Keskustelu: Nettisivujen teko: $_POST ja php

<?php
require("config.php");
$db = mysql_connect($dbhost, $dbuser, $dbpassword);
mysql_select_db($dbdatabase, $db);
if($_POST['submit']) {
    input_clean();
    $potilas=$_SESSION['ASIAKAS'];
    //$cat=$_POST['cat'];
    if (empty($_POST['subject']))
        $error['subject'] = 'Aihe ei voi olla tyhjä';
    if (empty($_POST['body']))
        $error['body'] = 'Merkintä ei saa olla tyhjä';
    if(!isset($error)){/*
            escapestrings();
            //extract($_POST);
            //$sqltime=gmdate(date("Y-m-d H:i:s"));
            $sqltime=date("Y-m-d H:i:s");
            //$setzonesql="SET time_zone = '+3:00';";
            //$setzonesql="SET SESSION time_zone = 'Europe/Helsinki';";
            $sql = "INSERT INTO entries(pat_id, cat_id, dateposted, subject, body)VALUES('$potilas', '$cat', '$sqltime', '$subject', '$body');";
            //mysql_query($setzonesql);
            //$sql = "INSERT INTO entries(pat_id, cat_id, dateposted, subject, body)VALUES(" .$_SESSION['POTILAS'] . ", " . $_POST['cat'] . ", NOW(), '" . $_POST['subject'] . "', '" . $_POST['body'] . "');";
            //$sql = "INSERT INTO entries(pat_id, cat_id, dateposted, subject, body)VALUES(" .$_SESSION['POTILAS'] . ", " . $_POST['cat'] . "', '" . $entrytime . "', '". $_POST['subject'] . "', '" . $_POST['body'] . "');";
            mysql_query($sql);
            header("Location: " . $config_basedir);
    */}
}
	require("header.php");
    $potilas=$_SESSION['POTILAS'];
$nimisql="SELECT patient.pat_sukunimi, patient.pat_id, patient.pat_etunimet FROM patient WHERE pat_id=$potilas;";
$result=mysql_query($nimisql);
$rivi=mysql_fetch_assoc($result);

?>

<h1>Tee uusi merkintä asiakkaalle: <?php echo $rivi['pat_sukunimi']," ",$rivi['pat_etunimet'];echo $entrytime=date("Y-m-d H:i:s");?> </h1>
<form action="<?php echo $SCRIPT_NAME ?>" method="post">
<table>
<tr>
	<td>Kategoria</td>
	<td>
	<select name="cat">
	<?php
		$catsql = "SELECT * FROM categories;";
		$catres = mysql_query($catsql);
		while($catrow= mysql_fetch_assoc($catres)) {
			echo "<option value='" . $catrow['cat_id']. "'>" . $catrow['cat'] . "</option>";
		}
	?>
	</select>
	</td>
</tr>
<tr>
	<td>Aihe:</td>
	<td><input type="text" name="subject" <?php if (isset($error)) echo "value='$subject'";?>></td>
    <td <?php if (isset($error['subject'])){echo "class=\"warning\">". $error['subject'];
    }?></td>
</tr>
<tr>
	<td>Merkintä</td>
	<td><textarea name="body" rows="10" cols="50"><?php if (isset($error)){echo $body;}?></textarea></td>
    <td <?php if (isset($error['body'])){echo "class=\"warning\">". $error['body'];
        }?></td>
</tr>
<tr>
	<td></td>
	<td><input type="submit" name="submit" value="Lisää merkintä"></td>
</tr>
</table>
</form>

<?php
require("dump_vars.php");
require("footer.php");
?>

<?php
function input_clean(){
    foreach ($_POST as $key => $arvo){
        $_POST[$key]=trim($arvo);
    }
    foreach ($_GET as $key => $arvo){
        $_GET[$key]=trim($arvo);
    }
    foreach ($_COOKIE as $key => $arvo){
        $_COOKIE[$key]=trim($arvo);
    }
    foreach ($_REQUEST as $key => $arvo){
        $_REQUEST[$key]=trim($arvo);
    }
}
function escapestrings(){
    if(get_magic_quotes_gpc()){
        $_GET=array_map('stripslashes', $_GET);
        $_POST=array_map('stripslashes', $_POST);
        $_COOKIE=array_map('stripslashes', $_COOKIE);
        $_REQUEST=array_map('stripslashes', $_REQUEST);
    }
    foreach ($_POST as $key => $arvo){
        $_POST[$key]=mysql_real_escape_string($arvo);
    }
    foreach ($_GET as $key => $arvo){
        $_GET[$key]=mysql_real_escape_string($arvo);
    }
    foreach ($_COOKIE as $key => $arvo){
        $_COOKIE[$key]=mysql_real_escape_string($arvo);
    }
    foreach ($_REQUEST as $key => $arvo){
        $_REQUEST[$key]=mysql_real_escape_string($arvo);
    }
}
?>

<?php
if($_POST['submit']) {
    input_clean();
    extract($_POST);
    if (empty($cat))
        $error['cat']='laita kategoralle nimi';
//käydään kaikki läpi ja jos kelpaa
if (!isset($error)){
    escapestrings();
    extract($_POST);
	$sql = "INSERT INTO categories(cat) VALUES('$cat');";
	$result=mysql_query($sql)
    or die (mysql_error());
    //header("Location: " . $config_basedir . "viewcat.php");
    }
?>