1

I have the table below which I have fileld with some default values:

    while($records=mysql_fetch_array($result))
{
    echo "<tr>";
    echo "<td>".$records['item1']."</td>";
    echo "<td>".$records['item2']."</td>";
    echo "<td>".$records['item3']."</td>";
    echo "<td>".$records['item4']."</td>";
    echo "<td>".$records['item5']."</td>";
    echo "<td>".$records['item6']."</td>";
    echo "<td>".$records['item7']."</td>";
    echo "</tr>";
}
echo "</table>";

I also have a my_sql query statement that looks like this and references a function which sorts all the data by asc or desc:

$sortBy=$_POST['SortBy'];
$sortIn=$_POST['SortIn'];
$sql="SELECT * FROM Results ORDER BY $sortBy $sortIn";

$result=mysql_query($sql, $conn);
echo "<table>";

All of this works successfully with a bunch of connection statements that I won't include. I also have a 2 option radio button that looks like this:

Include newItem
<input type="radio" name="IncludeNewItem" value="1" />Yes
<input type="radio" name="IncludeNewItem" value="0" />No

What I am trying to do is set it so that when I submit the user options from the HTML page, the table is generated (and sorted) and depending on the state of the radio button, it should either display or not display another column which already exists in the database. (For examples sake, let's call this 'item 8').

I tried creating something that looks like this:

$includeNI = if(isset($_POST['IncludeNewItem']))
    {Alter Table Results Add $newItem };

But I'm really unsure about the syntax as I'm new to this language. All help is appreciated.

Brian Tompsett - 汤莱恩
  • 5,753
  • 72
  • 57
  • 129
aTubOfAdam
  • 91
  • 1
  • 7
  • 1
    I imagine you just need to do `if(!empty($_POST['IncludeNewItem'])) { //do code }` – Rasclatt Jan 19 '17 at 16:14
  • Please stop using deprecated `mysql_*` and [Little Bobby](http://bobby-tables.com/) says [your script is at risk for SQL Injection Attacks](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – [Jay Blanchard](http://stackoverflow.com/users/1011527/jay-blanchard) – Jeff Puckett Jan 19 '17 at 16:51
  • In terms of security, this is just coursework, I'm not worrying about that kind of stuff atm. – aTubOfAdam Jan 19 '17 at 17:22

0 Answers0