SQL Statement not generating results and going back to the previous SQL Statement entered

Question

I have a form. Users are supposed to enter sql statement into the form textarea box. The sql statement will generate results. However, when I insert an sql statement into the form, it displays results to the previous SQL statement inserted into the form. It does not show the current SQL statement inserted results. Any help for this?

PHP Code

<?php
    if (isset($_POST['submit']))
    {
        $sqlinput =  $_POST['sql_input'];
        $title = $_POST['title'];
        $description = $_POST['description'];
        $assigneduser = $_POST['assigned_user'];

        $new = "INSERT INTO `new_default_reports`(`sql_statement`, `description`, `graph_title`, `assigned_user`) VALUES ('$sqlinput' , '$description', '$title' , '$assigneduser')";
        $resultnew = $conn->query($new);

        $query = "SELECT * FROM `new_default_reports` ORDER BY `id` DESC ";
        $result = $conn->query($query);
        $row = $result->fetch_assoc();
        $id_report = $row['id'];
        header('Location: previewgraphs.php?notify=yes&id='.$id_report);
    }

Form

<form method="post" action="">

    <label>Graph Title</label>
    <input type="text" id= "title" name="title" class="form-control" value =<?php if (isset($_POST['submit'])){ echo $_POST['title'];} ?>

    <label>Description</label>
    <textarea class="form-control" name = "description" rows="3" id="desc" placeholder="Graph Description"><?php if (isset($_POST['submit'])){ echo $_POST['description'];} ?></textarea>

    <div class="form-group">
    <label> Query Generator </label>
    <textarea class="form-control" name="sql_input" rows="5" id="comment" placeholder="Select statement input here..."><?php if (isset($_POST['submit'])){ echo $_POST['sql_input'];} ?></textarea>

    <button type="submit" name="submit" class="btn btn-primary">Generate Graph</button>
</form>

Previewgraph.php

<?php
    $id =  $_GET['id'];
    $query = "SELECT * FROM new_default_reports WHERE id = '$id'";
    $result = $conn->query($query);
    $row = $result->fetch_assoc();
    $query = $row['sql_statement'];
    $result = $conn_temp->query($query);


    <div class="col-md-12">
        <?php if(isset($_REQUEST['notify'])){ ?>
        <div class="alert alert-success fade in">
        <a href="#" class="close" data-dismiss="alert">&times;</a>
        A New Graph <?php echo $row['graph_title']; ?> has been created.
    </div>
    <?php } ?>

    <?php
    $query = $row['sql_statement'];
    $result = $conn_temp->query($query);
?>

Use prepared statements. That is going to fail horribly. I also hope you aren't just executing the query from the DB.. — chris85, Dec 14 '15 at 06:14
Yes noted. But it keeps going back to the results of the previous SQL statement inserted in the form. @Saty — DivyaK, Dec 14 '15 at 06:15
Are you using `PDO` or `mysqli`? This thread should help you, http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php. — chris85, Dec 14 '15 at 06:16
Mysqli @chris85 how do i go about doing it? Possible to guide abit? — DivyaK, Dec 14 '15 at 06:22
Take a look at that thread and this doc; http://php.net/manual/en/mysqli.quickstart.prepared-statements.php. You want to separate input from query. — chris85, Dec 14 '15 at 06:27
@DivyaK, thanks for the edit, for me the logic should made the code work, but can you also share to us structure of the `new_default_reports` table? (mysql: `describe new_default_reports`) — catzilla, Dec 15 '15 at 07:23

SQL Statement not generating results and going back to the previous SQL Statement entered

0 Answers0