Quote:
Originally Posted by AndrewGSW
Once you have presented a page, with a form etc., to the user you have lost control over it. The user can muck around with it: enable radio buttons - do whatever they want (if they know how).
The important thing is that you ignore or discard any return (posted) values that you are not expecting, and check that the values you are expecting are acceptable.
disabled="disabled" is how we disable radio buttons - or you can hide them or don't include them.
|
I am hating myself for trying to combine 3 scripts into one...
Here is what I have so far, and it is not working...
PHP Code:
<?php
// ************************
// Loop through Requests. *
// ************************
while (mysqli_stmt_fetch($stmt3)){
// **************************************
// Build Friend-Request Decision array. *
// **************************************
$friendRequestDecision[$requestorID] = (isset($requesteeApproved) ? $requesteeApproved : 0);
// **************************
// Display Friend-Requests. *
// **************************
echo "<li>
<a href='/account/profile/$username/about-me'>
$username<br />
<img src='/uploads/"
. getSafeUserPhoto($photoName, $photoApproved) .
"' width='80' alt='Thumbnail of " . $username . "' />
</a>
<fieldset id='requestChoices'>
<input id='Requestor" . $requestorID . "_1' name='friendRequestDecision["
. $requestorID . "]' type='hidden' "
. ((isset($friendRequestDecision[$requestorID]) && $friendRequestDecision[$requestorID] == '0') ? "value='0'" : "") .
" />
<input id='Requestor" . $requestorID . "_1' name='friendRequestDecision["
. $requestorID . "]' type='radio' value='0' "
. ((isset($friendRequestDecision[$requestorID]) && $friendRequestDecision[$requestorID] == '0') ? "checked='checked'" : "") .
" disabled='disabled' />
<label for='Requestor" . $requestorID . "_1'>Decide Later</label>
<input id='Requestor" . $requestorID . "_2' name='friendRequestDecision["
. $requestorID . "]' type='hidden' "
. ((isset($friendRequestDecision[$requestorID]) && $friendRequestDecision[$requestorID] == '1') ? "value='1'" : "") .
" />
<input id='Requestor" . $requestorID . "_2' name='friendRequestDecision["
. $requestorID . "]' type='radio' value='1' "
. ((isset($friendRequestDecision[$requestorID]) && $friendRequestDecision[$requestorID] == '1') ? "checked='checked'" : "") .
" disabled='disabled' />
<label for='Requestor" . $requestorID . "_2'>Accept</label>
<input id='Requestor" . $requestorID . "_3' name='friendRequestDecision["
. $requestorID . "]' type='hidden' "
. ((isset($friendRequestDecision[$requestorID]) && $friendRequestDecision[$requestorID] == '2') ? "value='2'" : "") .
" />
<input id='Requestor" . $requestorID . "_3' name='friendRequestDecision["
. $requestorID . "]' type='radio' value='2' "
. ((isset($friendRequestDecision[$requestorID]) && $friendRequestDecision[$requestorID] == '2') ? "checked='checked'" : "") .
" disabled='disabled' />
<label for='Requestor" . $requestorID . "_3'>Decline</label>
</fieldset>
</li>\n";
}//End of LOOP THROUGH REQUESTS
?>
If I just load the form, it seems to be working okay, but if I re-submit the form without changing any values, then I get behavior like this...
Test #1:
There are two Friend-Requests:
- The one to "Mary" is originally marked as "Accept"
- The one to "Sally" is originally marked as "Accept"
When I re-submit the form...
- The one to "Mary" changes to "Decide Later"
- The one to "Sally" changes to "Decide Later"
Test #2:
There are two Friend-Requests:
- The one to "Mary" is originally marked as "Decline"
- The one to "Sally" is originally marked as "Decline"
When I re-submit the form...
- The one to "Mary" remains as "Decline"
- The one to "Sally" remains as "Decline"
Test #3:
There are two Friend-Requests:
- The one to "Mary" is originally marked as "Decide Later"
- The one to "Sally" is originally marked as "Decide Later"
When I re-submit the form...
- The one to "Mary" remains as "Decide Later"
- The one to "Sally" remains as "Decide Later"
I'm not sure what is wrong with my code?!
BTW, obviously I would want to hide the "Update Requests" button for this particular view, but I am leaving it for testing purposes. My logic being, that my code should be able to properly handle things if the Form was somehow re-submitted, which I sorta think plays to the points you were trying to make above about not being able to trust Form data, right??
Sincerely,
Debbie