Problem with Form and Select

[Discord]

I'm having some problems with my forum code.. the idea is simple i display a form that has a select. Inside there are the name some forums (for testing i called it item1 2 ect..). The user selects the item then hits submit. Then the page re-displays itself with all the items from the forum.. But for some reason whenever i hit submit nothing happens... globals are on i beleive.. i just can't seem to figure this one out.. any help would be appreciated

in my form block i have

	<form action="<?php echo $PHP_SELF?>" method="post" enctype="multipart/form-data">
	<SELECT Name="program">
	<OPTION VALUE="Item1">Item1
	<OPTION VALUE="Item2">Item2
	<OPTION VALUE="Item3">Item3
	<OPTION VALUE="Item4">Item4
	</SELECT>
	<input type="submit" name="submit" value="Do it!">
	</form>

Then inside the submit code i have

<?php

if ($submit) {


// Connects to database
$db = mysql_connect("localhost", "root") or die (mysql_error());
mysql_select_db("MYDB", $db);

$uname = $_GET['u'];
$pass = $_GET['p'];

 $selq = "Select user_id from phpbb_users where username='";
 $selq .= $user;
 $selq .= "' AND user_password='";
 $selq .= $pass;
 $selq .= "'";


// Double check username/pass again...
 $result = mysql_query($selq, $db);
 while ($myrow = mysql_fetch_row($result))
 {
	 $uid = $myrow[0];
 }

// direct outta here if its wrong....
if ($uid <=0) {
header ("Location: index.php");
}

// Display the downloads
$action = "SELECT forum_id FROM phpbb_forums WHERE forum_name='";
$action .= $program;
$action .= "'";


$result = mysql_query($action, $db);
while ($myrow = mysql_fetch_row($result))
{
	$fid = $myrow[0];
}
$qpids = "SELECT post_id FROM phpbb_posts WHERE forum_id=";
$qpids .= $fid;
$qpids .= " ORDER BY post_time DESC LIMIT 10";                    // CHANGE TO HOWEVER MANY YOU WANT RETURNED (this is the number of articles that will show on the lead page)

$res2 = mysql_query($qpids);
while ($rpids =@ mysql_fetch_array($res2))
{

	// -- Third get the forum subject and text from the post_id
	$qpost = "SELECT post_subject, post_text FROM phpbb_posts_text WHERE post_id=";
	$qpost .= $rpids[0];

		$res3 = mysql_query($qpost);
		while ($rpost = mysql_fetch_row($res3))
		{

			echo "<TABLE WIDTH=450 ALIGN=CENTER CELLSPACING=4 CELLPADDING=4 STYLE='border: 1px #151c20 solid'><TR><TD BGCOLOR=#0b5791 width=450><P align=left><IMG SRC=images/news.gif align=left><FONT Size=2>&#32;&#32;&#32;&#32;&#32;<B>";
		echo str_replace(array("&gt;", "&lt;", "&quot;", "&amp;"), array(">", "<", "\"", "&"), $rpost[0]);
		echo "</FONT></B></P><TD><TR width=450><TR><TD width=450><P>";
		echo str_replace(array("&gt;", "&lt;", "&quot;", "&amp;"), array(">", "<", "\"", "&"), $rpost[1]);
		echo "</P></TD></TR></TABLE><BR>";

		}
		mysql_free_result($res3);
}
mysql_free_result($res2);

// Close the db connection
mysql_close();
}

?>

[zhabala]

You are probably doing something strange.

You are sending the forum value from form with method="POST".

<form action="<?php echo $PHP_SELF?>" method="post" enctype="multipart/form-data">

And later in the script you are looking for user and pasword in $_GET super global array.

$uname = $_GET['u'];
$pass = $_GET['p'];

so the $uname and $pass are not probably set up and then it looks like it is doing nothing.

[zhabala]

Another mistake probably is that the select statement tries to use the $user variable, but you are filling the $uname variable

 $uname = $_GET['u'];
 $pass = $_GET['p'];

 $selq = "Select user_id from phpbb_users where username='";
 $selq .= $user;
 $selq .= "' AND user_password='";
 $selq .= $pass;
 $selq .= "'";

[Discord]

what would be an alternative action to correct the variables not being set?

[zhabala]

You have to store the logged user in the SESSION or you have to use the <INPUT TYPE='hidden' name='uname' value='username'>
and the same for the password, but it is unsecure because the page source code will contain the username and password so take a look a the sessions.

Zdenek