Member Avatar for GraficRegret

I got everything working on the edit information page even the delete picture and insert a new picture. However when I delete or insert a picture, every field in the details table dissapears, if it turns out to be a field that is editable then it gets replaced with a "/". Then I have to go back to the select page and reselect the product or click the back button and resubmit the information to get the page to look proper again. Here is my code, its rather long, because I have the delete and upload functions on the page with the rest of the information.

<?php
session_start();
include 'core/conection.php';
if(isset($_SESSION['user_id']))
{
    if(isset($_POST['delete']))
    {
        $id = $_POST['pic_id'];
        $query="DELETE FROM uploads WHERE pic_id='".$id."'";
        mysql_query($query,$con);

        $delFile = 'pics/' . $_POST['picName'];
        if (file_exists($delFile))
        {
            unlink($delFile);
            echo 'file has been removed';
        }else
        {
            echo 'file does not exist';
        }

    }

    if(isset($_POST['upload']))
    {
        $allowedExts = array("jpg", "jpeg", "gif", "png");
        $extension = end(explode(".", $_FILES["file"]["name"]));
        if ((($_FILES["file"]["type"] == "image/gif")
        || ($_FILES["file"]["type"] == "image/jpeg")
        || ($_FILES["file"]["type"] == "image/png")
        || ($_FILES["file"]["type"] == "image/jpg"))
        && ($_FILES["file"]["size"] < 20000000)
        && in_array($extension, $allowedExts))
        {
      if ($_FILES["file"]["error"] > 0)
          {
            echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
          }else
          {
            echo "Upload: " . $_FILES["file"]["name"] . "<br />";
            echo "Type: " . $_FILES["file"]["type"] . "<br />";
            echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";

            if (file_exists("pics/" . $_FILES["file"]["name"]))
            {
              echo $_FILES["file"]["name"] . " already exists. ";
            }else
            {
              move_uploaded_file($_FILES["file"]["tmp_name"],
              "pics/" . $_FILES["file"]["name"]);

               $path = $_FILES["file"]["name"];

              $sql = "INSERT INTO uploads (ref_id, name) VALUES('$_POST[refStk]', '$path')";
              if (!mysql_query($sql,$con))
              {
                  die('Error: ' . mysql_error());
              }else
              {
                 echo 'your picture has been uploaded';
             }
            }
          }
        }else
        {
          echo "Invalid file";
        }
    }
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Vehicle Edit</title>
</head>
<body onUnload="window.addEventListener("unload", invalidateBackCache, true)"><center><h1>Vehicle Edit</h1>
<?php
$refStk = $_POST['refStk'];

$refId = $_POST['refID'];

$result = mysql_query("SELECT * FROM inventory WHERE id = '$refId'") or die(mysql_error());
$row = mysql_fetch_array($result);

$picRes = mysql_query("SELECT * FROM uploads WHERE ref_id = '$refStk'");
?>
<form name="vehicleEdit" action="update.php" method="post">
<table border = '1'>
<tr><th>Stock Number</th><th>Year</th><th>Make</th><th>Model</th><th>Mileage</th><th>Transmition</th><th>Body Style</th><th>Location</th><th>Asking Price</th></tr>
<tr><td><?php echo $row['stock']?></td><td><?php echo $row['year']?></td><td><?php echo $row['make']?></td><td><?php echo $row['model']?></td><td><?php echo $row['mileage']?></td><td><?php echo $row['transmition']?></td><td><?php echo $row['body_style']?></td><td><?php echo $row['location']?></td><td><?php echo $row['ask_price']?></td></tr><tr><td></td><td></td><td></td><td></td><td><input type="text" name="mileage" value=<?php echo $row['mileage']; ?> /></td><td></td><td></td><td><input type="text" name="location" value=<?php echo $row['location']; ?> /></td><td><input type="text" name="price" value=<?php echo $row['ask_price']; ?> /></td></tr>
</table>
<input type="hidden" name="refID" value=<?php echo $_POST['refID']; ?> />
<input type="submit" name="submit" value="Update" />
</form><br /><a href = vehicleSelect.php><input type="button" value="Switch Vehicle" /></a><br /><br />
<table>
<tr>
<?php
while($picRow = mysql_fetch_array($picRes))
{
    ?>
    <td>
    <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post" name="delete" enctype="multipart/form-data"><input type="hidden" name="pic_id" value="<?php echo $picRow['pic_id']; ?>" /><input type="hidden" name="picName" value="<?php echo $picRow['name']; ?>" />
    <img src="<?php echo "pics/".$picRow['name']; ?>" width="110" height="83" /><br /><input type="submit" name="delete" value="Delete" />
    </form>
    </td>
    <?php
}
?>
</tr>
</table>
<form name="upload" action="<?php $_SERVER['PHP_SELF']; ?>" method="post" enctype="multipart/form-data"><input type="hidden" name="refStk" value=<?php echo $refStk; ?> />
<label for="file">Picture to be uploaded:</label><br />
<input name="file" type="file" /><br />
<input type="submit" name="upload" value="Upload" />
</form>
</center>
</body>
</html>
<?php
}else
{
    echo "<br /><br /><br /><br />";
    echo "<strong><center>"."You Are Not Authorized To view This Page......<a href='admin.php'>Please Login First !!</a>"."</center></strong>";
}
?>

Thank you all for any help you can provide.

  • 1 Contributor
  • 1 Reply
  • 205 Views
  • 1 Hour Discussion Span
  • Latest Post Latest Post by GraficRegret

Dani AI

Generated

Short summary and the root cause observed: the edit page lost its values because the small POST forms used for picture upload/delete didn’t carry the record context the edit table relied on (the stock/id values), so on those submissions the script had nothing to repopulate the fields. ’s follow-up confirms the fix was to post the hidden identifiers — that’s correct, and there are a couple of extra safeguards worth applying.

Always include the identifying state in every form that can change page state (delete/upload/select). Hidden inputs are simple and reliable for that:

<input type="hidden" name="refID"  value="<?php echo htmlspecialchars($refId, ENT_QUOTES); ?>">
<input type="hidden" name="refStk" value="<?php echo htmlspecialchars($refStk, ENT_QUOTES); ?>">

Also make sure all value attributes are quoted and HTML-escaped so an empty or space-containing value does not break the markup (an unquoted value= can produce odd render results like a stray /). Example for a text field:

<input type="text" name="mileage" value="<?php echo htmlspecialchars($row['mileage'], ENT_QUOTES); ?>" />

Better workflow and safety notes: use Post/Redirect/Get after processing a POST (redirect back to the edit URL with refID/refStk in the query string) so actions don’t leave the page in a mid-POST state:

header('Location: vehicleEdit.php?refID=' . urlencode($refId) . '&refStk=' . urlencode($refStk));
exit;

Security/robustness checklist not covered in the thread: stop using deprecated mysql_* APIs — migrate to PDO or MySQLi with prepared statements; validate uploads server-side (use pathinfo() for extension, check MIME with server functions, generate unique filenames, verify move_uploaded_file() success); store/display values with htmlspecialchars() to prevent XSS; and give each form a distinct submit name so the script can tell which action ran. These steps will prevent broken state, markup glitches, and common security pitfalls.

Member Avatar for GraficRegret

never mind i figured it out thanks all just needed hidden fields to post so that the proper information could be repopulated

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.