[Resolved] Grabbing <select> value from form

[AcousticJames]

Greetings, all! Just signed up, hoping to spend some time getting and giving what info I can. Here's my question.

I have a simple form with a select box populated by the result from a database query. All that is working fine. What I would like to do is to send the value of whatever was selected in the box (no multiple selection, single selection only) and display it on the next page. Here's my relevant code:

// add_show.php

$db = mysql_connect($dbhost, $dbuser, $dbpass); // defined in separate include file
mysql_select_db($dbname, $db); // defined in separate include file
$result = mysql_query("SELECT * FROM lists", $db);

if ($row = mysql_fetch_array($result)) {
	echo "<form action=\"add_show2.php\" method=\"post\">";
	echo "<center>Please select a collection:&nbsp;&nbsp;&nbsp;";
	echo "<select name=\"list\">";
	do {
		printf("<option value=\"%s\">%s</option>", $row["list_name"], $row["value"]);
	} while ($row = mysql_fetch_array($result));

echo "</select>";
echo "<p><input type=\"submit\" name=\"submit\" value=\"Submit!\">";
echo "</form>";
}
else {
	echo "There are no lists found in the database";
}

The above works fine, the select box is filled appropriately. It's the next part I'm not sure on:

// add_show2.php

$formvar = $_POST["list"]; // is that right?

$db = mysql_connect($dbhost, $dbuser, $dbpass);
mysql_select_db($dbname, $db);
$result = mysql_query("SELECT value FROM lists WHERE list_name = $formvar", $db); // is that right too?

$finalvar = mysql_fetch_array($result);

printf("You selected: %s!", $finalvar["value"]);

When I click submit, all I see on add_show2.php is "You selected !". So I'm obviously missing something probably rather basic. A push in the right direction would be much appreciated. Thanks!

James

[AcousticJames]

Figured it out. Looks like all I forgot to do was this:

$result = mysql_query("SELECT value FROM lists WHERE list_name = '$formvar'", $db);

Simply forgot to put single quotes around $formvar. Also found out that "$_POST["list"]; is the selected value from the select. Sorry for the disturbance.

James

[Drakla]

If the values in the select are strings then you need to quote them in the query, so

"SELECT value FROM lists WHERE list_name = $formvar"

would become

"SELECT value FROM lists WHERE list_name = '$formvar'"

Also depending on whether you've got magic quotes on, you might have to use mysql_escape_string on the string value before it goes into the query to escape any quotes and things that would essentially 'break' the query. Like this:

if (!get_magic_quotes_gpc())
{
    $formvar = mysql_escape_string($formvar);
}

Any script you're having trouble with put error_reporting(E_ALL); as soon as you can so you get all error messages, as your install might be supressing the mysql error

[AcousticJames]

Hehe, must've beat you by a matter of seconds, Drakla! Thanks for the info on magic_quotes. Right now, I was just trying to get my code to work using a "controlled" environment. I make sure it works correctly first, then I do all the little validation things (like magic quotes, etc.) after it's working properly.

And thanks for the tip on error reporting. I'll have to remember that.

James