How to display information from database using value selected in listbox

[ieda]

I want to display information when value in listbox selected.

Below is my code:-

This code to get value option in listbox

<?
$query = "select courseTitle from training where startDate > NOW() ";
$result = mysql_query($query);
print "<SELECT name=item>";
while ($line = mysql_fetch_array($result))
{
foreach ($line as $value)
{
print "<OPTION value='$value'";
}
print ">$value</OPTION>";
}
 
mysql_close($link);
print "</SELECT>";    
?>

This code to display information from database when select value in listbox

<?
if (isset($_GET['item']))
{
 
$query=mysql_query ("SELECT training_id from training where courseTitle='$item' "); 
 
 
while( $row = mysql_fetch_array($query) {
 
               $training_id=$row['training_id'];
 
echo $row['training_id'];
 
}
}
 
?>

Anyone can solve my problem? Thanks.

[Atli]

Hey.

The $item variable you use in your query has not been defined. You need to fetch the variable from the $_GET array before you can use it. (In most cases, anyways.)

[ieda]

@Atli
can u give me an example how to use $_GET array for my coding so that i can implement in my code above..really appreciate!

[Atli]

You fetch an array element into a variable like so:

$variable = $array['element'];

The $_GET array works just like a normal array.

See the manual for more details:
- PHP: $_GET - Manual
- PHP: Arrays - Manual

[ieda]

@Atli
Thanks atli..i will try implement it.

[NettSIte]

$query=mysql_query ("SELECT training_id from training where courseTitle='{$_GET['item']}' ");  

Should do the trick.

[Atli]

@NettSIte
You should never put $_GET or$_POST variables directly into a query. Not unless you want your database to be hacked.

Imagine if the value of $_GET['item'] were:

' OR 1='1

Or, even worse:

'; DROP TABLE training;--

You should always run your variables through mysql_real_escape_string before putting them into a query.

See SQL Inection for more details on why this is necessary.

[NettSIte]

@Atli
You should always run your variables through mysql_real_escape_string before putting them into a query.

True.