I am trying to get this form to work properly and right now it seems to be working.
However I was told I needed to validate data that is being input so as to be protected by a MySQL injection - using this mysql_real_escape_string()
Not quite sure how to insert the code properly - need some pointers on that one.
Also I have the form on my WAMP server and each time I load the form it has the previous test data that I input - can this be solved by issuing a Session?
There are a lot of session functions and I am not sure which one would satisfy my purposes.
session_id
session_start ?? Not quite sure on this one.
Also, if anyone would like to make suggestions about how to make this form 100% secure or better coding - I am up for learning PHP which is quite new to me.
<form action="update.php" method="post">
<p>City:<br/>
<input type="text" name="city" size="30" /></p>
<p>Property Type:<br/>
<select name="type">
<option value="Single Family Home">Single Family Home</option>
<option value="Condo">Condo</option>
<option value="Duplex">Duplex</option>
<option value="Multi-Unit">Multi-Unit</option>
<option value="Rental">Rental</option>
</select></p>
<p> Radius:<br/>
<select name="radius">
<option value="5 miles">5</option>
<option value="10 miles">10</option>
<option value="15 miles ">15</option>
<option value="20 miles">20</option>
<option value="25 miles">25</option>
</select></p>
<p> Price Range:<br/>
<select name="price">
<option value="under $200,000">Under $200,000</option>
<option value="$200,000 - $300,000">$200,000 - $300,000</option>
<option value="$300,001 - $400,000">$300,001 - $400,000</option>
<option value="$400,001 - $500,000">$400,001 - $500,000</option>
<option value="Over $500,000">Over $500,000</option>
</select></p>
<p> Number of Bedrooms:<br/>
<select name="bedrooms">
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5 or more</option>
</select></p>
<p> Number of Bathrooms:<br/>
<select name="bathrooms">
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5 or more</option>
</select></p>
<p> Garage Parking Preference:<br />
<select name="parking">
<option value="yes">Yes</option>
<option value="no">No</option>
</select>
</p><br />
<p>Please give some details on your ideal property. This can include features of your ideal home including near an elementary school,<br/>
parks, Close to Shopping. Feel free to describe anything you would like in the home that has not been covered.<br />
<textarea name="details" rows="20" cols="100" wrap="virtual" /></textarea></p>
<p>First name:<br/>
<input type="text" name="firstname" size="40" /></p>
<p>Last name:<br/>
<input type="text" name="lastname" size="40" /></p>
<p>email address:<br/>
<input type="text" name="email" size="40" /></p>
<p>Phone Number<br/>
<input type="text" name="phone" size="40" /></p>
<p><input type="submit" value="Send feedback" /></p>
</form>
//PHP
<?php
error_reporting(E_ALL ^ E_NOTICE);
?>
<?php
$city = $_POST['city'];
$radius = $_POST['radius'];
$type = $_POST['type'];
$price = $_POST['price'];
$bedrooms = $_POST['bedrooms'];
$bathrooms = $_POST['bathrooms'];
$parking = $_POST['parking'];
$details = $_POST['details'];
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$email = $_POST['email'];
$phone = $_POST['phone'];
// 1. Create a database connection
$connection = mysql_connect("localhost", "root", "maven777");
if(!$connection){
die("Database connection failed: " .mysql_error());
}
// 2. Select a database to use
$db_select = mysql_select_db("homesloans", $connection);
if(!$db_select){
die("Database selection failed: " .mysql_error());
}
$query="INSERT INTO leads (leadid, city, radius, type, price, bedrooms,
bathrooms, parking, details, firstname, lastname, email, phone)
VALUES('NULL', '[$city]', '[$radius]', '[$type]', '[$price]', '[$bedrooms]',
'[$bathrooms]', '[$parking]', '[$details]', '[$firstname]', '[$lastname]', '[$email]', '[$phone]')";
mysql_query($query) or die ('Error updating database');
echo "Database Successfully Updated.";
?>
