[RESOLVED] passing info from html to Php

[Fat_Colin]

Hi there,
I'm trying to pass info from a "Drop list" in an .html form into a .php which will then query a database. It doesn't work and I wondered if I'm missing something easy? If I junk the dropdown list and just put a "textfield" there is no problem but I want to have the fixed choices list. Here is the code:-

<form id="form1" name="form1" method="post" action="bindex.php">
<p>
<select name="firstname" id="firstname">
<option value="Colin" selected="selected">Colin</option>
<option value="Christophe">Christophe</option>
<option value="Neill">Neill</option>
<option value="Robbie">Robbie</option>
</select>
</p>
<p>
<input type="submit" name="Submit" value="Submit" />
</p>
<p>&nbsp;</p>
</form>

.....and the Php code....

$dbcnx = @mysql_connect('localhost', 'mydb', 'mypassword');
if (!$dbcnx){
echo ('<p>Unable to connect to the server at this time.</p>');
exit();
}

// Select birthday database
mysql_select_db('mydb', $dbcnx);
if (!@mysql_select_db('mydb')){
exit('<p>Unable to connect to database at this time.</p>');
}

//check value
$result = mysql_query("SELECT * from birthdays WHERE firstname='$firstname' ");
$worked = mysql_fetch_array($result);

$firstname = $worked[firstname];
$lastname = $worked[lastname];
$birthday = $worked[birthday];

if($worked){
echo " $firstname $lastname, $birthday ";
}
?>

Anyone any ideas? Thanks in advance

Fat Colin

[vamsee]

Hello Colin,

Do you have registered globals 'ON' on your server. If yes then you need to explicitly declare the variables.

I mean as you are using the method post in the form you have accept in the action form as also post. This a serious restriction in PHP when register globals are ON.

so your sql query would be

$result = mysql_query("SELECT * from birthdays WHERE firstname=$_POST['firstname'] ");
$worked = mysql_fetch_array($result);

[xblue]

It is good advice to always use $GET['something'] and $POST['something']. Also, the way you put it now, the content of the text field would overwrite the content of the select since the are both named "firstname".

[Fat_Colin]

Hi and thanks for your input. I reckon GLOBALS will be off as it is a standard installation with a UK webhosting company. Sorry about the "textfield" still being there, that was just a test to see if that would work and it does! It's just that using the droplist it doesn't pass the one I have selected to the Php page. The form does send the action to the Php page as I have a <? echo date('l,F dS Y.'); ?> at the top to give me some output to check. I get the date no problem at all. There must be a way of getting this to work as I see it all over the place.
Thanks again for your help.

Fat C

[js_thind]

Did you try what vamsee suggested?

$result = mysql_query("SELECT * from birthdays WHERE firstname=$_POST['firstname'] ");
$worked = mysql_fetch_array($result);

[Fat_Colin]

Yes I tried that but I get this error message
Parse error: parse error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/sites/mysite.com/public_html/mydb/bindex.php on line 27

Line 27 is the $result = mysql_query(...) line.

[bradgrafelman]

Try writing the query string properly:

$result = mysql_query("SELECT * from birthdays WHERE firstname='" . $_POST['firstname'] . "'");

Also, you might want to validate the user input instead of putting it directly into a SQL query, otherwise you're most likely vulnerable to SQL injection attacks.

[Fat_Colin]

Thank you very much, my incorrect syntax being due to a general lack of knowledge. I am working on it. I came back here to say that I had sussed it out myself by using single quotes round the $POST and no quotes inside the square brackets! ( ....WHERE firstname='$POST[firstname]' ");
Thank you very much to you all.

                      Fat boy

[bradgrafelman]

Fat Collin wrote:

I had sussed it out myself by using single quotes round the $_POST and no quotes inside the square brackets!

Except now your code isn't using proper syntax.

1. Array indeces in your case should be strings. $row[name] does not have a string as an index, but a constant. PHP will detect this (assuming there actually isn't a constant named 'name') and throw an E_WARNING and then assume it is a string. So, use quotes: $row['name'].

2. Arrays, more specifically items in arrays referenced by indeces, should not simply appear inside a double-quoted string. If they do, they should be wrapped in braces ( {} ). Instead, I usually escape out of the string and concatenate the array in the middle, like so:

   echo 'Your name is: ' . $row['name'] . '! Hello there.';

[Fat_Colin]

Thanks man, you're a star! Although I was happy that it actually worked, I would much rather be doing it right! Cheers.