JPadie I'm trying to implement your code and I have an error I can't find. It is an SQL error somewhere next to the ")" in line 1 ???????? Do you see the error?
//attach to the database here
$db_name = "slow";
$tablename = "Art";
$connection = @mysql_connect("localhost", "slow", "**") or die (mysql_error());
$db = @mysql_select_db($db_name,$connection) or die(mysql_error());
/* this code is split into three distinct 'bits' - each is organised as a function
displayImages does the work of outputting the images
parseintoarray takes the input from the user form and makes an array for displayimages to use
displayForm takes all the image NAMES from the database and creates a list of them with a checkbox so that you can select the images that you want to display.
*/ /// Line 20
if (isset($_POST['submit'])){ //check whether the user has submitted the form
displayImages(); //if yes, start displaying the images
} else {
displayForm(); //if not, then display the list of images for the user to make a choice
}
function displayImages(){
global $tablename; //the variable is defined outside a function. to make it available to a function we use the global keyword
$ids = parseIntoArray(); //this causes the parseintorarray function to fire up. the output of the function is assigned to $ids
$sql = "SELECT article_name, image, text, bigimage, alttext, a_id FROM $tablename WHERE a_id IN (". implode(",", $ids) . ")"; // the mysql IN keyword is used here. the implode function takes the array and makes it into a nice comma delimited string for the IN function to use
$result = mysql_query($sql) or die (mysql_error()); //perform the query
while ($row = mysql_fetch_assoc($result)){ //iterate through the recordset
$image = str_replace ("src=", "alt=\"".$row['alttext']."\" src=", $row['image']); //this line takes the normal image tag that is stored in the db and inserts the alttext into it
echo <<<HTML
<a href="kma_ce.php?a_id={$row['a_id']}">{$image}{$text}</a><br/>
HTML;
//output the links and the images at the moment they are just in a vertical column
}
}
//line 39
function parseIntoArray(){
//get a list of actual ids to cross check user input
global $tablename;
$validID = array(); //instantiate the array - just good practice
/*
what we are doing here is getting an array of all the id's in the database.
these are the KNOWN GOOD VALUES
the user input should ALWAYS be considerer tainted. so ideally you will test
each user value against the Known good values and discard those that do not match.
we do this here by selecting all the id's and then iteratively putting them into an array.
the incoming checkboxes are available to php in the $_POST['a_id'] variable which is itself an array.
the array is organised so that its keys are the ids. this is caused by the way we put the form together in display form.
to check the values we iterate over the array and check with each value (in fact the key) is in the array of known good values. if it is then we add the id onto the valid_id array
*/
$sql = "select a_id from $tablename";
$result = mysql_query($sql) or die (mysql_error());
while ($row = mysql_fetch_assoc($result)){
$permittedID[] = $row[0]; //create the array of known good values
}
//line 61
foreach($_POST['a_id'] as $ids=>$val){ //iterate through the incoming array of ids
if (in_array($ids, $permittedID)){ //check to make sure an incoming value is valid
$validID[] = $ids; // if it is valid, assign to a validated array
}
}
return $validID; // return the clean array to the calling functino
}
function displayForm(){
/*
this function is very simple. it just grabs all the ids and the names from the database and outputs
a form to the screen that allows the user to select those images that he wants displayed
*/
global $tablename;
$sql = "select `text`, `image`,a_id from $tablename";
$result = mysql_query($sql) or die (mysql_error());
//the syntax below is called the HEREDOC syntax. it is used most often for outputting chunks of html
$output = <<<STYLE
<style type="text/css">
.even_row {width:60%; margin:0 auto; border: 1px black solid; background-color:#FFFFFF;}
.odd_row {width:60%; margin:0 auto; border: 1px black solid; background-color:#CCCCFF;}
.cbox {width: 20px;}
</style>
<form action="{$_SERVER['PHP_SELF']}" method="post">
STYLE;
while ($row = mysql_fetch_assoc($result)){
$class = ($class=="even_row") ? "odd_row" : "even_row"; //this is just a stylistic tweak
$output .= <<<HTML
<div class="{$class}">
<label for="a_id[{$row['a_id']}]">
<span class="cbox">
<!--THIS IS THE IMPORTANT BIT. NAME THE CHECKBOX AS AN ARRAY SO THAT IT IS USABLE IN PHP-->
<input type="checkbox" name="a_id[{$row['a_id']}]" a_id="a_id[{$row['a_id']}]" />
</span>
<span class="label">
{$row['text']}
</span>
</label>
</div>
HTML;
}
$output .= <<<HTML
<div class="row">
<input type="submit" name="submit" value="Get Photos" />
</div>
</form>
HTML;
echo $output; //SEND THE FORM TO THE SCREEN
}
?>
