Sending Select Menu value to variable in SQL Select query

[ronrattie]

Okay I have a Select Menu dynamically created with two fields in a table.
LongOrg and ID, LongOrg is the field used for the displayed label and ID is the value
I want passed to the SQL query so that it will populate my form on the same page with the data stored in that row.

So the Dynamic Select Menu works (it shows all LongOrg labels)

The Query I have for the form works and loads data into the form as it should.
Now I just need the Select Menu to affect the query.

Here's the code.

<script language="JavaScript" type="text/javascript" src="js/calendarDateInput.js"></script>

</head>
<?php require_once('../Connections/Conference_Submit.php'); ?>
<?php
mysql_select_db($database_Conference_Submit, $Conference_Submit);
$query_ConfUpdate = "SELECT * FROM ConferencesMain ORDER BY StartDate ASC";
$ConfUpdate = mysql_query($query_ConfUpdate, $Conference_Submit) or die(mysql_error());
$row_ConfUpdate = mysql_fetch_assoc($ConfUpdate);
$totalRows_ConfUpdate = mysql_num_rows($ConfUpdate);

function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{
  $theValue = (!get_magic_quotes_gpc()) ? addslashes($theValue) : $theValue;

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;    

    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}

$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "update_form")) {
  $updateSQL = sprintf("UPDATE ConferencesMain SET ShortOrg=%s, StartDate=%s, EndDate=%s, Days=%s, LongOrg=%s, Owner=%s, Attendees=%s, Details=%s, City=%s, `State`=%s, Region=%s, Contact=%s, URL=%s, `Action`=%s, BillingNum=%s, RegistrationCost=%s, BoothCost=%s, Grade=%s, Paid=%s, NumberOfAttendees=%s, TotalSpent=%s, MembersOfOrg=%s, PresentationSubmitDeadline=%s, AbstractSubmitDeadline=%s, FinalPaperSubmitDeadline=%s, DeadlineDetails=%s, MMMreportShow=%s WHERE ID=%s",
                       GetSQLValueString($_POST['ShortOrg'], "text"),
                       GetSQLValueString($_POST['StartDate'], "date"),
                       GetSQLValueString($_POST['EndDate'], "date"),
                       GetSQLValueString($_POST['Days'], "int"),
                       GetSQLValueString($_POST['LongOrg'], "text"),
                       GetSQLValueString($_POST['Owner'], "text"),
                       GetSQLValueString($_POST['Attendees'], "text"),
                       GetSQLValueString($_POST['Details'], "text"),
                       GetSQLValueString($_POST['City'], "text"),
                       GetSQLValueString($_POST['State'], "text"),
                       GetSQLValueString($_POST['Region'], "text"),
                       GetSQLValueString($_POST['Contact'], "text"),
                       GetSQLValueString($_POST['URL'], "text"),
                       GetSQLValueString($_POST['Action'], "text"),
                       GetSQLValueString($_POST['BillingNum'], "int"),
                       GetSQLValueString($_POST['RegistrationCost'], "double"),
                       GetSQLValueString($_POST['BoothCost'], "double"),
                       GetSQLValueString($_POST['Grade'], "text"),
                       GetSQLValueString(isset($_POST['Paid']) ? "true" : "", "defined","'Y'","'N'"),
                       GetSQLValueString($_POST['NumberOfAttendees'], "int"),
                       GetSQLValueString($_POST['TotalSpent'], "double"),
                       GetSQLValueString(isset($_POST['MembersOfOrg']) ? "true" : "", "defined","'Y'","'N'"),
                       GetSQLValueString($_POST['PresentationSubmitDeadline'], "date"),
                       GetSQLValueString($_POST['AbstractSubmitDeadline'], "date"),
                       GetSQLValueString($_POST['FinalPaperSubmitDeadline'], "date"),
                       GetSQLValueString($_POST['DeadlineDetails'], "text"),
                       GetSQLValueString(isset($_POST['MMMreportShow']) ? "true" : "", "defined","'Y'","'N'"),
                       GetSQLValueString($_POST['ID'], "int"));

  mysql_select_db($database_Conference_Submit, $Conference_Submit);
  $Result1 = mysql_query($updateSQL, $Conference_Submit) or die(mysql_error());

  $updateGoTo = "http://kiosk2.jsanet.com/index.php?option=com_content&task=view&id=13&Itemid=34";
  if (isset($_SERVER['QUERY_STRING'])) {
    $updateGoTo .= (strpos($updateGoTo, '?')) ? "&" : "?";
    $updateGoTo .= $_SERVER['QUERY_STRING'];
  }
  header(sprintf("Location: %s", $updateGoTo));
}
?>

<body>


<p><span class="contentpagetitle">Conference Update Form</span><br />
  <br />
1. Select a conference from the drop down list.<br />
2. Edit the available fields for the selected conference.<br />
3. Click on the Update Conference Listing.
</p>
<hr />
<form action="" method="post" enctype="multipart/form-data" name="conference_select"><table width="90%" border="0" cellspacing="0" cellpadding="0">
  <tr>
    <th scope="col"><div align="left"><span class="category_header">Select a Conference to update:</span></div></th>
  </tr>
  <tr>
    <th scope="col"><div align="left">
      <select name="select">
        <option value="null" <?php if (!(strcmp("null", $row_ConfUpdate['ID']))) {echo "selected=\"selected\"";} ?>>click here</option>
        <?php
do {  

?>
        <option value="<?php echo $row_ConfUpdate['ID']?>"<?php if (!(strcmp($row_ConfUpdate['ID'], $row_ConfUpdate['ID']))) {echo "selected=\"selected\"";} ?>>
          <?php $startDate = $row_ConfUpdate['StartDate']; echo (date('m.j.Y', strtotime($startDate))); ?>
          ,&nbsp;<?php echo $row_ConfUpdate['LongOrg']?></option>
        <?php
} while ($row_ConfUpdate = mysql_fetch_assoc($ConfUpdate));
  $rows = mysql_num_rows($ConfUpdate);
  if($rows > 0) {
      mysql_data_seek($ConfUpdate, 0);
	  $row_ConfUpdate = mysql_fetch_assoc($ConfUpdate);
  }
?>
      </select>
      <br />
      <br />
      <input type="submit" name="Submit" value="Submit" />
    </div></th>
  </tr>
</table></form>
<form method="post" name="update_form" action="<?php echo $editFormAction; ?>">
  <table align="left" width="90%">
    <tr valign="baseline">
      <td width="206" align="left" nowrap class="category_header">&nbsp;</td>
      <td width="274"><?php echo $row_ConfUpdate['ID']; ?></td>
      <td width="172">&nbsp;</td>
    </tr>
    <tr valign="baseline">
      <td colspan="3" align="left" nowrap></td>
    </tr>
    <tr valign="baseline">
      <td align="right" nowrap class="category_header">Org. Short Name:</td>
      <td><input type="text" name="ShortOrg" value="<?php echo $row_ConfUpdate['ShortOrg']; ?>" size="20"></td>
      <<<<SNIP - for character limitation of the forum>>>>  

    <td>&nbsp;</td>
    </tr>
    <tr valign="baseline">
      <td nowrap align="right">&nbsp;</td>
      <td><input type="submit" value="Update Conference Listing"></td>
      <td>&nbsp;</td>
    </tr>
  </table>
  <input type="hidden" name="MM_update" value="form1">
  <input type="hidden" name="ID" value="<?php echo $row_ConfUpdate['ID']; ?>">
</form>
<p>&nbsp;</p>
</body>
</html>
<?php
mysql_free_result($ConfUpdate);
?>

[leatherback]

Short answer:

$query = "select * from TABLE where FIELD = $_POST['SELECTEDFIELD']";

Expanded answer:
YOu need to retrieve the variable from the posted data array $_POST. Then you need to select all (*) or specific field (list them: fieldname1, fieldname3) from your TABLE where the FIELD in the database equals the POSTed data.

You need to do your sql_inject testing. I am not sure how you handle that in your scripts. Could be by mysql_escape_real() or something.