Query results based on user input

Dennis10

I've created a form on my webpage which contains a dropdown menu of vehicle types. When the user selects a vehicle type e.g. car and selects go a script file runs that should return all available tyres for that car type.

At the moment all I can get the script file to do is return all values from the table 'tyre' in mysql.

Can anyone help me so that the query returns all values for the vehicle the user selects?

Any help would be appreciated.

Here is the script code

$result = mysql_query("SELECT * FROM $table") 
or die(mysql_error());  

echo "<table border='1'>";
echo "<tr> <th>Vehicle</th> <th>Description</th> </tr>";
// keeps getting the next row until there are no more to get
while($row = mysql_fetch_array( $result )) {
		 // Print out the contents of each row into a table
		 echo "<tr><td>"; 
		 echo $row['Vehicle'];
		 echo "</td><td>"; 
		 echo $row['Description'];
		 echo "</td></tr>"; 
} 

echo "</table>";
?>

Warmaster

<?
$result = mysql_query("SELECT * FROM $table")
          or die(mysql_error());

echo "<table border='1'>";
echo "<tr> <th>Vehicle</th> <th>Description</th> </tr>";

// keeps getting the next row until there are no more to get
while($row = mysql_fetch_array( $result )) {

// Print out the contents of each row into a table
echo "<tr><td>";
echo $row['Vehicle'];
echo "</td><td>";
echo $row['Description'];
echo "</td></tr>";
}

echo "</table>";
?>

Dennis10

Any idea on how I can get the query to only display results based on the selection the user makes e.g. car?

jenks517

I am a newbie myself but (and I'm assuming Warmaster was just making your code readable) it seems to me that you need to pass some of the user input variables from the form to the mySQL query...

$result = mysql_query("SELECT * FROM $table")
          or die(mysql_error());

That is calling everything in the TYRE database or whatever $table is set to. If you want it to pull specific Vehicle types from within the TYRE database you need ot pass the Vehicle type in as well and specify the column.

I think it would be

$result =mysql_query(SELECT FROM tyre WHERE vehicletype ='$_POST['formfieldname']')

That is definitely not 100% correct but I think you can figure it out the basic idea from it.

Dennis10

Thanks Jenks517 and thanks Warmaster (didn't realise the code error)

bpat1434

Dennis10: I'd suggest you use [man]mysql_real_escape_string/man to escape the user input. This lessens the chance of a SQL attack which are back on the rise again (see Sony's website go down recently? Yup, that was SQL injection).