Here about every post I've replied ask about the same question, so I'll continue with the same approach, that has gotten at least a part of script working:
when you first try to reference request methods, like $_POST or $_GET (or $_REQUEST) USE THE isset($_GET/POST/REQUEST) accordingly first... Your first code snippet checks the isset() after you've tried to declare variables from unchecked $_POST's so do for example as follows:
PHP Code:
<?php
$fieldname = isset($_POST['fieldname']) ? $_POST['fieldname'] : '';
?>
Now secondly, you're not closing the echo's in your second part you pasted, be sure to close the echo with a semicolon like follows
<?php echo $field
; ?>
Thirdly I'd do proper input checking on everything that you query your database against, for example if your id's are always integers, I'd check the id for being numerical like:
PHP Code:
$id = isset($_POST['id']) ? $_POST['id'] : '';
if(!empty($id) && is_numeric($id)) { ... continue with your script ... }
else { die("id is empty or not numeric"); }
The next issue I'd figure out would be checking your mysql queries, for proper escaping and usage of quotes, for example:
PHP Code:
//this is yours:
$name = $_POST['name'];
$sql = "SELECT * from tblbasicform WHERE name = '$name'";
//this is my version:
function escape($s) {
if (function_exists('mysql_real_escape_string')) {
$s = mysql_real_escape_string($s);
} else {
$s = mysql_escape_string($s);
}
return $s;
}
$name = isset($_POST['name']) ? $_POST['name'] : '';
$name = escape($name);
$sql = "SELECT * from tblbasicform WHERE name = '".$name."'";
You check out your syntax, correct the issues and let us know how you're progressing, okay?
ps. oh and be sure to not use short tag syntax, because it's not supported on a large number of servers, so instead of <? ?> use <?php ?>