<?php
session_start();
if(!$_SESSION['username']) {
//not logged in. redirect to login page
header("Location: login.php");
exit;
}
$address = "localhost";
$username = "myuser";
$password = "mypass";
$database = "mydb";
mysql_connect($address,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
</head>
<body>
<?php
echo "<strong>You are logged in as:</strong> " . $_SESSION['username'];
?>
<p>Please answer all questions. For blank fields, please enter <strong>N/A</strong>.</p>
<p>Fields marked with an asterisk (<span class="warning">*</span>) must be completed.</p>
<?php
if (!isset($_POST['submit'])) {
?>
<form action="" method="post">
//HTML FORM HERE
</form>
<?php
$uniqueValue = mysql_real_escape_string($_POST['hotel_name']);
$query = "SELECT `hotel_name` FROM `survey` WHERE `hotel_name` = '$uniqueValue'";
$result = mysql_query($query);
$rowCount = mysql_num_rows($result);
if ($rowCount > 0)
{
// Error logic.
echo '<input type="text" name="hotel_name" value="'.htmlentities($_POST['hotel_name']).'">';
}
else
{
// Carry on with the script.
}
} else {
$hotel_name = mysql_real_escape_string($_POST['hotel_name']);
$contact = mysql_real_escape_string($_POST['contact_name']);
$telephone = mysql_real_escape_string($_POST['telephone']);
$do = mysql_real_escape_string($_POST['do']);
$have = mysql_real_escape_string($_POST['have']);
mysql_query("INSERT INTO `survey` (hotel_name, contact, telephone, do, have) VALUES
('$hotel_name','$contact','$telephone','$do','$have')");
echo "Thank you! Your survey is now complete and the information has been submitted";
}
mysql_close();
?>
</body>
</html>