How to use a dynamic dropdown created from a database to build a MySQL Query

Question

I have built a dropdown list using PHP to show all the Unique names in my Table. I want to use that dropdown list to then use the selected value to create a MySQL Statement Dynamically.

Select * From iot_sensors WHERE Sensor_ID = ['USE the DROPDOWN MENU TO SELECT A NAME']

$select2 = "SELECT DISTINCT Sensor_ID FROM iot_sensors;";
$result2 = mysqli_query($conn, $select2);
$counter2 = mysqli_num_rows($result2);

echo "<select name ='Sensor Names'>";
    while ($row = mysqli_fetch_assoc($result2)){
    echo "<option value ='".$row['Sensor_ID']."'>".$row['Sensor_ID']."   </option>";
}
    $dynamic_query = "SELECT * FROM iot_sensors WHERE Sensor_ID = ['option value']";
echo "</select>";

I understand usually if I had manually populated the dropdown menu all I would have to do is call the option value but here the option value is on there for HTML rendering purposes.

Answer 1

First some warnings:

Little Bobby says your script is at risk for SQL Injection Attacks. Learn about prepared statements for MySQLi. Even escaping the string is not safe! Don't believe it?

---

First, do not use names with spaces for HTML elements:

echo "<select name ='Sensor_Names'>";

Once selected and submitted (without knowing what your form method= is) the item will be in the $_REQUEST array:

$sensor_name = $_REQUEST['Sensor_Names'];
$dynamic_query = "SELECT * FROM iot_sensors WHERE Sensor_ID = '$sensor_name'";