How to make php parsing script to insert "<option> from <select>" into database?

[ilya Kraft]

Hello,

Alright so I have had this problem for a while. I have a page on a website where members write their articles and they select a category that is relevant to that article. I have made a following <select> form with <options>

<SELECT NAME="Categories">
<OPTION VALUE="option 1">option 1
<OPTION VALUE="option 2">option 2
<OPTION VALUE="other ....">other ...
</SELECT>
 

I need to insert selected option into database table called "articles" into field named "Category". How do I make a PHP parsing script that inserts selected value into database ???

Thank You )))

I also made this image that kind of shows what I want to do, so you can understand better.
http://bytes.com/attachment.php?atta...2&d=1307376479

[dlite922]

<select> works just like <input>, grab it like you grab the rest of the fields with $_POST, $_GET, or $_REQUEST.

Make sure you still clean the values like an <input> to avoid sql injection attacks before putting it in your database.

Dan

[ilya Kraft]

Hello Dan,

Thnx for reply, The thing is I have little experience with php and just started working with server side aspect of it. If it's not hard for you could you please explain it in more depth? I've done a little research on $_POST method and here is what I understood so far. I would have something like this, a variable with post function.

$category = $_POST['Categories'];
 

Than I would connect to my database and use $sql to put in the category, so I would have something like this

 $sql = mysql_query("INSERT INTO articles (category) VALUES ('$category')") 
 
 or die (mysql_error());
 

So then I can filter by category (for example category of option1) by using something like $sql2 that looks like this.

sql2 = ("SELECT * FROM articles WHERE category=option1");
 

Am I right so far or do I miss something And also could you explain what do you mean by cleaning the values to prevent sql injections?

Thank you ))) sorry for asking so many questions :/

[nathj]

In a nutshell the SQL Injection can be prevented by making sure a given $_POST variable is exactly what you expect it to be. So if you are expecting just a date check that it is a date.

This article here looks good but I haven't read it all yet.

I did take a quick look over the code and I thiknk you are heading in the right direction. I would suggest testing it and posting any errors you may encouter.

Cheers
nathj

[ilya Kraft]

Alright ))) so for example in my option list I will have something like "Animals,Home,Cars ..." so to prevent sql injections I would filter all numbers and symbols out so I only get letters as I only use them in option list?

[nathj]

That shoudl do it yeah. In a nutshell ensuring that any data passed to the server is as expected is the way to prevent SQL Injection attacks.

Cheers
nathj

[ilya Kraft]

Hi,

I have tried to finalize it ))) and it works, but I have issue with story title. It doesn't get stored and when I look into database instead of title I see blank space ((( I store title in st_title field. Do you have any ideas what's wrong?

Here is parsing script I use:

//Parsing Story
if ($_POST['parse_var'] == "submitstory"){
    $storyTitle = $_POST['storyTitle'];
    $category = $_POST ['categories'];
    $theStory = $_POST['myStory'];
        include ("scripts/connect_to_mysql.php");
        $auth_name = $_SESSION['username'];
        $Articlesql = mysql_query("INSERT INTO stories (auth_id, auth_name, cr_date, st_title, st_category, st_body) VALUES('$id','$auth_name', now(), '$storyTitle','$category','$theStory')")
        or die (mysql_error());
 

And here is HTML for <form> I use:

<form action="story.php" method="post" enctype="multipart/form-data">
                Title:<br>
                <input name="stroyTitle" type="text" size="50" maxlength="50" value="<?php echo $storyTitle; ?>" />
                <br>
                Your Story:<br>
                <textarea name="myStory" class="tinymce" cols="39" rows="1" /><?php echo $myArticle; ?></textarea>
                <br>
                Select Category<br>
                <select name="categories">
                    <option value="<?php print "$category";?>"><?php print "$category";?></option>
                    <option value="Love">Love</option>
                    <option value="Work">Work</option>
                    <option value="Sex">Sex</option>
                    <option value="Money">Money</option>
                    <option value="Kids">Kids</option>
                    <option value="Health">Health</option>
                    <option value="Friends">Friends</option>
                    <option value="Education">Education</option>
                    <option value="Other">Other</option>
                </select>
                <br><br>
                <button name="addStory" type="submit" id="addStory">Submit</button>
                <input name="parse_var" type="hidden" value="submitstory" />
                <input name="thisWipit" type="hidden" value="<?php echo $thisRandNum; ?>" /></td>
 
</form>
 

[nathj]

Hi,

Good progress has been made. The trouble you know have is a classic typing error.

The form contains an item named stroyTitle and you are accessing a POST variable storyTitle.

I suggest you change the name in the form and all should be well.

Cheers
nathj

[ilya Kraft]

Oh ;D my bad, it works now )), but I couldn't make that moderation system we were working on, I can't create a field (showing), I always get sort of error, I'll link a screenshot of what I'm doing maybe you could point what's wrong with values I enter.

Thank You very much for your great help )))

here is the screenshot;
inelmo.com/db_showing.jpg

[nathj]

I took a look and the field length shoul be 1. You can set a default value of 0.

Changing the length should allow you to create the field which you can then use as de discussed previously.

Thanks
nathj

[ilya Kraft]

Well, looks like it should work now ))) I can manually change it from 0 to 1 now ))) Thank You very much ))) One last question about that checkbox, say I have account types and one of them is admin so I can see that checkbox, how would I use it? I mean what condition do I need to set "showing" to 1 if checkbox is clicked? Do I use $_POST again or something additional?

Thnx again )))

[Markus]

Can you please clarify? Is your latest question: how to display a checkbox is user is an administrator, otherwise do not display it?

[ilya Kraft]

Hello,

Sory for confuse, what I meant was "Let's assume that I have admin system, what would be the php script for admin checkbox to set value of (showing) from 0 to 1" Nothing about displaying checkbox to admin or normal user )))

[nathj]

Hi,

I normally use a little javascript so when the box is checked I set the value to 1 and when it is unchecked set the value to 0. Then you can use $_POST to access the value. You may need to parse it from a string to an int to put it in the db.

nathj