Tabulating the Results
Next we create the PHP routines to tabulate the votes. These will go into the file showvotes.php. First I am going to discuss the SQL queries that make up the core of showvotes.php, then I will display the script in its entirety.
The first step is to add the current vote to the total for the appropriate answer. Since the form will allow users to see the vote totals without voting themselves, we must first check to see if the variable $_POST['vote'] exists. If it is not set, we won't want to add a vote.
<?php
if(isset($_POST['vote']) && ctype_digit($_POST['vote'])) {
$query = 'UPDATE poll_answers SET votes=votes+1';
$query .= ' WHERE choice=' . $_POST['vote'];
$result = mysql_query($query);
}
?>
In addition to checking whether the variable exists, we need to be sure that it is numeric. Although our form contains only numeric values, a malicious user could create a form (even on a different web domain) that points to showvotes.php and sends a bad value, or even an additional query, to MySQL. The function ctype_digit() checks the variable to see if every character is a decimal digit. If $_POST['vote'] contains any non-numeric characters, the update query will not be executed.
This provides some security but is not the most efficient. A more robust way to check the validity of the data would be to query the database to get the actual number of choices, assign this total to a variable, say $count, and then change the if() statement to:
<?php
if(isset($_POST['vote']) && $_POST['vote'] > 0 && $_POST['vote'] <= $count) {
...
?>
This would prevent the user from sending the value '9' to MySQL if the poll had 8 choices. Using ctype_digit(), the query would still run but would not update any rows.
Once we've added the vote we will need to retrieve both the number of votes for each choice and the total number of votes cast. We'll get the sum of the vote totals from the database first.
<?php
$num_votes_query = 'SELECT SUM(votes) AS sumvotes';
$num_votes_query .= ' FROM poll_answers';
if ($result = mysql_query($num_votes_query)) {
$row = mysql_fetch_array($result);
$sum = $row['sumvotes'];
}
?>
It is possible to eliminate the query to obtain the sum of the votes, run just the query to get the votes for each choice and calculate the overall total using PHP. That would make less work for the database server, but would also require more processing and more data storage for the PHP engine, as well as more coding. For your own polls you can use either method; just be aware of the tradeoffs involved.
Finally, we run the query to get the choices and vote totals. Because we already know the total number of votes, we can calculate the percentage for each choice as we read its row.
<?php
$totals_query = 'SELECT activity, votes FROM poll_answers ';
if ($result = mysql_query($totals_query)) {
print "<table>\n";
print "<tr><th>Activity</th>\n";
print "<th colspan=\"2\" align=\"center\">Votes</th></tr>\n";
while($row = mysql_fetch_array($result)) {
print "<tr><td>" . $row['activity'] . "</td>\n";
print "<td align=\"right\">" . $row[1] . "</td>\n";
if($sum) {
$percent = round($row['votes'] * 100 / $sum);
print "</tr>\n<tr><td>";
print "<img src=\"bargraph.php?pct=$percent\"></td>\n";
print "<td align=\"right\">" . $percent . "%</td>\n";
}
print "</tr>\n";
}
print "</table>\n";
}
?>
The results are outputted into a table. Each row from the database becomes two rows in the html table. As each choice is read from the database, the description and number of votes are inserted into the table. Then the bargraph and percentage are added below.
The if($sum) line checks to see whether the total number of votes is greater than zero. Without this check, we would have a divide by zero error displayed in our results. That's usually not desirable, so, if no vote have been cast, we won't calculate the percentages.
Source:
http://codewalkers.com/tutorials/92/4.html