0

I have created php coding to generate excel file. data are grab from SQL tables but the result are displayed with the HTML tags to the csv file. please see the attached image file which shows the output of below coding.

//genarate report
$out = '';
$filename_prefix = 'showroom_report';
$filename = $filename_prefix."_".$fromDate."-".$toDate;
$pay_array = array();
$showroom_array = array();
$location_id_array = array();
$pay_sql = "SELECT abans_crm.pay_mode.pay_mode,
                        Count(abans_crm.customers.purchase_type) AS mode_count,
                        abans_crm.customers.location_id
                        FROM
                                abans_crm.customers
                        INNER JOIN abans_crm.pay_mode ON abans_crm.customers.purchase_type = abans_crm.pay_mode.mode_id
                        WHERE
                                DATE(
                                        abans_crm.customers.purchase_date
                                ) >= '$fromDate'
                        AND DATE(
                                abans_crm.customers.purchase_date
                        ) <= '$toDate'   
                        GROUP BY
                                abans_crm.pay_mode.pay_mode";

            $pay_result = mysql_query($pay_sql) or die(mysql_error());

            if (mysql_num_rows($pay_result) > 0) {
                while($row = mysql_fetch_assoc($pay_result)) {
                      array_push($pay_array, $row);
                      array_push($location_id_array, $row['location_id']);
                }
            }

            $location_id_unique = array_unique($location_id_array);
            $location_id_result = implode(", ", $location_id_unique);

    //load showroom names         
        $showroom_sql = "SELECT 
                        sh_sso.showrooms.showroom_id,
                        sh_sso.showrooms.showroom_name
                        FROM
                                sh_sso.showrooms
                        WHERE 
                              sh_sso.showrooms.showroom_id IN ($location_id_result)";

       $showroom_result = mysql_query($showroom_sql) or die(mysql_error());

            while($row = mysql_fetch_assoc($showroom_result)){
                  array_push($showroom_array, $row);
            } 

            echo "<table border=1 >\n"; 
            echo "<thead><tr class=\"tableizer-firstrow\"><td colspan=6>Enquiries Report - $fromDate-to-$toDate</td></tr></thead><tbody>\n"; 
            echo " <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>\n"; 
            echo " <tr><td>SHOWROOM</td><td colspan=4>PAYMENT METHOD</td><td rowspan=2>Total</td></tr>\n"; 
            echo " <tr>"
                . "<td>&nbsp;</td>"
                . "<td>CASH</td>"
                . "<td>CREDIT CARD</td>"
                . "<td>HIRE PURCHASE</td>"
                . "<td>LEASE</td>"
                . "</tr>\n";

            $cash_val = 0;
            $credit_val = 0;
            $hire_val = 0;
            $lease_val = 0;
            $row_total = 0;

            for ($i=0; $i < count($showroom_array); $i++) {
                  $cash_val = searchArray($pay_array, $showroom_array[$i]['showroom_id'], 'Cash');
                  $credit_val = searchArray($pay_array, $showroom_array[$i]['showroom_id'], 'Credit Card');
                  $hire_val = searchArray($pay_array, $showroom_array[$i]['showroom_id'], 'Hire Purchase');
                  $lease_val = searchArray($pay_array, $showroom_array[$i]['showroom_id'], 'Lease');
                  include_once("../../../includes/sh_cms_functions.php");
                  $row_total = $row_total + $cash_val;
                  $row_total = $row_total + $credit_val;
                  $row_total = $row_total + $hire_val;
                  $row_total = $row_total + $lease_val;
                  echo "<tr>"
                  . "<td>".$showroom_array[$i]['showroom_name']."</td>"
                  . "<td>".$cash_val."</td>"
                  . "<td>".$credit_val."</td>"
                  . "<td>".$hire_val."</td>"
                  . "<td>".$lease_val."</td>"
                  . "<td>".$row_total."</td>"
                  . "</tr>\n"; 
                  $row_total = 0;
            }

            echo "</tbody></table>\n";

        //Generate the CSV file header
        header("Content-type: application/vnd.ms-excel");
        header("Content-Encoding: UTF-8");
        header("Content-type: text/csv; charset=UTF-8");
        header("Content-disposition: csv" . date("Y-m-d") . ".csv");
        header("Content-disposition: filename=".$filename.".csv");
        echo "\xEF\xBB\xBF"; // UTF-8 BOM
        //Print the contents of out to the generated file.
        print $out;
        //Exit the script
        exit;
        mysql_close();          
}

above coding will generate CSV file.

result

Muhammad Arif
  • 1,014
  • 3
  • 22
  • 56
asela daskon
  • 496
  • 1
  • 8
  • 21
  • csv !== html !== Excel – Mark Baker Apr 18 '16 at 11:33
  • where should i type the above coding – asela daskon Apr 18 '16 at 11:38
  • your header content-type must be excel, not csv. See more here: http://stackoverflow.com/questions/9856518/php-excel-header – mitkosoft Apr 18 '16 at 11:40
  • [Little Bobby](http://bobby-tables.com/) says [your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard Apr 18 '16 at 12:31
  • Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). – Jay Blanchard Apr 18 '16 at 12:31

1 Answers1

0

You have HTML in the output, just simply remove it.

Matt Jameson
  • 582
  • 3
  • 16