how do I update my votes into my sql with my dropdown, textfield and submit button?

Question

how do I update my votes into my sql with my dropdown, textfield and submit button? Im badly need help to fix my codes. its almost 1week and I cant still figure out. this is the scenario if I put 20 in textfield, it will add +20 into my totalvotes column in mysql

this is my textfield and submit button

<?php
$teacherz = $_POST['teacher_dropdown'];
$votecount = $_POST['votecount'];
$sql = "SELECT facultyname FROM subj_eva";

echo "<form method='post' action='cof_test.php'>
    <input type='text' name='votecount'>
    <input type='submit' name='submit' value='Submit now'>
    </form>";


$teacherz = $_POST['teacher_dropdown'];
$votecount = $_POST['votecount'];
$sql = "SELECT facultyname FROM subj_eva";

if (isset($_POST['submit'])) {
    $sql = "UPDATE $subj_eva SET facultyname='$teacherz', totalvotes=totalvotes + '$votecount'";
}
$result=mysql_query($sql);
?>

and this one is my dropdown

<?php
mysql_connect('localhost', 'root', 'password');
mysql_select_db('ramon_pascual');

$sql = "SELECT facultyname FROM subj_eva";
$result = mysql_query($sql);

echo "<select name='teacher_dropdown'>";
while ($row = mysql_fetch_array($result)) {
    echo "<option value'" . $row['facultyname'] ."'>" . $row['facultyname'] . "</option>";
}
echo "</select>";

?>

Your code is vulnerable to [SQL-Injection](http://stackoverflow.com/q/60174/4193263). Be careful. — ByteHamster, Feb 22 '15 at 08:17
The `select` box has to be in the same `
` like the `votecount` input button. — ByteHamster, Feb 22 '15 at 08:19

Leandro Papasidero · Accepted Answer · 2015-02-22T09:08:07.803

I just refactored your code

Form file (index.php)

<?php
if (!$link = mysql_connect('localhost', 'root', 'password')) {
    echo 'Could not connect to mysql';
    exit;
}

if (!mysql_select_db('stackoverflow', $link)) {
    echo 'Could not select database';
    exit;
}

$sql    = 'SELECT facultyname FROM subj_eva';
$result = mysql_query($sql, $link);

if (!$result) {
    echo "DB Error, could not query the database\n";
    echo 'MySQL Error: ' . mysql_error();
    exit;
}
?>


<!doctype html>
<html lang="en">
  <head>
  <meta charset="utf-8">
  <title>Title</title>
</head>
<body>
    <form method='post' action='cof_test.php'>
       <input type='text' name='votecount'>
       <select name='teacher_dropdown'>
       <?php
          while ($row = mysql_fetch_assoc($result)) {
            echo "<option value'" . $row['facultyname'] ."'>" . $row['facultyname'] . "</option>";
          }
       ?>
       </select>
       <input type='submit' name='submit' value='Submit now'>
    </form>

</body>
</html>
<?php mysql_free_result($result);?>

cof_test.php File

<?php
$teacherz = isset($_POST['teacher_dropdown']) ? $_POST['teacher_dropdown'] : "";
$votecount = isset($_POST['votecount'])  ? $_POST['teacher_dropdown'] : "";

if (isset($_POST['submit'])) {
    $sql = "UPDATE $subj_eva SET facultyname='$teacherz', totalvotes = totalvotes + '$votecount'";
}
$result=mysql_query($sql);

BTW, I highly recommend you to use PDO instead mysql. First of all, mysql is deprecated. Second SQL injection issues with your code. PDO prevent SQL injection using prepare statements. However, at the end, it is your choice. :) — Leandro Papasidero, Feb 22 '15 at 09:08

how do I update my votes into my sql with my dropdown, textfield and submit button?

1 Answers1