Click here to Skip to main content
15,891,777 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
<?php  
include("_dbconn.php");

$area = isset($_GET["area"])? $_GET["area"] : "";

// $area = str_replace("1", "Production Floor Access", $area);
// $area = str_replace("2", "Office Floor Access", $area);
// $area = str_replace("3", "Specific Access Doors", $area);

if(substr($area,-1) == "|"){
	$area = substr($area,0,-1);
}
$area_list = explode("|",$area);

// print_r($area_list);
$area_clause = " area_no in ('" . implode("','", $area_list) . "')";

$ary_approver = array(
  "Albert Chin"       => "albert.chin@example.com",
  "Alberto Leotti"    => "alberto.leotti@example.com",
  "Alex Koh"          => "alex.koh@eg.com",
  "Bala Subbu"        => "bala.subbu@eg.com",
  "Bertrand Seow"     => "bertrand.seow@eg.com",
  "Calvin Goh Chin Boon"     => "calvin.goh@eg.com",
  "Chan Boon Hock"           => "boon-hock.chan@eg.com",
  "Cheng Kear Yong"   => "kear-yong.cheng@eg.com",
  "Cheng Kong Meng"   => "kong-meng.cheng@eg.com",
  "Chia Yeow Chong"   => "yeowchong.chia@eg.com",
  "Chong Chan Sin"    => "chan-sin.chong@eg.com",
  "Daniel Tan"        => "yung-an.tan@eg.com",
  "Dominic Tay"       => "dominic.tay@eg.com",
  "Eddie Lim"         => "eddie.lim@eg.com",
  "Gordon Mckee"      => "gordon.mckee@eg.com",
  "Ignatius Ong"      => "ignatius.ong@eg.com",
  "Jacynthia Khor"    => "jacynthia.khor@eg.com",
  "Jasmine Yeo"       => "jasmine.yeo@eg.com",
  "Joe Tan"           => "joe.tan@eg.com",
  "Ken Leong"         => "ken.leong@eg.com",
  "Kim Myung Sung"    => "ms.kim@eg.com",
  "Lee Chee Kit"      => "chee-kit.lee@eg.com"
);


$sql = "Select distinct(approver_name) from access_request.tbl_access_area where ".$area_clause."";
$result = mysqli_query($conn,$sql);
//echo $result;

$cnt = 0;

echo "<table align=\"center\" border=\"0\" width=\"95%\" bordercolor=\"#DADADA\" cellpadding=\"3\" cellspacing=\"1\">\n";
echo  "<tr bgcolor=\"#F5F5F5\"><td align=\"left\" colspan=\"5\">\n";
    echo  "<font face=\"arial\" size=\"2\" color=\"#3C5F84\">  Approver  </font>";
    echo "       ";
	echo "<tr bgcolor=\"#F5F5F5\"><td align=\"left\" colspan=\"5\" style=\"
	display: grid;
	grid-template-columns: max-content max-content max-content max-content max-content max-content max-content max-content;
	grid-gap: 10px;
	margin-left:138px;
	margin-top:-23px;\">";

    while($row = mysqli_fetch_array($result)){
    	foreach($ary_approver as $k => $v){


    		if($k == $row["approver_name"]){
    			echo "<input type=\"checkbox\" id=\"chkApprover" . $cnt . "\" name=\"chkApprover[]\" value=\"$v\"><font face=\"arial\" size=\"2\" color=\"#3C5F84\">". $k . "</font>";
    			//echo "<br>           ";
    		}
    	}
    	$cnt++;
    }

    echo  "</td></tr>\n";
	echo  "</td></tr>\n";
    echo "<tr bgcolor=\"#F5F5F5\"></tr>\n";
    echo  "</table>\n";

?>


What I have tried:

Above codes are from full php and I will provide JS part in down below.
<pre>var alist = '';
    var list = document.getElementsByName('chkApprover[]');

    for ( i=0; i < list.length; i++ ) {   
      if (document.getElementById('chkApprover' + i).checked == true) {
        alist = alist + list[i].value + '|';
      }
    }

    if(alist == ""){
      alert("Please choose Approver !");
      return false;
    }
Posted
Comments
Richard Deeming 4-Apr-22 4:00am    
Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation/interpolation to build a SQL query. ALWAYS use a parameterized query.

PHP: SQL Injection - Manual[^]
PHP: Prepared statements and stored procedures - Manual[^]

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900