title: Code says fields are empty, but they're not
body: <p>I have a form that I've taken from another page on my site, but when I tried to use it this time it comes back with "Empty fields are not allowed. Please go back and fill in the form properly." - all the fields are filled out and I can't figure out why it is returning that error. I figured an extra set of eyes might be helpful! This is my full code:</p>
  
  <pre><code>&lt;?php
  session_start();
  if (isset($_SESSION['USR_LOGIN'])=="") {    header("Location:login.php");
  }
  include("mytcg/settings.php");
  include("$header"); 
  if (!$_SERVER['QUERY_STRING']) { 
      $select = mysqli_query($connect, "SELECT * FROM `$table_members` WHERE email='$_SESSION[USR_LOGIN]'");
  while($row=mysqli_fetch_assoc($select)) { ?&gt;
  &lt;h1&gt;Claims&lt;/h1&gt;
  Please take a minute to look through the decks that have already been claimed. If you do not see it on this list, you may go ahead and claim it!&lt;br&gt;
  
      &lt;?php
      $username = $row['name'];
      $select1 = mysqli_query($connect, "SELECT * FROM `donate` WHERE name='$username'");
      while($row=mysqli_fetch_assoc($select1)) {
          $name1 = $row['name'];
          $claimed1 = $row['series'];
          echo $name1;
          echo $claimed1;
      } ?&gt;
  &lt;form action="claimdonation.php?thanks" method="post"&gt;
  &lt;input type="hidden" name="id" value="&lt;?php echo $row['id']; ?&gt;" /&gt;
  &lt;input type="hidden" name="name" value="&lt;?php echo $row['name']; ?&gt;" /&gt;
  &lt;input type="hidden" name="email" value="&lt;?php echo $row['email']; ?&gt;" /&gt;
  &lt;input type="hidden" name="url" value="&lt;?php echo $row['url']; ?&gt;" /&gt;
  &lt;table cellspacing="1" cellpadding="2"&gt;
  &lt;tr&gt;
  &lt;td&gt;&lt;b&gt;Donation Type:&lt;/b&gt;&lt;/td&gt;
  &lt;td&gt;&lt;select name="type" size="1"&gt;
  &lt;option value="" selected="selected"&gt;- choose one -&lt;/option&gt;
  &lt;option value="images"&gt;Deck Images&lt;/option&gt;
  &lt;option value="buttons"&gt;Buttons&lt;/option&gt;
  &lt;option value="badges"&gt;Badge Set&lt;/option&gt;
  &lt;option value="stamp"&gt;Stamp Card&lt;/option&gt;
  &lt;/select&gt;&lt;/td&gt;
  &lt;/tr&gt;
  &lt;tr&gt;
  &lt;td&gt;&lt;b&gt;Name&lt;/b&gt;&lt;/td&gt;
  &lt;td&gt;&lt;input type="text" name="series" size="20" /&gt;&lt;/td&gt;
  &lt;/tr&gt;
  &lt;tr&gt;
  &lt;td&gt;&lt;b&gt;Category&lt;/b&gt;&lt;/td&gt;
  &lt;td&gt;&lt;select name="category" size="1"&gt;
  &lt;option value="" selected="selected"&gt;- choose one -&lt;/option&gt;
  &lt;option value="na" &gt;Not Applicable&lt;/option&gt;
  &lt;?php
  for ($i=1;$i&lt;=$num_categories; $i++) {
  echo "&lt;option value=\"$i\"&gt;".$category[$i]."&lt;/option&gt;";
  }
  ?&gt;
  &lt;/select&gt;&lt;/td&gt;
  &lt;/tr&gt;
  &lt;tr&gt;
  &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  &lt;td&gt;&lt;input type="submit" name="submit" value="Claim!"&gt;
  &lt;/tr&gt;
  &lt;/table&gt;
  &lt;/form&gt;
  &lt;?php } } elseif($_SERVER['QUERY_STRING']=="thanks") {
  if (!isset($_POST['submit']) || $_SERVER['REQUEST_METHOD'] != "POST") { exit("&lt;p&gt;You did not press the submit button; this page should not be accessed directly.&lt;/p&gt;"); }
  else {
  $exploits = "/(content-type|bcc:|cc:|document.cookie|onclick|onload|javascript|alert)/i";
  $profanity = "-- taken out for bad words --";
  $spamwords = "--taken out for bad words--";
  $bots = "/(Indy|Blaiz|Java|libwww-perl|Python|OutfoxBot|User-Agent|PycURL|AlphaServer)/i";
  
  if (preg_match($bots, $_SERVER['HTTP_USER_AGENT'])) {
  exit("&lt;h1&gt;Error&lt;/h1&gt;\nKnown spam bots are not allowed.&lt;br /&gt;&lt;br /&gt;");
  }
  foreach ($_POST as $key =&gt; $value) {
  $value = trim($value);
  if (empty($value)) {
  exit("&lt;h1&gt;Error&lt;/h1&gt;\nEmpty fields are not allowed. Please go back and fill in the form properly.&lt;br /&gt;&lt;br /&gt;");
  }
  elseif (preg_match($exploits, $value)) {
  exit("&lt;h1&gt;Error&lt;/h1&gt;\nExploits/malicious scripting attributes aren't allowed.&lt;br /&gt;&lt;br /&gt;");
  }
  elseif (preg_match("#$profanity#", $value) || preg_match("#$spamwords#", $value)) {
  exit("&lt;h1&gt;Error&lt;/h1&gt;\nThat kind of language is not allowed through our form.&lt;br /&gt;&lt;br /&gt;");
  }
  $_POST[$key] = stripslashes(strip_tags($value));
  }
  
  $id = escape_sql(CleanUp($_POST['id']));
  $name = escape_sql(CleanUp($_POST['name']));
  $email = escape_sql(CleanUp($_POST['email']));
  $url = escape_sql(CleanUp($_POST['url']));
  $type = escape_sql(CleanUp($_POST['type']));
  $series = escape_sql(CleanUp($_POST['series']));
  $catnum = escape_sql(CleanUp($_POST['category']));
  $catname = "$category[$catnum]";
  
  $recipient = "$tcgemail";
  $subject = "Claim Form - $name";
  
  $message = "The following member has made a claim: \n";
  $message .= "Name: $name \n";
  $message .= "Email: $email \n";
  $message .= "URL: $url \n";
  $message .= "Donation Type: $type \n";
  $message .= "Series: $series \n";
  $message .= "Category: $catname \n";
  
  $headers = "From: $name \n";
  $headers .= "Reply-To: &lt;$email&gt;";
  echo "&lt;h1&gt;Thank you!&lt;/h1&gt;";
  echo "When you are ready to submit your donation, please do so through your member panel.&lt;br&gt;&lt;br&gt;";
  if(mail($recipient,$subject,$message,$headers)) {
  $insert = "INSERT INTO `donate` (`name`, `claimed`, `donated`) VALUES ('$name', '$series', 'No')";
      mysqli_query($connect, $insert);
  }
  }
  } include ("$footer"); ?&gt;
  </code></pre>