can't get form with drop down box working.. confused with $_GET and $_POST!

[thunderstorm]

Hi, im trying to use a drop down box to select data from my tables in my database that relate to just one column, which populates the drop down. I'm trying to display a drop down box full of race names pulled from a race table in my database, and this works fine, they're all listed correctly.

I want to then allow the user to select one, hit submit or whatever, then below, (OR on another page, I don't mind) in a table, display the member first and last names (from member table), the race date, length (from race table) and the result (from result table).

At the moment I'm stuck as whatever u select nothing happens. I'm really confused about how to get the race name from the submitted drop down, do you use get or post or what?? Need a simple explanation of what ive done wrong, I KNOW its wrong but just cant figure out how to fix it 🙂 getting muddled :queasy: !

Thanks, and here's my code:

<?php
require_once('connection.php');
if (!isset($_GET['race'])) {
	$res=mysql_query("select race_name from race");
		if(mysql_num_rows($res)==0) {
			echo "there is no data in table..";
		}
		else {
		echo'<form action="bugger.php" method="post"><select name="categories">';
			for($i=0;$i<mysql_num_rows($res);$i++) {
			$row=mysql_fetch_assoc($res);
			echo"<option>$row[race_name]</option>";
			} // endof for
		echo'</select><input type="submit" name="submit" value="race" />
		<input type="hidden" name="submitted" value="TRUE" /></form>';
		}
}
elseif ((isset($_GET['race']))) {
    	$getrace = $_GET['race'];
		$res=mysql_query("select member.first_name,member.last_name,race.race_name,race.race_date,results.time from member,race,result WHERE race.race_name='".$getrace."'");

	}

if(mysql_num_rows($res)==0) {
	echo "there is no data in table..";
}

else {
	//table header
	echo'<table align="center" cellspacing="10" cellpadding="5">
	<tr><td align="left"><b>First Name</b></td>
	<td align="left"><b>Last Name</b></td>
	<td align="left"><b>Race Name</b></td>
	<td align="left"><b>Race Date</b></td>
	<td align="left"><b>Race Time</b></td></tr>';
	echo'</select>';
}
// fetch and print all the records
while($row = mysql_fetch_array($res,MYSQL_ASSOC)) {
		echo'<tr><td align="left">'.$row['first_name'].'</td>
		<td align="left">'.$row['last_name'].'</td>
		<td align="left">'.$row['race_name'].'</td>
		<td align="left">'.$row['race_date'].'</td> 
		<td align="left">'.$row['time'].'</td>
		</tr>
		';}echo'</table>';

?>

oh yes, the files called bugger.php cos im getting stuck 😉

[Roger_Ramjet]

Sorry, you already have.

[Roger_Ramjet]

OK, you are using POST in the form so you need to process POST vars not GET vars.
You do not need the hidden form field as you can test for submit

// set up display
$form = FALSE;
$err = '';

// test for form submit
if (isset($_POST['submit'])) {
   // test for selection made
  if (isset($_POST['race'])) {
    // protect against sql injection: I use a function for this
    // you can get that from the manual for mysql_real_escape_string
    $getrace = mysql_real_escape_string($_POST['race']);
    $sql = "select member.first_name,member.last_name,race.race_name,race.race_date,results.time from member,race,result WHERE race.race_name='".$getrace."'";
    // query and display
    ....
    if (mysql_num_rows($result) < 1) {
      $form = TRUE;
      $err = 'No data found';
    }
  } else {
    // no race selected so display error and redisplay form
    $form = TRUE;
    $err = 'Please select a race first';
  }
} else {
  $form = TRUE;
}

if ($form) {
  // display form testing for error message $err
}

[suntra]

I personally simplify things... I use $REQUEST instead of $GET and $_POST. If the posting method really matters, I simply check it...

if(trim(strtolower($_SERVER['REQUEST_METHOD'])) <> 'post') {
    exit('You didn\'t use the correct request method !');
}

[Roger_Ramjet]

suntra wrote:

I personally simplify things... I use $REQUEST instead of $GET and $_POST. If the posting method really matters, I simply check it...

if(trim(strtolower($_SERVER['REQUEST_METHOD'])) <> 'post') {
    exit('You didn\'t use the correct request method !');
}

Oh do you! Please post your URL so I can attack your site 😃

What the manual has to say on the issue:

$_REQUEST

Variables provided to the script via the GET, POST, and COOKIE input mechanisms, and which therefore cannot be trusted.[/COLOR] 

Thunderstorm, the use of $_REQUEST is NOT recommended so do not follow Suntra's advise.

[suntra]

Except some variables not being the good ones because of the order they are assigned, I don't see the risk with $REQUEST. I access cookie with $COOKIE, and GET/POST with $_REQUEST... My cookie names are never use with fields, and I always check submitted value, and of course, use mysql_real_escape_string() before inserting in a DB !

I admit that it would be more secure using $GET and $POST and especially less confusing, but even though I use $_REQUEST, I always make security my priority.

[Roger_Ramjet]

OK so you compensate, in which case why use request in the first place? Seems like extra code to me!!

The problem with request is that you don't know where the vars have come from so spoofing is that much easier for a robot script. Does not matter always, but just a bad habit cos sometimes it really does matter.

[suntra]

But thanks for you posts, it made me realize I should change something 😉

I haven't done anything big for ages, but I have some projects in mind, and I will from now on use $POST (or $GET) instead of $_REQUEST 😉

Thanks 😉

[thunderstorm]

Alright guys, thanks for your input, i got it working 😃 but got some more questions.

1) is there any way i can have the drop down NOT disappear when u select a race from it? atm when u pick one and hit submit it disappears.

2) I didn't realise that I have some race names that are the same, but their race lengths are different - so my drop down box looks like it has a duplicate race name as users aren't going to know which one is which.... basically, is there some way that i could somehow print the race length next to the race name in the drop down? E.g. Forest 8 (race name) - 8 miles (race length) or for the other one its Forest 8 - 5 miles...

So is it possible to effectively concatenate it? Or will this fuck up the query later??

Here's my current code:

<?php
require_once('connection.php');
if (!isset($_POST['submit']))#IT should be $_POST bcoz form method is POST.
{
      $res=mysql_query("select race_name from race");
      if(mysql_num_rows($res) == 0) {
         echo "there is no data in table..";
      }
      else
      {
         echo '<form action="race_results.php" method="post"><select name="race">'; 
         while($row = mysql_fetch_array($res)) 
         {
            print '<option value = "'.$row['race_name'].'" >'.$row['race_name'].'</option>'; 
         } // endof for
         echo'</select><input type="submit" name="submit" value="submit" />
         <input type="hidden" name="submitted" value="TRUE" /></form>';
      }
}
else{
      $getrace = $_POST['race'];
      $res = mysql_query("select member.first_name,member.last_name,race.race_name,race.race_date,results.time from member,race,results WHERE member.member_no = results.member_no AND race.race_no = results.race_no AND race.race_name='".$getrace."'");

   if(mysql_num_rows($res) == 0) {
      echo "there is no data in table..";
   }

   else {
      //table header
      echo'<table align="center" cellspacing="10" cellpadding="5">
      <tr><td align="left">First Name</td>
      <td align="left">Last Name</td>
      <td align="left">Race Name</td>
      <td align="left">Race Date</td>
      <td align="left">Race Time</td></tr>';
   // fetch and print all the records
   while($row = mysql_fetch_array($res)) {
               echo'<tr><td align="left">'.$row['first_name'].'</td>
         <td align="left">'.$row['last_name'].'</td>
         <td align="left">'.$row['race_name'].'</td>
         <td align="left">'.$row['race_date'].'</td> 
         <td align="left">'.$row['time'].'</td>
         </tr>';
       }

echo'</table>';
   }
}
?> 

[Roger_Ramjet]

1. If it is disapearing that is because your code does that.

2. Yes: <option>

[thunderstorm]

Roger Ramjet wrote:

2. Yes: <option>

cant see anything relevant here unless im being blind what to look for?

[Roger_Ramjet]

It is telling you that the value returned from the select option does not have to be the same as the string displayed in that option, so Yes you can concatenate the race distance without messing up the query later.

[thunderstorm]

can i just put the other column i want as the label?