how to get values from HTML select to php\sql

Question

I'm trying to pass values from an html form <select> list to a SQL table. I've tried several things but can't get it to work.

HTML

<select class="select-list">
    <option value="volvo" class="selectval">
        Volvo
    </option>

    <option value="saab" class="selectval">
        Saab
    </option>

    <option value="mercedes" class="selectval">
        Mercedes
    </option>

    <option value="audi" class="selectval">
        Audi
    </option>
</select>

PHP

$name = filter_var($_POST['name'],FILTER_SANITIZE_STRING);
$email = filter_var($_POST['email'],FILTER_VALIDATE_EMAIL);
$email = filter_var($email,FILTER_SANITIZE_EMAIL);
$phone = filter_var($_POST['phone'],FILTER_SANITIZE_STRING);

if (empty ($name)|| empty ($email) || empty ($phone) || !isset($select)) {

    return;

} else {

    mysql_connect('localhost' , 'root' , '');
    mysql_select_db('show_express');        

    $name = clean_inputs($name);
    $email = clean_inputs($email);
    $phone = clean_inputs ($phone);     

    $sql = "INSERT INTO clients(id,name,email,phone,bands) ";
    $sql .= "VALUES('','$name','$email','$phone','$select')";
    mysql_query($sql);

    if (mysql_affected_rows()) {
        echo true;          
    }       

}


function clean_inputs($input) {
   $clean = mysql_real_escape_string(stripcslashes($input));
   return $clean;       
}

Answer 1

Firstly, you don't have $select defined/instantiated anywhere in your code. So how can you test it or insert it if it isn't present?

Secondly, I presume that the issue you're facing is that you do not have a name attribute on your select element? (Please provide your form code to verify)

So you'd have to create a select that looks something like this:

<select name="car">
    <option value="audi">Audi</option>
    <option value="saab">Saab</option>
    ....etc
</select>

Which in turn allows you to access the select like this:

$select = filter_var($_POST['car'], FILTER_SANITIZE_STRING);

Notice the name attribute in the <select> tag? Yeah, you'll need that to access the value.

And as stated in the comments, PLEASE avoid using mysql_* functions as the library is depreciated.

Look at this comment for more information as to why you should avoid them.

---

And just for extra cookie points, here's an example of how you'd do an insert using PDO. (Taken from this answer)

$db = new PDO("...");
$statement = $db->prepare("insert into clients(id,name,email,phone,bands) VALUES(NULL,:name, :email, :phone, :select)");
$statement->execute(array(':name' => $name, ':email' => $email, ':phone' => $phone, ':select' => $select));
$row = $statement->fetch(); // Use fetchAll() if you want all results, or just iterate over the statement, since it implements Iterator

Answer 2

You are using the variable $select but it's not being initiated anywhere. You need to use something like this.

 $select = filter_var($_POST['select'],FILTER_SANITIZE_STRING);

Next time post your client side script.

Answer 3

This is something along the lines of what I use:

<?php
$db_host = 'localhost';
$db_name = 'show_express';
$db_user = 'root'; // you REALLY shouldn't use root for normal access
$db_pass = ''; // you REALLY need to use a password

$dbh = new PDO('mysql:host='.$db_host.';dbname='.$db_name, $db_user, $db_pass);
if (!$dbh)
{
    print "<p>Error connecting to database</p>";
    exit;
}

$q_insert = $dbh->prepare(
    "INSERT INTO clients (name, email, phone) VALUES (?,?,?);"
);
if (!$q_insert)
{
    $err = $q_insert->errorInfo();
    print "<p>Error preparing query: ".$err[2]." [".$err[0]."]</p>";
    exit;
}

$r = $q_insert->execute(array($_POST['name'], $_POST['email'], $_POST['phone']));
if (!$r)
{
    $err = $q_insert->errorInfo();
    print "<p>Error executing query: ".$err[2]." [".$err[0]."]</p>";
    exit;
}

print "<p>Success!</p>";
?>

I would strongly suggest you start learning to use PDO instead of the mysql_ functions. They make way more sense, the paradigm aligns with other languages, and the knowledge you gain will be portable.

I know this is just a newbie project, but don't use the 'root' user, especially without a password. Create a new user with permissions only for the 'show_express' database.

When asking questions, it is helpful if you tell us how it doesn't work. Are you getting an error message? Is the data ending up in the table but not correctly? Also, along those lines, how do you know it didn't work. I.e., what are you using to verify this code?