Query With Dropdown

amax

Hi All, I wish to query a database depending on the user selection from a drop down and input form field. I have all my database queries but need the user to be able to search say - all people from country x (Country x being selected from a drop down) If I have say:

<select name="Country" id="Country">
<option value="Country1">Country1</option>
<option value="Country2">Country2</option>
<option value="Country3">Country3</option>
</select>

and that have a name beginning with say "Peter" - again selected from the input field e.g.

<input type="text" name="first_name"/>

I alread know how to do the database queries but not sure how I pass the select or first name to the query string. When I grab $first_name = "fisrt_name"; from the post, how do I put it in the query string?
can I say - $result = mysql_query("SELECT $first_name FROM $country");

I would love some advice on this please if anyone can help me

coldwerturkey

1) use $_POST['form_name_here'] to get the posted form value, (not $form_name_here unless you defined it outside of the code you posted.. I'm just assuming)
2) use mysql_real_escape_string() to prevent mysql injection

then, like you already did, you can build your query something like

$query = "SELECT  ".mysql_real_escape_string($_POST['first_name'])." FROM ".mysql_real_escape_string($_POST['Country']);

(also, you can use or die(mysql_error()); at the end of your database query while developing/testing to see if any errors happen)

bradgrafelman

You'll have to modify the query a bit - I think coldwerturkey meant something like

SELECT col1, col2 FROM myTables WHERE
    first_name LIKE '$firstname&#37;'
    AND country='$country'

Where the dummy variables in the query contain the properly escaped user input.

coldwerturkey

bradgrafelman;10909337 wrote:
You'll have to modify the query a bit - I think coldwerturkey meant something like

I was basing it off of his query, he had said he knew how to do the query - even though it looks uber improper

amax;10909312 wrote:
I alread know how to do the database queries ... $result = mysql_query("SELECT $first_name FROM $country");

</defending my reasoning>

bradgrafelman

Ah, missed that part of the OP's post. Then yes, in that case, I would suggest that either a) the example query was hastily written and didn't go through the logic test first, or b) the OP may have an okay grasp on querying but a horrible one on database structure/design. :p

amax

Coldturkey, bradgrafelman thank you so much for your replies. I learned a lot form each of them. I now have my drop down with queries up and running.

p.s. bradgrafelman is 110% right on choice b - the OP is horrible on database structure/design.