php /mysql form with drop down box

Help with inserting data into Mysql DB from Form

[AliTaylor4411]

Hi I am complete novice with php and mysql but have created a Database and Forms which insert the data into the database fine. The only problem being that that the drop down boxes do not work. All the data from the text boxes are inserted into the database but not the selections made from the drop down boxes. I am at a complete loss and am hoping someone here can guide me. This is the code for one of the forms:

Code in form creating the drop down list as follows:

<td width="24%">Bedrooms</td>
<td width="15%"><select name="bedrooms">
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
<option value="6+">6+</option>
</select>&nbsp;</td>&nbsp;</td>
</tr>

Code in php script which the form goes to as follows:

<?php
//Open the connection
$con = mysql_connect("example.com","#*$!X", "#*$!");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
//Select the Database
mysql_select_db("ahtaylor1db", $con);

// Create the MySQL Command to insert the record
$sql = "INSERT INTO property
values ('',
'$_POST[propertyadd1]',
'$_POST[propertyadd2]',
'$_POST[propertyadd3]',
'$_POST[postcode]',
'$_POST[$propertytype]',
'$_POST[$bedrooms]',
'$_POST[price]',
'$_POST[agentid]',
'$_POST[garage]',
'$_POST[conservatory]',
'$_POST[swimmingpool]',
'$_POST[description]',
'$_POST[property_details]')";


// Execute the MySQL statement
$result = mysql_query($sql);
if (!$result) {
die('Invalid query: ' . mysql_error());
}
else {
echo "Record Inserted. Would you like to <a href=\"insertproperty.htm\">insert another property record</a>?";
}
?>


As I said the text boxes insert the data fine but the drop down list selections are not inserted.

Any ideas?

[edited by: dreamcatcher at 6:30 pm (utc) on Aug 3, 2010]
[edit reason] exemplified [/edit]

[BarryStCyr]

'$_POST[$propertytype]',
'$_POST[$bedrooms]',

need to be

'$_POST[propertytype]',
'$_POST[bedrooms]',

The dollar sign ($) in front of the values propertytype and bedrooms cause a reference to the variables $propertytype and $bedrooms. You don't have the dollar sign in front of any other of the $_POST key names.

[Matthew1980]

Hi there AliTaylor4411,

Welcome to the Forum :) [webmasterworld.com ]

Another issue I notice is this:-

$_POST[propertytype] they all need to be: $_POST['propertytype']

and I'm pretty sure that the insert statement is formatted wrong, try it like this:-

INSERT INTO `table_name` (`col1`, `col2`, `col3`) VALUES ('value1','value2','value3');

So your statement would look like this:-

$sql = "INSERT INTO `property`
(`YOUR_COLUMN`, `NAMES`, `HERE`)
values ('',
'".$_POST['propertyadd1']."',
'".$_POST['propertyadd2']."',
'".$_POST['propertyadd3']."',
'".$_POST['postcode']."',
'".$_POST['propertytype']."',
'".$_POST['bedrooms']."',
'".$_POST['price']."',
'".$_POST['agentid']."',
'".$_POST['garage']."',
'".$_POST['conservatory']."',
'".$_POST['swimmingpool']."',
'".$_POST['description']."',
'".$_POST['property_details']."') ";

That looks better anyway ;) Obviously substitute the column names with what corresponds with the values.

Oh, and with using the $_POST array directly into mysql, you will need to sanitise the data first, so functions like mysql_real_escape_string() & strip_tags() applied to the post array will make the sql more secure against malicuios code attacks..

Hope that helps.

Cheers,
MRb

[rocknbil]

It looks like propertytype won't work either, unless you're testing with a default value and it's just setting that value by chance. Look:

'$_POST[$propertytype]',
'$_POST[$bedrooms]',

Did you define $propertytype and $bedrooms? (Guessing no. :-) ) So essentially what you're inserting is

'$_POST[]',
'$_POST[]',

or literally

'',
'',

and if the fields are numeric data types (int, etc.) it will insert 0 (zero) into those fields unless you explicitly set them as NULL for no value when setting up the database. Which most people don't do.

[AliTaylor4411]

Thanks BarryStCyr,

Worked a Treat.

Thanks also to Matthew1980 as hadnt thought of the sanitise issue and am currently working on it now.

Thanks again

[AliTaylor4411]

Thanks rocknbil,

well explained and makes complete sense now!