Is it possible???

Discussion in 'PHP' started by candle21428, Oct 3, 2006.

  1. #1
    I have just created a form that will allow me to collect the data from my customer and then send all the info to database, here is part of the code:


    
    $q1 = mysql_query("INSERT INTO Affiliates (Username, Password, FirstName, LastName, Company, Street,
    	  	Street2, City, State, Zip, Country, Phone, Email, Website, PayTo, Title, PaymentPreferenceID, StartEffectiveDate, EndEffectiveDate) VALUES 
    	  	('".$_POST['ausername']."', '".$password."', '".$_POST['afirstname']."', '".$_POST['alastname']."',
    		'".$_POST['acompany']."', '".$_POST['astreet']."', '".$_POST['astreet2']."', '".$_POST['acity']."',
    		'".$_POST['astate']."', '".$_POST['azip']."', '".$_POST['acountry']."', '".$_POST['aphone']."', 
    		'".$_POST['aemail']."', '".$_POST['awebsite']."', '".$_POST['acheckname']."', '".$_POST['atitle']."', 
    	    '".$_POST['payPreference']."', '".$date_now."', '2145945600')") 
            or die(mysql_error()); 
          
          include "tellfriend.php?id=".$_POST['ausername']; 
    PHP:
    and then I would like to direct the customer to a page called "tellfriend.php".

    The question I have is, is it possible to send the customer to

    tellfriend.php?id=[username of that customer]???

    What should be used instead of the $_POST['ausername']???

    If it is not possible to do it this way, is there other way I could send the item "username" to the nextpage?

    Thx
     
    candle21428, Oct 3, 2006 IP
  2. T0PS3O

    T0PS3O Feel Good PLC

    Messages:
    13,219
    Likes Received:
    777
    Best Answers:
    0
    Trophy Points:
    0
    #2
    You have greater worries than whether that is possible.

    Search about SQL injection. I can delete your database within seconds. That's about the worst way of handling form input and storing it in a database.

    But yes, it's possible. I would personally just redirect to the next page with the required parameters. That way you don't get duplicate database entires if they refresh the page.
     
    T0PS3O, Oct 3, 2006 IP