$_GET not working properly

Question

i have a code in which i received two variable($isbn,$eno) from former page via form GET method but these two variables are not working if i am not echo out it on my page the code for the same is given below.

                <?php
            error_reporting(E_ALL);
            require 'db/connect.php';
            if(isset($_POST['generatereport']))
            {
                $isbn=$_GET['isbn'];
                $eno=$_GET['eno'];
                echo $eno;    //if this is not done then i am  not receiving data from database
                echo $isbn;   //if this is not done then i am not receiving data from database

                $studentdata="select * from users where eno='$eno'";
                if($studentresult=$db->query($studentdata))
                {
                    $studentrow = $studentresult->fetch_assoc();
                }
                else
                {
                    echo"fetching error";
                }
                $bookdata="select Lpad(isbn,'10','0') as isbn,book_name from book_data where isbn='$isbn'";
                if($bookresult=$db->query($bookdata))
                {
                    $bookrow = $bookresult->fetch_assoc();
                }
                else
                {
                    echo"fetching error";
                }


            }
            ?>
            <!doctype html>
            <html lang='en'>
            <head>
            </head>
            <body>
            <div id='report'>
            <table>
            <tr><td><h3>Issue Report</h3></td></tr>
            <tr><td><h4>Student details</h4></td></tr>
            <tr><td>UNIQUE ID:<?php //random number here ?></td></tr>
            <tr><td>Enrollment:<?php echo $eno; ?></td></tr>
            <tr><td>Name:<?php echo strtoupper($studentrow['fname']);echo strtoupper( $studentrow['lname']); ?></td></tr>
            <tr><td>Branch:<?php echo strtoupper($studentrow['branch']); ?></td></tr>
            <tr><td>Semester:<?php echo $studentrow['sem']; ?></td></tr>
            </table>
            <hr/>
            <table>
            <tr><td><h4>Book details</h4></td></tr>
            <tr><td>isbn:<?php echo $bookrow['isbn']; ?></td></tr>
            <tr><td>Book Name:<?php echo strtoupper($bookrow['book_name']);?></td></tr>
            </table>
            <hr/>
            <form action="script/issue.php?isbn=<?php echo $isbn;?>" method='post' id='report'>
            <input id="btn_issue" type="button" value="Issue this Book"/>
            <input id="btn_close" type="button" value="cancel"/>
            </form>
            </div>
            </body>
            </html>

You're checking `isset($_POST..` and then try to read from `$_GET`... — Nir Alfasi, Jan 31 '14 at 07:28
As @HarryFink already said, your script is vulnerable to SQL injections; you should read on [how to prevent them](http://stackoverflow.com/q/60174/53114). — Gumbo, Feb 01 '14 at 14:35
I know how to use mysqli_real_escape_string method for submiting data and preventing sql injection but as this was just sample code i hadn't included it — PalakM, Feb 01 '14 at 15:36

score 3 · Answer 1 · answered Jan 31 '14 at 07:27

You need to set attribute name to inputs in your form, after that you can access to value by GET or POST Change form method:

  <form action="script/issue.php?isbn=<?php echo $isbn;?>" method='get' id='report'>
                <input name ='isbn' id="btn_issue" type="button" value="Issue this Book"/>
                <input name ='eno' id="btn_close" type="button" value="cancel"/>
  </form>

Or get your variables from post, like:

  $isbn=$_POST['isbn'];
 $eno=$_POST['eno'];

score 1 · Answer 2 · answered Jan 31 '14 at 07:28

1

change your from method to get

<form action="script/issue.php?isbn=<?php echo $isbn;?>" method='get' id='report'>

or you can use $_REQUEST in php which can read either get or post

answered Jan 31 '14 at 07:28

Satish Sharma

9,547
6
29
51

score 0 · Answer 3 · edited Dec 18 '15 at 08:49

0

If you use method="POST", it meant you should use $_POST for your next process. Can use $_REQUEST also. But I think $_POST is more specifics for method POST. Please read the documentation of PHP about form method again.

edited Dec 18 '15 at 08:49

Irshad

3,071
5
30
51

answered Dec 18 '15 at 08:04

Idhos

23
1
4

$_GET not working properly

3 Answers3