How to use a Switch Statement in PHP with FORM Post to Update, Search, and Insert into SQL Database?

Question

I have a form that has user input fields and 3 submit buttons at the bottom of the form. It's supposed to either update, insert, or search database records when filled out. I've tested my database connection and it is connecting. I've tested my Post and it is not null. But on my results page the only thing I ever see displayed is my default in my switch statement. So it seems like none of my case statements are working. The switch statement is supposed to work off of the $action submitted - either insert, update, or search.

form.php

<input type="submit" value="insert" name="action" class="btn btn-default">
<input type="submit" value="update" name="action" class="btn btn-default">
<input type="submit" value="search" name="action" class="btn btn-default">

form-results.php

require_once 'DataBaseConnection.php';

$firstName = $_POST['$firstName'];
$lastName = $_POST['$lastName'];
$phoneNumber = $_POST['$phoneNumber'];
$address1 = $_POST['$address1'];
$city = $_POST['$city'];
$zip = $_POST['$zip'];
$birthday = $_POST['$birthday'];
$username = $_POST['$username'];
$password = $_POST['$password'];
$sex = $_POST['$sex'];
$relationship = $_POST['$relationship'];
$action = $_POST['$action'];

?>
<div class="container">

        <div class="row" style="padding-top:100px;">
            <div class="col-md-12 col-sm-12">
                <h2>Family &amp; Friends Form</h2>
                <p>Results:</p>
                <?php
                if ( !empty($_POST) ) { echo"<p>not empty post</p>";}



                switch ($action){
                    case "insert":
                         $insert = "INSERT INTO `friends_family`.`users` (`firstName`,`lastName`,`phoneNumber`,`address1`,`city`,`state`,`zip`,`birthday`,`username`,`password`,`relationship`)
                             VALUES (`$firstName`, `$lastName`, `$phoneNumber`,`$address1`, `$city`,`$state`, `$zip`,`$birthday`,`$username`,`$password`,`$relationship`)";
                        $success = $con->query($insert);
                        if ($success == FALSE) {
                            $failmess = "Whole query " . $insert . "<br>";
                            echo $failmess;
                            die('Invalid query: '. mysqli_error($con));
                        } else {
                            echo "$firstName was added<br>";
                        }

                        break;
                    case "update":
                         $update = "UPDATE `friends_family`.`users` SET `phoneNumber` = '$phoneNumber', `address1` = '$address1', `city` = '$city', `zip` ='$zip', `birthday` = '$birthday',`username` = '$username',`password` = '$password',`relationship`='$relationship' WHERE `firstName` = '$firstName', `lastName`='$lastName'";
                        echo "$firstName $lastName was updated<br>";
                        break;
                    case "search":
                         $search = "SELECT * FROM friends_family.users WHERE firstName like '%$firstName%' ORDER BY firstName";
                        $return = $con->query($search);

                        if (!$return) {
                            $message = "Whole query " . $search;
                            echo $message;
                            die('Invalid query: ' . mysqli_error($con));
                        }
                       echo "<table class='table'><thead><th>First Name</th><th>Last Name</th><th>Phone</th><th>Address</th><th>City</th><th>State</th><th>Zip</th><th>Birthday</th><th>Sex</th><th>Relationship</th></thead><tbody>\n";
                        while ($row = $return->fetch_assoc()){
                            echo "<tr><td>" . $row['firstName']
                                    . "</td><td>" . $row['lastName']
                                    . "</td><td>" . $row['phoneNumber']
                                    . "</td><td>" . $row['address1']
                                    . "</td><td>" . $row['city']
                                    . "</td><td>" . $row['state']
                                    . "</td><td>" . $row['zip']
                                    . "</td><td>" . $row['birthday']
                                    . "</td><td>" . $row['sex']
                                    . "</td><td>" . $row['relationship'] . "</td></tr>\n";
                        }
                        echo "</tbody></table>";
                        break;
                        default:
                          echo "Error";
                            break;
                }
                    mysqli_close($con);
                ?>



            </div>


        </div>

As noted by @David in the answers, please do research SQL injection – this is a big risk in this script. — Zoe Edwards, Mar 11 '17 at 00:42

score 0 · Accepted Answer · edited May 23 '17 at 11:53

0

The name of the form element is action, not $action. So this:

$_POST['$action']

should be this:

$_POST['action']

(And similarly for the rest of your form elements.)

It's also worth noting that your code is wide open to SQL injection. You should look into using prepared statements with query parameters. This and this are good places to start.

edited May 23 '17 at 11:53

Community

1
1

answered Mar 11 '17 at 00:22

David

208,112
36
198
279

Doh! That fixed it. Thank you! – K. R. Mar 11 '17 at 00:41

How to use a Switch Statement in PHP with FORM Post to Update, Search, and Insert into SQL Database?

1 Answers1