0

The project that I'm working on have a user login section. Once the user logged in, they should be able to see a list of orders that they made in the past which are stored in the database. The list view is done by a foreach function. In this case, the user must be able to rebook any of those past order by one click and it should send the same data back to the database as a new row or duplicate the same row with a new id. My code looks like this:

<form method="post" action="">           
 foreach ( $row as $row ){ ?>
    <div> Previous Trip from:
    <?php echo $row-> your_departing .' to : '.$row-> your_destination; ?>
    <?php $depart = $row-> your_departing;
          $dest = $row-> your_destination;
          ?>
      <button type="submit" name="rebook" class="signupbtn">REBOOK</button>
    </div>

<?php  }    ?>
</form>

 if ( isset( $_POST["rebook"] ) != "" ) {
      $table = $wpdb->prefix."Savedata";
      $wpdb->insert(
          $table,
          array(
              'your_destination' => $dest,
              'your_departing' => $depart
          )
      );
  }
 ?>

I wrote this code to insert the data as a new row. Do I miss something in the code? Can anyone suggest an easy way to get this done? Any helps would be great. Thanks

1
  • Sorry not an answer, just a comment. why don't you use the wordpress abstraction ? User information could be saved in a CPT, post meta or user meta, and then you use wordpress functions such as get_posts, get_user_meta, get_post_meta for retrieving the info, and wp_insert_post / wp_update_post / update_post_meta / update_user_meta to save or update user information. Oct 15, 2019 at 0:26

2 Answers 2

0

To insert something to database you should send data with post request, get this data from request and save it. You created code which will insert last row of your loop on post request.

You should create form for each of your previous trip and add hidden input fields to have the opportunity to get them on post request.

<?php
    // Handling request and saving to database should not be in template,
    // but for the simplicity of the example I will leave it here.
    if( isset( $_POST['rebook'] ) ) {

        // Get value from $_POST array secure way after sanitization
        $destination = filter_input( INPUT_POST, 'destination', FILTER_SANITIZE_STRING );
        $departing   = filter_input( INPUT_POST, 'departing', FILTER_SANITIZE_STRING );

        $table = $wpdb->prefix . "table_name";
        $wpdb->insert(
            $table,
            array(
              'your_destination' => $destination,
              'your_departing' => $departing
            )
        );
    }
?>
 <?php $rows = array(); // Get data from database ?>
 <?php foreach ( $rows as $row ): // Iterate over data ?>
    <?php
        // Create form for each previous trip to that
        // there would be an opportunity to save each
    ?>
    <form method="post" action="">
        <div> Previous Trip from:

          <?php echo $row->your_departing .' to : '.$row->your_destination; ?>
          <?php // Create hidden fields to send 'departing' and 'destination' with $_POST data  ?>
          <input type="hidden" name="departing" value="<?php esc_attr( $row->your_departing ); ?>">
          <input type="hidden" name="destination" value="<?php esc_attr( $row->your_destination ); ?>">

          <button type="submit" name="rebook" class="signupbtn">REBOOK</button>

        </div>
    </form>
<?php endforeach; ?>
-1

There is a better way to do that. It is not that your approach is wrong. But you can write code like this to insert data, passing the $format third argument to $wpdb->insert. Which will be more secure.

    if ( empty( $row->your_departing ) || empty( $row->your_destination ) ) {
        return; // Retrun if your_departing or your_destination one of these are empty
    }

    $defaults = array(
        'your_destination' => '',
        'your_departing'  => '',
    );

    $args = array(
        'your_destination' => $row->your_departing;
        'your_departing' => $row->your_destination;
    );

    $data = wp_parse_args( $args, $defaults );

    $wpdb->insert(
            $wpdb->prefix . 'Savedata',
            $data,
            array(
                '%s',
                '%s',
            )
    ); // the %s will ensure these two values should be the string

You can look into the doc here for more details.

3
  • You've linked to the wpdb->insert docs but the other answer and the original code both use that don't they? The thing you've changed is wp_parse_args I think. Is that what you're saying is more secure?
    – Rup
    Nov 9, 2022 at 11:28
  • Hello @Rup, Have you noticed that I have added a third parameter inside the insert method which is an array describing the data types you are providing? That one is for security purposes. I am talking about the array below. array('%s', '%s' ) Nov 9, 2022 at 12:54
  • Yes fair enough. That's probably worth pointing out in the answer.
    – Rup
    Nov 10, 2022 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.