Re: [SLUG] hacking at php: how to set a variable

[Peter Rundle]

Voytek,

what do I need to set '$ResLN' to '$lastname' ?

<td><input type="text" name="lastname" readonly 
style="cursor:not-allowed" value="<?php
        if (isset($ResLN)){
                echo $ResLN;
        } else {
                echo $lastname;
        }

BTW this style of Sql that you've written is at risk of SQL injection.
Consider a user who entered the following into the title field of your form,

  junk'; delete from members;

your SQL would then become,

  UPDATE members SET title = 'junk';delete from members;

At the very least you should sanitise your form data but you should 
really use a database connection that uses prepared statements, I.E

 dblink->execute("UPDATE members SET title = ?, firstname= ? etc", 
array($_SESSION['ResTTL'],$_SESSION['ResFN'],etc);

HTH

P.


--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html