0

I'm trying to do a normal insert query and it's working for my normal fields but I've added a textbox that generates dropdowns based on user input in that textbox that displays data from table or to be specific the questions under whatever is selected from the third dropdown.

 <?php
    $con = mysqli_connect("localhost","root","","imetrics");

    if(isset($_POST['submit'])){

        $catdd = $_POST['catdd'];
        $subbcatdd = $_POST['subcatdd'];
        $topdd = $_POST['topdd'];
        $gender = $_POST['gender'];
        $age = $_POST['age'];
        $occupation = $_POST['occupation'];
        $status = $_POST['status'];



        $insert = mysqli_query($con, "INSERT INTO `surveyform` (`surveycategory`,`surveysubcategory`,`surveytopic`,`gender`,`age`,`occupation`,`status`) VALUES ('$catdd','$subbcatdd','$topdd','$gender','$age','$occupation','$status')");
        if(!$insert){
            echo mysqli_errno();
        }
        else{
            echo '<script language="javascript">';
            echo 'alert("Registration Success!")';
            echo '</script>';
        }
    }



    ?>
    <html>
    <head>
        <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js">
        </script>

        <script>
            $(document).ready(function(){
                $("#execute").click(function(){
                    var numQ = +$('#q_num').val();
                    //Loop--
                    for(var ctr=0; ctr < numQ; ctr++){
                        var str = load_questions();
                        $("#divQuestions").append(str);
                    }
                });
            });
        </script>

    </head>

    <body>

    <div id="divQuestions">


    </div>

    <form name="form1" action="" method="POST">

        <table>

            <tr>

                <td>Survey Title</td>

                <td><input type="text" name="surveytitle" placeholder="Enter Title" required</td>

            </tr>

            <tr>

                <td>Select Category</td>
                <td>

                        <select id="categorydd" name="catdd" onChange="change_category()">

                            <option>--None Selected--</option>

                            <?php
                            $query=mysqli_query($con, "SELECT category_id, categoryname FROM category WHERE ParentCategoryID IS NULL");
                            while($row=mysqli_fetch_array($query)) {
                                ?>
                                <option value="<?php echo $row["category_id"]; ?>"><?php echo $row["categoryname"]; ?></option>

                                <?php
                            }
                            ?>

                        </select>
                </td>

            </tr>

            <tr>

                <td>Select Subcategory</td>

                    <td>

                        <div id="subcategory">

                            <select>

                                <option>-- None Selected--</option>

                            </select>

                        </div>

                    </td>

            </tr>

            <tr>

                <td>Number of questions:</td>

                <td>
                    <span id="ctr_num"> <input id="q_num" size="2" placeholder="#"/></span>
                    <div id="question">

                    </div>

                </td>

            </tr>

            <tr>
                <td>Select Topic:</td>

                <td>

                    <div id="topic">

                        <select>

                            <option>-- None Selected--</option>

                        </select>

                    </div>

                </td>

            </tr>

            <tr>

                <td>Gender:</td>

                <td><input type="radio" name="gender" value="male">Male

                    <input type="radio" name="gender" value="female">Female

                </td>


            </tr>

            <tr>

                <td>Age:</td>

                <td><input type="text" name="age" placeholder="How old are you? " required</td>


            </tr>

            <tr>


                <td>Occupation:</td>

                <td><select name="occupation">
                        <option>--None Selected--</option>
                        <option>Grade School</option>
                        <option>K-12</option>
                        <option>College</option>
                        <option>Working Student</option>
                        <option>Employed</option>
                        <option>Unemployed</option>
                    </select></td>


            </tr>


                <tr>

                        <td>Work Status:</td>

                        <td><select name="status">
                                <option value="">--None Selected--</option>
                                <option value="1">Part-time</option>
                                <option value="2">Full-time</option>
                                <option value="3">Casual</option>
                            </select></td>

                </tr>

            <tr>

                    <td><input id="btnSaveSurvey" type="submit" name="submit" value="Save Survey">
                    <input id="btnSaveSurvey" type="submit" name="resetsurvey" value="Reset Survey"></td>

                </tr>

            </tr>

        </table>



    </form>
    </body>

    </html>




    <script type="text/javascript">

        function change_category()
        {
            var xmlhttp=new XMLHttpRequest();
            xmlhttp.open("GET","ajax.php?category="+document.getElementById("categorydd").value,false);
            xmlhttp.send(null);
            document.getElementById("subcategory").innerHTML=xmlhttp.responseText;


            if(document.getElementById("categorydd").value=="--None Selected--")
            {
            document.getElementById("topic").innerHTML="<select><option>--None Selected--</option></select>";
            }
        }

        function change_subcategory()
        {
            var xmlhttp=new XMLHttpRequest();
            xmlhttp.open("GET","ajax.php?subcategory="+document.getElementById("subcategorydd").value,false);
            xmlhttp.send(null);
            document.getElementById("topic").innerHTML=xmlhttp.responseText;
        }


        function change_topic()
        {
            var xmlhttp=new XMLHttpRequest();
            xmlhttp.open("GET","ajax.php?topic="+document.getElementById("topicdd").value,false);
            xmlhttp.send(null);
            document.getElementById("question").innerHTML=xmlhttp.responseText;
        }

        function load_questions(){

            var xmlhttp=new XMLHttpRequest();
            xmlhttp.open("GET","ajax.php?topic="+document.getElementById("topicdd").value +"&cnt="+document.getElementById("q_num").value,false);
            xmlhttp.send(null);
            document.getElementById("question").innerHTML=xmlhttp.responseText;

        /*
            var html_code = "<select>";

            html_code+= "<option>--None Selected--</option>";

            html_code += "</select></br>";

            return html_code;

            */
        }


    </script>

2nd php file

<?php
$con = mysqli_connect("localhost","root","","imetrics");

$category= isset($_GET["category"])?$_GET["category"]:"" ;
$subcat=isset($_GET["subcategory"])?$_GET["subcategory"]:"";
$question=isset($_GET["topic"])?$_GET["topic"]:"";
$cnt=isset($_GET["cnt"])?$_GET["cnt"]:"";

if($category!=""){

    $query=mysqli_query($con, "SELECT category_id, categoryname FROM category WHERE ParentCategoryID =$category ");
echo "<select id='subcategorydd' name='subcatdd' onChange='change_subcategory()'>";
    echo " <option>--None Selected--</option>";
while($row=mysqli_fetch_array($query))
{
    echo "<option value='$row[category_id]' selected>"; echo $row["categoryname"]; echo "</option>";
}
    echo "</select>";
}

if($subcat!=""){

    $query=mysqli_query($con, "SELECT * FROM topic WHERE SubCat = $subcat ");
    echo "<select id='topicdd' onchange='load_questions()'>";
    echo " <option>--None Selected--</option>";
    while($row=mysqli_fetch_array($query))
    {
        echo "<option value='$row[topic_id]' selected>"; echo $row["title"]; echo "</option>";
    }
    echo "</select>";
}

if($question !="" && $cnt!=""){

    for ($i = 1; $i <= $cnt; $i++)
    {
        $query=mysqli_query($con, "SELECT * FROM question WHERE question_topic = $question ");
        echo "<select id='question_dropdown".$i."'>";
        echo "<option>--None Selected--</option>";
        while($row=mysqli_fetch_array($query))
        {
                 echo "<option value='$row[question_id]' selected>"; echo $row["questiontitle"]; echo "</option>";
        }
        echo "</select>";
        echo "<br />";
        echo "<br />";
    }
}


?>

This is my database table design and it's currently working for the normal fields but now I need to know if my current insert query in the first php file is wrong for the goal that I'm trying to reach which is doing an insert with the dynamic dropdowns that is generated based on user input in the textbox. Btw this is for school project so they don't mind about sql injection.

Current database design

enter image description here

Rahul Sharma
  • 2,867
  • 2
  • 27
  • 40
Jola
  • 55
  • 9
  • Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) – RiggsFolly Feb 13 '17 at 09:39
  • Please read [What topics can I ask about](http://stackoverflow.com/help/on-topic) and [How to ask a good question](http://stackoverflow.com/help/how-to-ask) and [the perfect question](http://codeblog.jonskeet.uk/2010/08/29/writing-the-perfect-question/) and how to create a [Minimal, Complete and Verifiable example](http://stackoverflow.com/help/mcve) – RiggsFolly Feb 13 '17 at 09:39

0 Answers0