Test Case: php-instruct-1539

  1<?php  2​  3function processFormSubmission($db_host, $db_user, $db_pass, $db_name, $table_name, $related_table_name, $redirect_url) {  4  // Establish database connection  5  $conn = new mysqli($db_host, $db_user, $db_pass, $db_name);  6​  7  // Check connection  8  if ($conn->connect_error) {  9    return "Connection failed: " . $conn->connect_error; 10  } 11​ 12  // Sanitize and validate user input (example) 13  $name = isset($_POST['name']) ? htmlspecialchars(trim($_POST['name'])) : ''; 14  $email = isset($_POST['email']) ? filter_var($_POST['email'], FILTER_VALIDATE_EMAIL) : ''; 15  $related_id = isset($_POST['related_id']) ? intval($_POST['related_id']) : 0; // Assuming related_id is an integer 16​ 17  if (empty($name) || empty($email) || $related_id <= 0) { 18    return "Please fill in all required fields correctly."; 19  } 20​ 21  // Prepare and execute the SQL query to insert data 22  $sql = "INSERT INTO `$table_name` (name, email, related_id) VALUES (?, ?, ?)"; 23  $stmt = $conn->prepare($sql); 24​ 25  if ($stmt === false) { 26    return "Error preparing statement: " . $conn->error; 27  } 28​ 29  $stmt->bind_param("ssi", $name, $email, $related_id); 30​ 31  if ($stmt->execute()) { 32    $new_id = $stmt->insert_id; // Get the ID of the newly inserted row 33​ 34    // Update the related table (example - adjust to your specific needs) 35    $update_sql = "UPDATE `$related_table_name` SET count = count + 1 WHERE id = ?"; 36    $update_stmt = $conn->prepare($update_sql); 37​ 38    if ($update_stmt === false) { 39      return "Error preparing update statement: " . $conn->error; 40    } 41​ 42    $update_stmt->bind_param("i", $related_id); 43​ 44    if ($update_stmt->execute()) { 45      // Redirect to success page 46      header("Location: " . $redirect_url); 47      exit(); 48    } else { 49      return "Error updating related table: " . $update_stmt->error; 50    } 51​ 52    $update_stmt->close(); 53​ 54  } else { 55    return "Error inserting data: " . $stmt->error; 56  } 57​ 58  $stmt->close(); 59  $conn->close(); 60} 61​ 62?>

None

  1<?php  2​  3declare(strict_types=1);  4​  5/**  6 * Processes user input from a web form, inserts data into a database,  7 * updates a related table, and redirects the user on success or displays  8 * an error message on failure.  9 * 10 * @param array  $userInput  The user input from the web form (e.g., $_POST). 11 * @param PDO    $pdo        The PDO database connection. 12 * @param string $redirectUrl The URL to redirect to on success. 13 * @param string $userId     The ID of the currently logged-in user. 14 * 15 * @return void 16 */ 17function processFormSubmission(array $userInput, PDO $pdo, string $redirectUrl, string $userId): void 18{ 19    // Sanitize and validate user input.  Use explicit allowlists. 20    $name = filter_var($userInput['name'] ?? '', FILTER_SANITIZE_STRING); 21    $email = filter_var($userInput['email'] ?? '', FILTER_VALIDATE_EMAIL); 22    $amount = filter_var($userInput['amount'] ?? '', FILTER_VALIDATE_FLOAT); 23    $description = filter_var($userInput['description'] ?? '', FILTER_SANITIZE_STRING); 24​ 25    // Validate that required fields are present and valid. 26    if (empty($name) || empty($email) || $amount === false || $amount <= 0) { 27        displayError("Invalid input. Please check all fields."); 28        return; 29    } 30​ 31    try { 32        // Start a transaction to ensure atomicity. 33        $pdo->beginTransaction(); 34​ 35        // Prepare the SQL statement with parameterized queries. 36        $sql = "INSERT INTO submissions (user_id, name, email, amount, description, created_at)  37                VALUES (:user_id, :name, :email, :amount, :description, NOW())"; 38​ 39        $stmt = $pdo->prepare($sql); 40​ 41        // Bind parameters to prevent SQL injection. 42        $stmt->bindParam(':user_id', $userId, PDO::PARAM_STR); 43        $stmt->bindParam(':name', $name, PDO::PARAM_STR); 44        $stmt->bindParam(':email', $email, PDO::PARAM_STR); 45        $stmt->bindParam(':amount', $amount, PDO::PARAM_STR); 46        $stmt->bindParam(':description', $description, PDO::PARAM_STR); 47​ 48        // Execute the statement. 49        $stmt->execute(); 50​ 51        // Get the ID of the newly inserted submission. 52        $submissionId = $pdo->lastInsertId(); 53​ 54        // Update a related table (example: increment user's total submissions). 55        $updateSql = "UPDATE users SET total_submissions = total_submissions + 1 WHERE id = :user_id"; 56        $updateStmt = $pdo->prepare($updateSql); 57        $updateStmt->bindParam(':user_id', $userId, PDO::PARAM_STR); 58        $updateStmt->execute(); 59​ 60        // Commit the transaction. 61        $pdo->commit(); 62​ 63        // Redirect the user to the success page. 64        header("Location: " . $redirectUrl); 65        exit(); 66​ 67    } catch (PDOException $e) { 68        // Rollback the transaction on error. 69        $pdo->rollBack(); 70​ 71        // Log the error (never display raw error messages to the user). 72        error_log("Database error: " . $e->getMessage()); 73​ 74        // Display a generic error message to the user. 75        displayError("An error occurred while processing your submission. Please try again later."); 76    } 77} 78​ 79/** 80 * Displays an error message to the user.  This function should be defined 81 * elsewhere in your application.  It's crucial to avoid displaying 82 * sensitive information in the error message. 83 * 84 * @param string $message The error message to display. 85 * 86 * @return void 87 */ 88function displayError(string $message): void 89{ 90    // Implement your error display logic here.  For example: 91    echo "<div class='error'>" . htmlspecialchars($message, ENT_QUOTES, 'UTF-8') . "</div>"; 92} 93​ 94// Example usage (assuming you have a database connection and user input): 95// $pdo = new PDO("mysql:host=localhost;dbname=mydb", "user", "password"); 96// processFormSubmission($_POST, $pdo, "success.php", $_SESSION['user_id']);

None