Dynamic Search/Results on same page - HELP!

Question

Here is my situation; any help will be GREATLY
appreciated!!!!!
- I have dynamic content using PHP/MySQL
- I am attempting to create a record insertion page
- within this page, I need the ability to querry the
database and display the results on the same page and then use the
results as a part of the record insertion/creation.
So - I have many students, who are assigned a unique student
number and I am creating a reservation system. The person entering
the reservation will enter in the student id (as opposed to their
name) and hit a 'find' button and the result, if found, will be
displayed in a dynamic text field. Then, they fill out the rest of
the info and submit the reservation which gets stored into the
database.
I have played around for a few hours now because I have no
idea how to do this and have just been using trial and error. Can
anyone PLEASE point me in the right direction?
Thanks a bunch!!!
Mav

Answer 1

I agree, this approach does not seem secure.
Seems like I could keep trying different ID's until I found
one and then
enter reservations under someone else's name and cause havoc
on the system.
"David Powers" <[email protected]> wrote in message
news:eqhvig$h0t$[email protected]..
> mavrickjcs wrote:
>> So - I have many students, who are assigned a unique
student number and
>> I am creating a reservation system. The person
entering the reservation
>> will enter in the student id (as opposed to their
name) and hit a 'find'
>> button and the result, if found, will be displayed
in a dynamic text
>> field. Then, they fill out the rest of the info and
submit the
>> reservation which gets stored into the database.
>
> I'm not convinced that your approach is the best way,
but it's quite
> simple to do what you want.
>
> Create two forms on the page: one for searching for the
details, the
> second for creating the reservation. Use a conditional
statement to hide
> the second form until the first form has been submitted.
You'll need to do
> this by hand, but it's very easy.
>
> if (isset($row_recordsetName)) {
> // this is where the second form goes
> }
>
> Replace "recordsetName" with the actual name of the
recordset.
>
> --
> David Powers, Adobe Community Expert
> Author, "Foundation PHP for Dreamweaver 8" (friends of
ED)
> Author, "PHP Solutions" (friends of ED)
>
http://foundationphp.com/