473,508 Members | 2,343 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Off-by-one error in display

Hi,

I am currently writing PHP code for some polling software. When someone
votes, it stores their IP address in the database. From then on, they
cannot vote in that particular poll, they only view the results. There
are several polls in the database, and there is a field called
"status". When it is 0, the poll is "active" and can be voted upon.
When it is 1, it is archived and one can only view the results.

But, there seems to be some kind of off-by one error. Here's an example
of how it goes. Say that I have two active polls, poll 1 and poll 2. If
I vote in poll 1, it displays what the results were prior to voting.
Then, if I vote in poll 2, it shows the correct results for poll 1, but
poll 2 still appears like you can vote in it. I have to cast a second
vote in poll 2 for the results to display. I hope that this makes
sense!

Anyway, here is my code. I am stumped; does anyone have any ideas?
Thanks in advance!!

<html>
<!-- Copyright @2004 -->
<!-- do whatever you want with it, just retain the copyright -->
<head>
<?php
// The file with various global settings
include "include.php";

// create connection
$conn = mysql_connect($hostname, $username, $password);
if (!$conn) {
die ("Couldn't connect to server : " . mysql_error());
}

// select database
$db = mysql_select_db($database, $conn);
if (!$db) {
die ("Couldn't select $database : " . mysql_error());
}

echo "</head>";
echo "<body>";

/* Create an array to mark active polls
so that we don't have to iterate through
the entire database table */

// Make array of all the active polls
$sql_active = "SELECT poll_ID FROM poll_titles WHERE status=0";

$sql_active_result = mysql_query($sql_active,$conn);
if (!$sql_active_result) {
die ("Couldn't execute query : " . mysql_error());
}

$j = 0; // keeps track of array index
while ($row = mysql_fetch_array($sql_active_result)) {

$arr_active[$j] = $row["poll_ID"];
$j++;

}

/* Print all the active polls */

// Variable for number of array items, to use for the for loop
$arr_max = $j;

for ($i=0; $i < $arr_max; $i++) {

// Get the poll title
$sql_title = "SELECT title AS title FROM poll_titles WHERE
poll_ID=$arr_active[$i]";

$sql_title_result = mysql_query($sql_title,$conn);
if (!$sql_title_result) {
die ("Couldn't execute query : " . mysql_error());
}

$row = mysql_fetch_array($sql_title_result);
$title = $row["title"];

if ($title) {
echo "<p><table bgcolor='#FF00AA'><tr><td align='center'
colspan='2'><b>$title</b></td></tr><tr><td><p></p></td></tr>";

// See if user has already voted
$sql_ip = "SELECT COUNT(*) AS count FROM visited_ips WHERE
ip='$REMOTE_ADDR' AND poll_ID=$arr_active[$i]";

$sql_ip_result = mysql_query($sql_ip,$conn);
if (!$sql_ip_result) {
die ("Couldn't execute query : " . mysql_error());
}

$row = mysql_fetch_array($sql_ip_result);
$count = $row["count"];

// Get options and votes
$sql_options = "SELECT options, votes, id, poll_ID FROM poll WHERE
poll_ID=$arr_active[$i]";

$sql_options_result = mysql_query($sql_options,$conn);
if (!$sql_options_result) {
die ("Couldn't execute query : " . mysql_error());
}

if (($count == 0) && ($_POST["hidden_id"] == $arr_active[$i])) {

/* See which value is checked */

// which poll was submitted?
$cur_poll = $_POST["hidden_id"];
$tmp = "group" . $cur_poll;
$val = $_POST[$tmp];

$sql_update = "UPDATE poll SET votes = votes + 1 WHERE ID = $val";
// execute the query
mysql_query($sql_update);

// add ip to visited_ips
$sql_visited = "INSERT INTO visited_ips (ip, poll_ID) VALUES
('$REMOTE_ADDR', $cur_poll)";
mysql_query($sql_visited);

echo "<tr><td align='left'><u>Option</u></td><td
align='right'><u>Votes</u></td></tr>";

while ($row = mysql_fetch_array($sql_options_result)) {

$option = $row["options"];
$votes = $row["votes"];
echo "<tr><td align='left'>$option: </td><td
align='right'>$votes</td></tr>";

}

echo "</table></p>";

}

// Display the poll if the user has not yet voted
else if (($count == 0) && ($_POST["hidden_id"] != $arr_active[$i])) {

echo "<form action='pollkitty.php' method='post'>";

while ($row = mysql_fetch_array($sql_options_result)) {

$option = $row["options"];
$id = $row["id"];
$poll_ID = $row["poll_ID"];

$groupname = "group" . $poll_ID;

echo "<tr><td align='left'><input type='radio' name='$groupname'
value='$id'>$option</td></tr>";
}

echo "<tr><td align='right'>
<input type='hidden' name='hidden_id' value='$poll_ID'>
<input type='Submit' value='submit'></td></tr>
</form>
</table></p>";

}

// Otherwise, if the user has already voted, display results
else {

echo "<tr><td align='left'><u>Option</u></td><td
align='right'><u>Votes</u></td></tr>";

while ($row = mysql_fetch_array($sql_options_result)) {

$option = $row["options"];
$votes = $row["votes"];
echo "<tr><td align='left'>$option: </td><td
align='right'>$votes</td></tr>";
}

echo "</table></p>";

}

}
}

echo "</body></html>";
?>

Jul 17 '05 #1
2 1953
.oO(erica)
I am currently writing PHP code for some polling software. When someone
votes, it stores their IP address in the database. From then on, they
cannot vote in that particular poll, they only view the results.


What about proxies?

Micha
Jul 17 '05 #2
I am currently writing PHP code for some polling software. When someone
votes, it stores their IP address in the database. From then on, they
cannot vote in that particular poll, they only view the results.
Wrong. Many users have different IP assigned each time they
connect to the web.
The chances are that you would block someone else, who didn't vote.

Use cookies for permanent 'ban' and use IP to block
for a limited amount of time only (2-5hrs?)

$conn = mysql_connect($hostname, $username, $password);
if (!$conn) {
die ("Couldn't connect to server : " . mysql_error());
}
That outputs text in <head> section.

// See if user has already voted
You first read data for polls and then add new vote.
Add new vote first.

// which poll was submitted?
$cur_poll = $_POST["hidden_id"];
$tmp = "group" . $cur_poll;
$val = $_POST[$tmp];

$sql_update = "UPDATE poll SET votes = votes + 1 WHERE ID = $val";
Think what will happen when I submit:
hidden_id = "0"
group0 = "1 OR 1"

$sql_visited = "INSERT INTO visited_ips (ip, poll_ID) VALUES
('$REMOTE_ADDR', $cur_poll)";
mysql_query($sql_visited);


This query may be manipulated too.

You blindly trust data from external source. This way you trust all
crackers out there.
If you expect number, make *sure* you've got a number.
Simple way: $number = (int)$number;
--
* html {redirect-to: url(http://browsehappy.pl);}
Jul 17 '05 #3

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

4
12401
by: Frank | last post by:
Whats best : register_globals ON ? OR register_globals OFF ? I currently use: $_POST
1
1375
by: kishor kotecha | last post by:
Hi, I have created a .net app. all works fine. but, i want to prevent closure (kill) of this app when the user of the machine does a 'log off' of windows/xp. currently what is happening...
2
7409
by: Alexander Schmidt | last post by:
Hi, I am not very familiar with C++ programming, so before I do a dirty hack I ask for a more elegant solution (but only the usage of STL is allowed, no special libs). So I need to read a file...
2
8977
by: scorp7355 | last post by:
I was wondering if there is some other way to turn autocomplete off besides using "autocomplete=off", using a meta tag or something similar. It would be great if there is some way to turn it off...
1
12314
by: Gaffer | last post by:
Is it possible to change the following code so that the music is 'off' when the page is loaded and the user gets the option to turn it on? ---------------------------------------------------...
17
2875
by: peter | last post by:
I just took over the website at work. I am still learning PHP. Register_globals are on and the script appears to be coded to take advantage of this. I know how to recode the script, but am unsure...
1
1033
by: - Steve - | last post by:
Two questions. 1. Is there a good way to include a log off button on every page on the site. Like using an include for a banner at the top or bottom. I tried to add it to my header banner but...
1
1576
by: robert112 | last post by:
Hi All, I have a webpage.aspx and a webusercontrol.ascx with both of them having viewstate turned off. Then in my web user control I have got some code reading the request stream: Dim str As...
5
1315
by: Michael Starberg | last post by:
cat, I wouldn't be worried about linq nor IDisposable. http://www.youtube.com/watch?v=MQ4vmSvCVbc Enjoy, and if you hate silly cats, at least the music is great! =) - Michael Starberg
16
2880
by: tvnaidu | last post by:
I have these two ON and OFF buttons html code below, based on condition I am displaying status on screen(I have mutliple lines for each LED), my row shifting when some displaying ON and some...
0
7123
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
0
7324
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
1
7042
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...
0
7495
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...
0
5627
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing,...
1
5052
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new...
0
3181
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
766
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
0
418
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.