Hello All,
I am working on a PHP website with MySQL DB. Initially the code was working, and but as I carried on working on it, the create new user function stopped working, I am not sure if I changed something in it to cause this. The message on the website pulls through the successfully created message, but the DB is not updated. I can return the SQL code and enter it manually to PHPmyAdmin, and see it fails to create because the ID (A-I PK), is being returned as a ‘’ due to the rest of the values going through a “cleaning” function before inserting into DB. I am sure this was always the case, but clearly something is wrong now as values I am not wanting to insert it is trying to insert as the fields are being pulled from the table.
Here is the code
the webpage uses the save function, update works as it should, so dont think there are issues behind this:
}
private function has_attribute($attribute){
// get_object_vars returns an associative array with all attributes
//(incl. private ones!!) as the keys and their current values as the value
$object_vars = $this->attributes();
return array_key_exists($attribute, $object_vars);
}
protected function attributes(){
// return an array of attribute keys and their values
$attributes = array();
foreach(static::$db_fields as $field){
if(property_exists($this, $field)){
$attibutes[$field] = $this->$field;
}
}
return get_object_vars($this);
}
protected function sanitized_attributes(){
global $database;
$clean_attributes = array();
// Clean values before submitting
foreach($this->attributes() as $key => $value){
$clean_attributes[$key] = $database->escape_value($value);
}
return $clean_attributes;
}
public function save(){
// A new record won't have a valid id
return isset($this->id) ? $this->update() : $this->create();
}
protected function create(){
global $database;
$attributes = $this->sanitized_attributes();
$sql = "INSERT INTO ".static::$table_name." (";
$sql .= join(", ", array_keys($attributes));
$sql .= ") VALUES ('";
$sql .= join("', '", array_values($attributes));
$sql .= "')";
var_dump($sql);
return($sql);
if($database->query($sql)){
$this->id = $database->insert_id($sql);
$message = "Success.";
return $message;
} else {
return false;
}
}
protected function update(){
global $database;
$attributes = $this->sanitized_attributes();
$attribute_pairs = array();
foreach($attributes as $key => $value){
$attribute_pairs[] = "{$key}='{$value}'";
}
$sql = "UPDATE ".static::$table_name." SET ";
$sql .= join(', ', $attribute_pairs);
$sql .= " WHERE id='". $database->escape_value($this->id) . "'";
$database->query($sql);
return($database->affected_rows($database) == 1) ? True : False;
}
the webpage form:
$reg_errors = array();
$user = new User();
if(isset($_POST['submit'])){
include('forms/validate/reg_validate.php');
if(empty($reg_errors)){
var_dump($user);
$user->first_name = $_POST['first_name'];
$user->last_name = $_POST['last_name'];
$user->email_address = $_POST['email_address'];
$password = $user->pass_enc($_POST['password']);
$user->password = $password;
$user->receive_emails = $_POST['receive_emails'];
$user->contact_number_1 = $_POST['contact_number_1'];
$user->contact_number_2 = $_POST['contact_number_2'];
$user->save();
$session->message("USER CREATED!");
//redirect_to('index2.php');
}
DB functions
public function query($sql){
$result = mysqli_query($this->connection, $sql);
$this->confirm_query($result);
return $result;
}
public function escape_value($string){
$escaped_string = mysqli_real_escape_string($this->connection, $string);
return $escaped_string;
}
if i var dump user on this page before it is passed to the functions id = null
after attributes are cleaned, id = ‘’
let me know if there is more code needed
the user is not created as ‘’ cannot be inserted as a primary key