<select multiple / foreach (...) problem

dickreuter

I have a select multiple where the user can select a number of cities and I'd like for each of the selected cities to have PHP make a database entry. For some reason the foreach doesn't seem to be working (there are no entries, although I select cities!). Any help is appreciated.

The code looks like this:

<form action="xy.php" method="post" id="offer">
<p align="left">Select Cities in which you want to offer the Service<br />
<select name="cities[]" size="10" multiple="MULTIPLE" id="offer">
<option>London</option>
<option>New York</option>
<option>Zurich</option>
<option>Zug</option>
<option>Luzern</option>
<option>Bern</option>
</select>

xy.php:

<?php
$dbcnx=@mysql_connect('localhost','root','');
if (!$dbcnx) {
echo '<p>Unable to connect to the '.'Database server at this time.';
exit();
}
mysql_select_db('itopservice',$dbcnx);

 $c[]=$_REQUEST['cities[]'];

  foreach ($c as $cityname) {
     $sql="INSERT INTO citylink SET
     serviceid='$serviceid',
     cityid='$cityname'";
     if (@mysql_query($sql)) {
      echo '<p> Entry had been added to Citylink.'; } 
     else{echo '<p> Error submission: '.mysql_error().'<BR>';}
  }

bpat1434

You want to use $c = $_POST['cities'] not what you have before the foreach loop.

The "[]" in the name attribute of the form element just means that you want the data to be sent as an array. When in PHP, you can just think of that item as a regular array. So $POST['cities'][0] would be the first selection, and $POST['cities'][n] would be the n-th selection.

You also don't need to have the "[]" with the $c variable either as it will just have the contents of the $_POST['cities'] array which will make it an array. You don't need to specify 😉

bradgrafelman

Note that you could simply perform the foreach() on the $_POST['cities'] array directly - no need to copy it to another variable.

Also, your code appears to be vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query; instead it should be sanitized with a function such as [man]mysql_real_escape_string/man.