PHP Standard - Simple ELSE issue - HELP!

[oliverj777]

Hi, I'm trying to make an error message appear when a user misses a text field, or fills in an error. All the errors are sent to a form.php, this then sends the error message back to the current page. Here is the code I am using to retrieve the error message:

 

if($form->error = ("user")){
echo $form->error("user");
}
if($form->error = ("pass")){
echo $form->error("pass");
}

 

Which works fine, but I only want ONE error message to be displayed at a time. This IS what I want:

 

There are two fields, user, and password. If the user fails to enter anything into both, only one error message will appear "Please enter your username" (which is what the form.php does).

 

When the user fills in the username, but fails to fill in the password then it works, only one error message appears (as there is only one error to send)

 

When the user fills in the password, but fails to fill in the username it also works, only one error message appears. Its just when the user fails to fill in either, it prints both error messages when I only want it to print the 'user' error message.

 

Please help, Thanks

[DWilliams]

If I'm understanding your question correctly you should be able to change the second "if" to an "elseif"

[oliverj777]

I've tried that, and it DOES display one error message when I fail to fill in both fields, but when I fill in the user field, but leave the password field, no error message is shown at all.

 

Its as if the 'pass' does not respond no longer ...

[oliverj777]

Is there a way of saying:

 

if($form->error does not equal ("user") but does equal ("pass"){

echo ....

 

?

(not equal = no error to display || equal = error to display)

I may have an idea ...

[hcdarkmage]

Try this:

if(isset($form->error)){
   if($form->error == ("pass") && $form->error != ("user"){
       echo $form->error("pass");
   } else {
       echo $form->error("user");
   }
}

[oliverj777]

I get errors with that code you gave me 

 

On the 2nd and 4th line ...

 

[hcdarkmage]

Could you post the errors, please?

[oliverj777]

Yeah sorry - long day ...

 

 

syntax error, unexpected '{'

[hcdarkmage]

I see it now . . . long day here too, lol.

 

if(isset($form->error)){
   if($form->error == ("pass") && $form->error != ("user")){ //<--- Missed a )
       echo $form->error("pass");
   } else {
       echo $form->error("user");
   }
}

[DWilliams]

Yeah sorry - long day ...

 

 

syntax error, unexpected '{'

 

There's a closing ) missing after ("user") on the second line.

 

Although I don't see why you're surrounding your strings with parenthesis anyway, it should work just fine without. Parenthesis are generally used to change the order of operations which you don't need to do with just one comparison.

[oliverj777]

Okay, now it doesn't display any error at all .... 

 

[oliverj777]

It logs me in when I type in the correct details, but if I miss any fields ... nothing appears

[hcdarkmage]

Could you post the code where $form->error is getting set? The code I posted is looking for matches that may not be there.

[oliverj777]

class Form
{
   var $values = array();  //Holds submitted form field values
   var $errors = array();  //Holds submitted form error messages
   var $num_errors;   //The number of errors in submitted form

   /* Class constructor */
   function Form(){
      /**
       * Get form value and error arrays, used when there
       * is an error with a user-submitted form.
       */
      if(isset($_SESSION['value_array']) && isset($_SESSION['error_array'])){
         $this->values = $_SESSION['value_array'];
         $this->errors = $_SESSION['error_array'];
         $this->num_errors = count($this->errors);

         unset($_SESSION['value_array']);
         unset($_SESSION['error_array']);
      }
      else{
         $this->num_errors = 0;
      }
   }

   /**
    * setValue - Records the value typed into the given
    * form field by the user.
    */
   function setValue($field, $value){
      $this->values[$field] = $value;
   }

   /**
    * setError - Records new form error given the form
    * field name and the error message attached to it.
    */
   function setError($field, $errmsg){
      $this->errors[$field] = $errmsg;
      $this->num_errors = count($this->errors);
   }

   /**
    * value - Returns the value attached to the given
    * field, if none exists, the empty string is returned.
    */
   function value($field){
      if(array_key_exists($field,$this->values)){
         return htmlspecialchars(stripslashes($this->values[$field]));
      }else{
         return "";
      }
   }

   /**
    * error - Returns the error message attached to the
    * given field, if none exists, the empty string is returned.
    */
   function error($field){
      if(array_key_exists($field,$this->errors)){
         return '<div class="errormsg_index">'.$this->errors[$field].'</div>';
      }else{
         return "";
      }
   }

   /* getErrorArray - Returns the array of error messages */
   function getErrorArray(){
      return $this->errors;
   }
};

[hcdarkmage]

Cheaters cop out:

 

if(isset($form->error)){
   echo "There was a problem with your login. Username/Password incorrect.";
}

 

But that probably doesn't help.

[DWilliams]

For some reason my mind is blanking and I can't stay focused long enough to think why that isn't working but personally I would suggest doing it a little differently.

 

You probably don't need to tell the user which part of their login details are wrong. This potentially gives an attacker a bit more information since your script will essentially tell them they have a correct username. It's certainly not a big security risk but there's really not any reason to give out the extra information. Just withholding which part of their login details are incorrect exponentially multiplies the complexity of doing a blind brute force attack (although you should take steps other than this to guard against that).

 

Instead of what you're trying to do, have you considered just doing something like setting $hasErrors or whatever to true, then in place of your current code having

 

if($hasErrors)
   echo 'Invalid username and/or password';

[oliverj777]

Noooo, I'm only sending an error if the user has not ENTERED anything into the fields ...

 

Sorry for the misunderstanding

[hcdarkmage]

Okay let's try a new tactic:

 

if(isset($form->error)){
   if(($form->error = ("pass")) && !($form->error = ("user"))){
       echo $form->error("pass");
   } else {
       echo $form->error("user");
   }
}

[oliverj777]

Humm,

 

Still not working ... I really don't understand what is going wrong

 

:wtf: :wtf:

[oliverj777]

When i say its not working I mean that no error messages are being displayed at all ...

[hcdarkmage]

Son of monkey biscuits . . . I am having the hardest time figuring this out . . . I thought the last code would work. You would think that a simple if-else statement would solve your problem.

 

You may want to check if $form->error is being set by throwing some test text in the if statement and checking to see if it shows up.

 

something like:

if(isset($form->error)){
   echo "This is test 1.<br />";
   if(($form->error = ("pass")) && !($form->error = ("user"))){
       echo "This is test 2.<br />";
       echo $form->error("pass");
   } else {
       echo "This is test 3.<br />";
       echo $form->error("user");
   }
}

Just to see where it is failing, or if it is hitting those statements at all.

[oliverj777]

Again, does not display anything ... what the heck ... ahh don't worry about it, I'll just do it the cheap way 'error with username/password'

 

Cheers anyway guys