET['feet']);
$inches = mysql_real_escape_string($_GET['inches']);
$ethnicity = mysql_real_escape_string($_GET['ethnicity']);
$tattoos = mysql_real_escape_string($_GET['tattoos']);
$earrings = mysql_real_escape_string($_GET['earrings']);
$city = mysql_real_escape_string($_GET['city']);
$state = mysql_real_escape_string($_GET['state']);
$query = "insert into database values ('','$userId','$firstName','$lastName','$gender','$age','$feet','$inches','$ethnicity','$tattoos','$earrings','$city','$state')";
mysql_query($query);
}
?>
[/code] |
