1
sarahmx
drop down select - php/mysql help
  • 2010/1/9 14:24

  • sarahmx

  • Quite a regular

  • Posts: 381

  • Since: 2007/10/28


First of all sorry for my English

Im a php/xoops coding newbie..i'm currently testing

doing a simple module for XOOPS cms...

i'm having trouble with this can anyone help me

ok i have this

two table

info_unit : log_id, occupation
myocc : id, occ_list


input

<select name='occupation'>
 <option value="">Select Occupation</option>
   <?php
 
global $xoopsDB
 
$result mysql_query("SELECT * FROM ".$xoopsDB->prefix("myocc")."");
 
 while(
$row mysql_fetch_array($result))
{
$occ_list=$row['occ_list'];
echo 
"<option value='$occupation'>$occ_list</option>";
}
?>


</select>


the above code working properly...the drop down will display value from myocc..

and the value is submitted to info_unit table successfully

the problem is this code below when i want to edit a record in the edit form the value that i selected in the input form is not display/choosen

update record

<?php

$log_id
=$_POST[log_id];

if(
$log_id=='')
{
echo 
"<center>Please Select a record</center><br /><br />";
}

else 
{
$result mysql_query("SELECT * FROM info_unit WHERE log_id=$log_id");
while(
$row mysql_fetch_array($result))
{
$log_id=$row['log_id'];
$occupation=$row['occupation'];
}
?>
<select name='occupation'>
<option value=''>Select occupation</option>
 
<?php
 
  
global $xoopsDB
  
$result mysql_query("SELECT * FROM ".$xoopsDB->prefix("myocc")."");

 while(
$row mysql_fetch_array($result))
{
$occ_list=$row['occ_list'];
 
        if(
$occupation == '$occ_list') {
    
    echo 
"<option value='$occupation' selected>$occ_list</option>";
}
 
else
{   

echo 
"<option value='$occupation'>$occ_list</option>";
}  

}
?>

  </select>

2
sarahmx
Re: drop down select - php/mysql help
  • 2010/1/10 1:21

  • sarahmx

  • Quite a regular

  • Posts: 381

  • Since: 2007/10/28


i forgot to put
$occupation=$occ_list; in the first code

and i've solved this...TQ

i just changed the if statement and MySQL query.lol

<?php
$log_id
=$_POST[log_id];

if(
$log_id=='')
{
echo 
"<center>Please Select a record</center><br /><br />";
}

else 
{
$result mysql_query("SELECT * FROM info_unit WHERE log_id=$log_id");
while(
$row mysql_fetch_array($result))
{
$log_id=$row['log_id'];
$occupation=$row['occupation'];
}
?>
<select name='occupation'>
<option value=''>Select occupation</option>
 
<?php
 
  
global $xoopsDB
  
$result mysql_query("SELECT * FROM ".$xoopsDB->prefix("myocc").",".$xoopsDB->prefix("infounit")." WHERE log_id=$log_id");

 while(
$row mysql_fetch_array($result))
{
$occ_list=$row['occ_list'];
$occupation=$row['occupation'];
 
        if(
$occ_list == $occupation) {
    
    echo 
"<option value='$occupation' selected>$occ_list</option>";
}
 
else
{   
$occupation=$occ_list;
echo 
"<option value='$occupation'>$occ_list</option>";
}  

}
?>

  </select>

3
culex
Re: drop down select - php/mysql help
  • 2010/1/10 13:05

  • culex

  • Module Developer

  • Posts: 711

  • Since: 2004/9/23


You should consider in the places where you use an user input in sql query to sanitize this to avoid sql injection (old advise given to my by trabis ;)

for instance where you have.

else 
{
$result mysql_query("SELECT * FROM info_unit WHERE log_id=$log_id");


to add an intval($value) like this

else 
{
$result mysql_query("SELECT * FROM ".$xoopsDB->prefix("info_unit")." WHERE log_id=".intval($oa_id)."");



4
sarahmx
Re: drop down select - php/mysql help
  • 2010/1/10 14:51

  • sarahmx

  • Quite a regular

  • Posts: 381

  • Since: 2007/10/28


Thank you...culex
this module i'm developing is actually for my office...


any other tips to prevent sql injection ?

5
culex
Re: drop down select - php/mysql help
  • 2010/1/10 16:30

  • culex

  • Module Developer

  • Posts: 711

  • Since: 2004/9/23


No problem.

I can only forward the excellent advise Trabis gave me some time ago always to sanitize what you put in sql queries.

More fast would be actually to give the url to the post where he very nice give me the explanation.

Have a nice day and please just ask if I can help with anything :)


Login

Who's Online

216 user(s) are online (124 user(s) are browsing Support Forums)


Members: 0


Guests: 216


more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: Apr 30
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits