I have create resume form to update multiple field upended text box in php

Akshay_10 0 Newbie Poster

9 Years Ago

[Click Here](http://www.acchajob.com)
if (isset($_POST['createresume'])) 
{
$university = $_POST['university'];
$frommon = $_POST['frommon'];   
$tomon = $_POST['tomon'];
$lavel = $_POST['lavel'];
$courtitle = $_POST['courtitle'];
$eduinfo = $_POST['eduinfo'];
$typeskill = $_POST['typeskill'];
$lavelskill = $_POST['lavelskill'];
$skilldetails = $_POST['skilldetails'];
$langskill_1 = mysqli_real_escape_string($con, $_POST['langskill_1']);
$langskill_2 = mysqli_real_escape_string($con, $_POST['langskill_2']);
$langskill_3 = mysqli_real_escape_string($con, $_POST['langskill_3']);
$langskill_4 = mysqli_real_escape_string($con, $_POST['langskill_4']);
$langskill_5 = mysqli_real_escape_string($con, $_POST['langskill_5']); 
$langskill_6 = mysqli_real_escape_string($con, $_POST['langskill_6']);
$langdetails = mysqli_real_escape_string($con, $_POST['langdetails']);
$jobposition = $_POST['jobposition'];
$fromMon = $_POST['fromMon']; 
$toMon = $_POST['toMon'];
$compname = $_POST['compname']; 
$addinfoexp = $_POST['addinfoexp'];
$infohobby = $_POST['infohobby'];               
$reftype = $_POST['reftype'];
$refname = $_POST['refname'];   
$refinfo = $_POST['refinfo'];       
$Filename = rand(1000,100000)."-".$_FILES['Filename']['name'];
$file_loc = $_FILES['Filename']['tmp_name'];
$file_size = $_FILES['Filename']['size'];
$file_type = $_FILES['Filename']['type'];
$folder="uploads/"; 
move_uploaded_file($file_loc,$folder.$Filename);
for($i=0;$i<count($_POST['university']);$i++) 
{   
        if (empty($profile_data)) 
    {
        mysqli_query($con, "INSERT INTO education(EducID,University,FromMon,ToMon,Lavel,CourTitle,EduInfo,Registration_Id) VALUES('','" . $_POST['university'][$i] . "','" . $_POST['frommon'][$i] . "','" . $_POST['tomon'][$i] . "','" . $_POST['lavel'][$i] . "','" . $_POST['courtitle'][$i] . "','" . $_POST['eduinfo'][$i] . "','" . $registration_Id . "')");        
} 
else{
    for($i=0;$i<count($_POST['university']);$i++) 
{
    $query = "UPDATE education SET University = '" . $_POST['university'][$i] . "',FromMon='" . $_POST['frommon'][$i] . "',ToMon='" . $_POST['tomon'][$i] . "',Lavel='" . $_POST['lavel'][$i] . "',CourTitle='" . $_POST['courtitle'][$i] . "',EduInfo='" . $_POST['eduinfo'][$i] . "',Registration_Id='" . $registration_Id . "' WHERE registration_Id= $registration_Id";         
        mysqli_query($con,$query);      
}   
}   
}       
        //$EducID= mysqli_insert_id($con);
    for($i=0;$i<count($_POST['typeskill']);$i++)
      { 
if (empty($profile_data)) 
    {     
        mysqli_query($con, "INSERT INTO empskill1(SkillID,TypeSkill,LavelSkill,SkillDetails,Registration_Id) VALUES('','" . $_POST['typeskill'][$i] . "','" . $_POST['lavelskill'][$i] . "','" . $_POST['skilldetails'][$i] . "','" . $registration_Id . "')"); 
      } 
      else{
          for($i=0;$i<count($_POST['typeskill']);$i++)
          {
              $query = "UPDATE empskill1 SET TypeSkill ='" . $_POST['typeskill'][$i] . "',LavelSkill='" . $_POST['lavelskill'][$i] . "',SkillDetails='" . $_POST['skilldetails'][$i] . "',Registration_Id='" . $registration_Id . "'WHERE registration_Id= $registration_Id";
              mysqli_query($con,$query);
          }           
      }
      }
      if (empty($profile_data)) 
    {
        mysqli_query($con, "INSERT INTO pinfo(PInfo_ID,LangSkill_1,LangSkill_2,LangSkill_3,LangSkill_4,LangSkill_5,LangSkill_6,LAngDetails,InfoHobby,RefType,RefName,RefInfo,Registration_Id) VALUES('','" . $langskill_1 . "', '" . $langskill_2 . "', '" . $langskill_3 . "', '" . $langskill_4 . "', '" . $langskill_5 . "', '" . $langskill_6 . "', '" . $langdetails . "', '" . $infohobby . "', '" . $reftype . "', '" . $refname . "', '" . $refinfo . "','" . $registration_Id . "')");     
    }
    else{
            $query = "UPDATE pinfo SET LangSkill_1='" . $langskill_1 . "', LangSkill_2='" . $langskill_2 . "',LangSkill_3= '" . $langskill_3 . "',LangSkill_4= '" . $langskill_4 . "',LangSkill_5= '" . $langskill_5 . "',LangSkill_6= '" . $langskill_6 . "',LAngDetails= '" . $langdetails . "',InfoHobby= '" . $infohobby . "', RefType='" . $reftype . "',RefName= '" . $refname . "',RefInfo= '" . $refinfo . "',Registration_Id='" . $registration_Id . "'WHERE registration_Id= $registration_Id";
            mysqli_query($con,$query);
        }       
        //$PInfo_ID= mysqli_insert_id($con); 
    for($i=0;$i<count($_POST['jobposition']);$i++)
      {
          if (empty($profile_data)) 
    {
        mysqli_query($con, "INSERT INTO workexp(WorkExpID,JobPosition,FromMon,ToMon,CompName,AddInfoExp,uploads,Registration_Id) VALUES('','" . $_POST['jobposition'][$i] . "', '" . $_POST['fromMon'][$i] . "', '" . $_POST['toMon'][$i] . "', '" . $_POST['compname'][$i] . "', '" . $_POST['addinfoexp'][$i] . "','" . $Filename . "','" . $registration_Id . "')"); 
      }  
    else{
        for($i=0;$i<count($_POST['jobposition']);$i++)
      {
        $query = "UPDATE workexp SET JobPosition ='" . $_POST['jobposition'][$i] . "',FromMon= '" . $_POST['fromMon'][$i] . "',ToMon= '" . $_POST['toMon'][$i] . "',CompName= '" . $_POST['compname'][$i] . "',AddInfoExp= '" . $_POST['addinfoexp'][$i] . "',uploads='" . $Filename . "',Registration_Id='" . $registration_Id . "'WHERE registration_Id= $registration_Id";
         mysqli_query($con,$query);
        }   
      }
      } 
    if (!$error)
        {
            echo "<script type='text/javascript'>alert('Successfully Created resume !.....!'); window.location.href='employeecreateresume';</script>";
        }
    else
        {            
            $errormsg = "Error in Created Resume...Please try again later!";
        }                   
        }

1 Contributor
0 Replies
120 Views

Dani AI

Generated 9 Months Ago

Short summary for : the form/loop approach can work, but it needs structural and security fixes before it’s safe and reliable in production. The common failure modes are logic errors when iterating arrays, accidental mass-updates when rows lack per-row keys, lack of transactional safety, and unsafe SQL/file handling. Recommended changes and a compact pattern follow.

Core fixes to apply:

Decide update vs insert once (outside loops) or include each row’s primary key in the form so the server can update the correct record. Reusing a single loop index across nested loops will cause wrong behaviour.
Use parameterized queries (prepared statements) and wrap multi-row operations in a transaction so either all rows are saved or none are. An easier, robust pattern is: delete existing rows for the user and re-insert the posted rows inside one transaction.
For file uploads validate $_FILES (check UPLOAD_ERR_*), verify MIME/type with finfo, limit size, and generate a collision-safe filename (e.g., uniqid() or a secure hash). Always check move_uploaded_file() return.

Example (pattern — uses prepared statements + transaction):

$conn->begin_transaction();

$del = $conn->prepare("DELETE FROM education WHERE Registration_Id = ?");
$del->bind_param("i", $regId);
$del->execute();

$ins = $conn->prepare("INSERT INTO education (University, FromMon, ToMon, Lavel, CourTitle, EduInfo, Registration_Id) VALUES (?, ?, ?, ?, ?, ?, ?)");
foreach ($universities as $idx => $univ) {
    $ins->bind_param("ssssssi", $univ, $from[$idx], $to[$idx], $level[$idx], $title[$idx], $info[$idx], $regId);
    $ins->execute();
}

$conn->commit();

Quick debugging & security tips: enable mysqli exceptions/reporting during development, log mysqli_error() messages, ensure all posted arrays have matching lengths, and never concatenate unescaped user data into SQL. See the PHP prepared-statement docs and file-upload guidance for specifics: mysqli prepared statements, file upload handling, and OWASP guidance on SQL Injection prevention and file upload security.

Be the first to reply

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.