2

I created a website which has two menus in it. One is to enter details of a person and the other to view list of entered persons. Here is the code

function agents_menu(){
  $items=array();
  $items['enquirylist']=array(
    'title'=>'View Enquiries',
    'description'=>'Lists all the enquiries',
    'page callback'=>'show_enquirylist', 
    'access callback'=>TRUE,
    'access arguments'=>array('access content'),
    'type'=>MENU_NORMAL_ITEM,
  );
  $items['enquiryform']=array(
    'title'=>'New Enquiry',
    'description'=>'Add new enquiries form',
    'page callback'=>'agents_form', 
    'access callback'=>TRUE,
    'access arguments'=>array('access content'),
    'type'=>MENU_NORMAL_ITEM,
  );
  $items['enquiry_details']=array(
    'page callback'=>'run_enquiry_details',
    'access arguments'=>array('access content'),
    'access callback'=>TRUE,
    'type'=>MENU_CALLBACK,
  );
  return $items;
}

function enquiries_form($form, &$form_state){
  $form = array();
  $form['#theme'] = 'enquiries';
  $form['efname'] = array(
    '#type' => 'textfield',
    '#title' => 'First Name',
    '#size' => 28,
    '#maxlength' => 100,
    '#required' => TRUE,
  );
  $form['elname'] = array(
    '#type' => 'textfield',
    '#title' => 'Last Name',
    '#size' => 28,
    '#maxlength' => 100,
    '#required' => TRUE,
  );
  $form['edob'] = array(
    '#type' => 'date',
    '#title' => 'Date of Birth',
    '#date_format' => 'Y-m-d',
    '#required' => TRUE,
  );
  $options = array('0'=>'Male','1'=>'Female');
  $selected = '0';
  $form['egender'] = array(
    '#title' => t("Choose Gender"),
    '#type' => 'select',
    '#options' => $options,
    '#default_value' => $selected,
  );
  $form['edob'] = array(
    '#type' => 'date', //you can find a list of available types in the form api
    '#title' => 'Date of Birth',
    '#date_format' => 'Y-m-d',
    '#required' => TRUE, //make this field required 
  );
  $form['submit_btn'] = array(
    '#type'=>'submit',
    '#value'=>'Submit',
  );
  return $form;
}

function show_enquirylist(){
  $header=array(
    array('data'=>t('Name'), 'field'=>'efname', 'sort'=>'asec'),
    array('data'=>t('Phone')),
    array('data'=>t('Email')),
  );
  $query = db_select('enquiries','u');
  $query->fields('u', array('eid','efname','elname','eemail','emobile',));
  $table_sort = $query->extend('TableSort')->orderByHeader($header);
  $pager = $table_sort->extend('PagerDefault')->limit(5);
  $result = $pager->execute();

  $rows = array();
  foreach($result as $res){
    $rows[] = array(l($res->efname.' '.$res->elname, "enquiry_details",array('query'=>array('vars'=>$res->eid))),$res->emobile,$res->eemail,);
  }
  $output = '';
  if(!empty($rows)){
    $output = theme('table', array('header' => $header, 'rows'=>$rows, 'attributes'=> array('id'=>'sort-table')));
  $output .= theme('pager');
  }
  else {
    $output .= t("No results found");
  }
  return $output;
}

function run_enquiry_details($form, &$form_state){
  $query = db_query("SELECT * FROM {enquiries} WHERE eid='".$_GET['vars']."'");
  $form = drupal_get_form('enquiries_form');
  foreach($query AS $result){
    $form['efname']['#value']=t($result->efname);
    $form['efname']['#attributes']['readonly'] = 'readonly';
    $form['efname']['#attributes']['class'][] = 'readonly';

    $form['elname']['#value']=t($result->elname);
    $form['elname']['#attributes']['readonly'] = 'readonly';
    $form['elname']['#attributes']['class'][] = 'readonly';
  }
  return $form;
}

function agents_form_alter(&$form, &$form_state, $form_id){
  if(isset($_GET['vars'])){
    $query = db_query("SELECT * FROM {enquiries} WHERE eid='".$_GET['vars']."'");
    foreach($query as $result){
      $form['egender']['#default_value'] = t($result->egender);
      $form['egender']['#attributes']['disabled'] = TRUE;
      $form['egender']['#attributes']['class'][] = 'readonly';

      $dob = getdate(strtotime($result->edob));
      $form['edob']['#value']['day'] = strval($dob[mday]);
      $form['edob']['#value']['month'] = strval($dob[mon]);
      $form['edob']['#value']['year'] = strval($dob[year]);
      $form['edob']['day']['#value']= strval($dob[mday]);
      $form['edob']['month']['#value']= strval($dob[mon]);
      $form['edob']['year']['#value']= strval($dob[year]);

      $form['submit_btn']['#access']=FALSE;
      $form['eimage']['#access']=FALSE;
    }
    return $form;
  }
}

If I don't use $_GET['vars'], the form is working fine. I can add details and submit into the database without any issues. Viewing the list of persons is absolutely working fine and when I click on the user name, it is calling enquiry_details with vars= id number. But to set the date, I used hook_form_alter to update the date of birth values. Without hook_form_alter, it is not updating the values of date and gender. Can someone guide me how to attain this without any obstacles?

1
  • There are so many issues with the code that I don't know where to being. Worst is that you have SQL Injection vulnerabilities making it possible for attackers to delete your entire database.
    – googletorp
    Commented Nov 18, 2016 at 9:43

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.