• Hello,

    I have a very basic html form that queries a local database and returns the result to an iframe on the same page. The form works perfectly in preview mode, but once the page is published the form returns a theme generated 404 page to the iframe instead of the found result or default “code not found message”. Any thoughts as to why this may be? I have already tried clearing the browser and server cache. I do not use a plugin cache or CDN for this site.

    Here is the form’s HTML:

    <form action="wp-includes/keyLookup.php" method="post" target="hidden_code_frame">5 Digit Key Number:
    <input height="150px" name="input_keyNum" type="search" width="150px" /><input type="submit" value="Find Codes" /></form>
    <iframe name="hidden_code_frame" width="800" height="150" frameborder="0"></iframe>

    Here is the KeyLookup.php file with the connection credentials redacted:

    <?php
    
    //define connection variables
    $dbHost = ***
    $dbName = ***
    $dbUser = ***
    $dbPass = ***
    
    // Create host connection
    $conn = new mysqli($dbHost, $dbUser, $dbPass, $dbName);
    
    //test connection
    
    if ($conn->connect_error) {
      die("Connection failed :" . $conn->connect_error);
    }
    
    $value = $_POST["input_keyNum"];
    
    //echo $value; 
    
    $sql = "SELECT serverCode FROM tbl_codes WHERE keyNumber = " . $value;
    
    $result = $conn->query($sql); 
    
    if ($result->num_rows > 0) {
      while($row = $result->fetch_assoc()) {
        echo "<h1>" . $row["serverCode"] . "</h1>";
        //echo $row["serverCode"]
      } 
    } else {
        echo "<h1>Codes Not Found</h1>";
    }
    
    $conn->close();
    
    ?>
    • This topic was modified 7 years, 5 months ago by bcworkz. Reason: code fixed

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • Hopefully you will be putting some security checks in there.
    The problem is that your form has a relative path, and won’t find the proper file that way.

    Thread Starter jfriedley

    (@jfriedley)

    Thank you Joy. That makes sense. As far as security goes the site itself uses the All-In-One-Intranet plugin that forces our users to log in to access any pages. Is there a security issue you had in mind that should still be addressed?

    Thanks,

    Yes, the code doesn’t sanitize the inputs, would let anyone access it (even without WP), and doesn’t escape the output.

    Thread Starter jfriedley

    (@jfriedley)

    thank you

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Update an iframe with a custom form’ is closed to new replies.