Support Forums - XOOPS Web Application System

Subject:* <
Name/Email:* <
Message Icon:* <
Select* <
Message:* <	xx-Small x-Small Small Medium Large x-Large xx-Large Arial Courier Georgia Helvetica Impact Verdana Haettenschweiler Black Blue Brown Green Grey Orange Paper Purple Red White Yellow [quote] sarahmx wrote: i forgot to put $occupation=$occ_list; in the first code and i've solved this...TQ i just changed the if statement and MySQL query.lol [code] <?php $log_id=$_POST[log_id]; if($log_id=='') { echo "<center>Please Select a record</center><br /><br />"; } else { $result = mysql_query("SELECT * FROM info_unit WHERE log_id=$log_id"); while($row = mysql_fetch_array($result)) { $log_id=$row['log_id']; $occupation=$row['occupation']; } ?> <select name='occupation'> <option value=''>Select occupation</option> <?php global $xoopsDB; $result = mysql_query("SELECT * FROM ".$xoopsDB->prefix("myocc").",".$xoopsDB->prefix("infounit")." WHERE log_id=$log_id"); while($row = mysql_fetch_array($result)) { $occ_list=$row['occ_list']; $occupation=$row['occupation']; if($occ_list == $occupation) { echo "<option value='$occupation' selected>$occ_list</option>"; } else { $occupation=$occ_list; echo "<option value='$occupation'>$occ_list</option>"; } } ?> </select> [/code][/quote] Click the Preview to see the content in action.
Options:* <	Enable Smiley Enable Xoops Code
Confirmation Code* <	9 - 4 = ? Input the result from the expression Maximum attempts you can try: 10
* <

Re: drop down select - php/mysql help

by culex on 2010/1/10 16:30:22

No problem.

I can only forward the excellent advise Trabis gave me some time ago always to sanitize what you put in sql queries.

More fast would be actually to give the url to the post where he very nice give me the explanation.

Have a nice day and please just ask if I can help with anything :)

Re: drop down select - php/mysql help

by sarahmx on 2010/1/10 14:51:13

Thank you...culex
this module i'm developing is actually for my office...

any other tips to prevent sql injection ?

Re: drop down select - php/mysql help

by culex on 2010/1/10 13:05:51

You should consider in the places where you use an user input in sql query to sanitize this to avoid sql injection (old advise given to my by trabis ;)

for instance where you have.

le="color: #000000"><?php else { $result = mysql_query("SELECT * FROM info_unit WHERE log_id=$log_id");

to add an intval($value) like this

le="color: #000000"><?php else { $result = mysql_query("SELECT * FROM ".$xoopsDB->prefix("info_unit")." WHERE log_id=".intval($oa_id)."");

Re: drop down select - php/mysql help

by sarahmx on 2010/1/10 1:21:42

i forgot to put
$occupation=$occ_list; in the first code

and i've solved this...TQ

i just changed the if statement and MySQL query.lol

<?php $log_id=$_POST[log_id]; if($log_id=='') { echo "<center>Please Select a record</center><br /><br />"; } else { $result = mysql_query("SELECT * FROM info_unit WHERE log_id=$log_id"); while($row = mysql_fetch_array($result)) { $log_id=$row['log_id']; $occupation=$row['occupation']; } ?> <select name='occupation'> <option value=''>Select occupation</option> <?php global $xoopsDB; $result = mysql_query("SELECT * FROM ".$xoopsDB->prefix("myocc").",".$xoopsDB->prefix("infounit")." WHERE log_id=$log_id"); while($row = mysql_fetch_array($result)) { $occ_list=$row['occ_list']; $occupation=$row['occupation']; if($occ_list == $occupation) { echo "<option value='$occupation' selected>$occ_list</option>"; } else { $occupation=$occ_list; echo "<option value='$occupation'>$occ_list</option>"; } } ?>  </select>

drop down select - php/mysql help

by sarahmx on 2010/1/9 14:24:01

First of all sorry for my English

Im a php/xoops coding newbie..i'm currently testing

doing a simple module for XOOPS cms...

i'm having trouble with this can anyone help me

ok i have this

two table

info_unit : log_id, occupation
myocc : id, occ_list

input

<select name='occupation'> <option value="">Select Occupation</option> <?php global $xoopsDB; $result = mysql_query("SELECT * FROM ".$xoopsDB->prefix("myocc").""); while($row = mysql_fetch_array($result)) { $occ_list=$row['occ_list']; echo "<option value='$occupation'>$occ_list</option>"; } ?>  </select>

the above code working properly...the drop down will display value from myocc..

and the value is submitted to info_unit table successfully

the problem is this code below when i want to edit a record in the edit form the value that i selected in the input form is not display/choosen

update record

<?php $log_id=$_POST[log_id]; if($log_id=='') { echo "<center>Please Select a record</center><br /><br />"; } else { $result = mysql_query("SELECT * FROM info_unit WHERE log_id=$log_id"); while($row = mysql_fetch_array($result)) { $log_id=$row['log_id']; $occupation=$row['occupation']; } ?> <select name='occupation'> <option value=''>Select occupation</option> <?php global $xoopsDB; $result = mysql_query("SELECT * FROM ".$xoopsDB->prefix("myocc").""); while($row = mysql_fetch_array($result)) { $occ_list=$row['occ_list']; if($occupation == '$occ_list') { echo "<option value='$occupation' selected>$occ_list</option>"; } else { echo "<option value='$occupation'>$occ_list</option>"; } } ?>  </select>

Search

Advanced Search

Donat-O-Meter

Stats
Goal:	$15.00
Due Date:	Jul 31
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$15.00

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

{{ record.commit.author.name }} {{ record.commit.author.date | formatDate }}

Search

Recent Posts

Re: XOOPS 2.7.1-RC1 Released for Testing

Re: XOOPS 2.7.1-RC1 Released for Testing

Coming soon: fully rewritten PEDIGREE

XOOPS Cocktails available for testing

Quotes module available for testing

mTools available for testing

XOOPS 2.7.1-RC1 Released for Testing

Re: New XOOPS 2.7.0 Documentation in development

New XOOPS 2.7.0 Documentation in development

Re: XOOPS 2.7.0-RC5 Released for Testing

Who's Online

Donat-O-Meter

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}