How to use the selected option value of the drop down in a SQL query in php file?

Question

I created a form which has a drop down list and uploading files. The drop down list values is populated from a database. The action file for this form is the add.php file which updates the database and uploads the file in the database. I want to update the database from the option which the user selects from the drop down list which has a select name "to_user" and for that row in the database, the files is uploaded corresponding to the selected option value. I am using this SQL query in add.php file :

 mysql_query(" UPDATE TABLE2 SET COL6=('$filename') WHERE COL1=$_POST['to_user'] ");

I am getting an error. What should I do? Error : Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING) in /Applications/XAMPP/xamppfiles/htdocs/add.php on line 21

index.php - webpage which has the drop down list and file uploading option

add.php- action file of the form created in index.php file

index.php

<!DOCTYPE html>
<html>
<head>
<title>Sch </title>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1”>
<link rel="stylesheet" href="https://www.w3schools.com/tags/tag_select.asp">
<link rel = "stylesheet" href="custom.css">
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
<script src="http://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/js/bootstrap.min.js"></script>

<style>


div.container {
    margin: 20px 0 20px 0;
    padding: 20px;
} 
div.space {
    margin: 2px 0 2px 0;
    padding: 1px;
} 
div.space1 {
    margin: 2px 0 2px 0;
    padding: 1px;
} 
div.space2 {
    margin: 2px 0 2px 0;
    padding: 2px;
} 

div.space3 {
    margin: 2px 0 2px 0;
    padding: 2px;
} 

div.space4 {
    margin: 2px 0 2px 0;
    padding: 2px;
} 

div.space5 {
    margin: 10px 0 15px 0;
    padding: 2px;
} 


</style>
</head>
<body>


<div class="container">
<h2>Select the Radioactive source and upload the documents:</h2>
</div>


<form enctype="multipart/form-data" action="add.php" method="POST">  

<div class="space">
<?php include('d2.php') ?>

<select name="to_user" class="form-control">
<option value="pick">Radioactive source</option>
<?php
$sql = mysqli_query($con, "SELECT DISTINCT COL1 FROM TABLE2");
$row = mysqli_num_rows($sql);
while ($row = mysqli_fetch_array($sql))
{
echo "<option value='". $row['COL1'] ."'>" .$row['COL1'] ."</option>" ;
}
?>
</select>
</div>

<div class="space1">
<p>
Upload NOC file :<br>
<input type="file" name="datafile1" size="40">
</p> </div>

<div class="space2">
<p>
Upload LT file :<br>
<input type="file" name="datafile2" size="40">
</p> </div>


<div class="space3">
<p>
Upload Import Noc file :<br>
<input type="file" name="datafile3" size="40">
</p> </div>

<div class="space4">
<p>
Upload Photo Inventory file :<br>
<input type="file" name="datafile4" size="40">
</p>
</div>

<div class="space5">
<input type="submit" value=Submit
</div>
</form>

<div class="background">
<div class="transbox">

</body>
<footer>done </footer> </html>

add.php

<?php include('index2.php') ?> 
<?php 

 $file1=( $_FILES['datafile1']['name']);
 $file_size1 = $_FILES['datafile1']['size']; 

 $file2=( $_FILES['datafile2']['name']);
 $file_size2 = $_FILES['datafile2']['size'];  

 $file3=( $_FILES['datafile3']['name']);
 $file_size3 = $_FILES['datafile3']['size'];  

 $file4=( $_FILES['datafile4']['name']); 
 $file_size4 = $_FILES['datafile4']['size']; 

 mysql_connect("localhost", "root", "") or die(mysql_error()) ; 
 mysql_select_db("CSV_DB") or die(mysql_error()) ; 

 if($file_size1 >0) 
 {
 mysql_query("UPDATE Table2 SET COL6=('$file1') WHERE COL1=$_POST['to_user']")or die('Error, query failed'); 
 }
 if($file_size2 >0)
 {
 mysql_query("UPDATE Table2 SET COL7=('$file2') WHERE COL1=$_POST['to_user']")or die('Error, query failed');
 }
 if($file_size3 >0)
 {
 mysql_query("UPDATE Table2 SET COL8=('$file3') WHERE COL1=$_POST['to_user']")or die('Error, query failed');
 }
 if($file_size4 >0)
 {
 mysql_query("UPDATE Table2 SET COL9=('$file4') WHERE COL1=$_POST['to_user']")or die('Error, query failed');
 }

echo "<br>File $file1 uploaded<br>";  
echo "<br>File $file2 uploaded<br>";  
echo "<br>File $file3 uploaded<br>";  
echo "<br>File $file4 uploaded<br>";  

?>

Why are you using round brackets on $filename? I have two suggerences: First, use mysqli, mysql is deprecated. Second: Use mysql_error() function to check the error reason. — Sakura Kinomoto, May 28 '17 at 14:46
Please show all relevant code in the question itself .... and be specific about what errors are. Code in images can't be copied and requires us to open 2 addiitonal sources to read what should simply be available in the question itself — charlietfl, May 28 '17 at 14:46
Please tell me this is just a test or for a personal project. Because that code is open to sql injection. Please do not put that code on a server. Read up about sql security first. I think the reason you are having trouble is the way you add the to_user variable. Rather escape it properly like so: `".$_POST['to_user']` But again, please read up about sql injection before continuing with your project. — Chris, May 28 '17 at 14:55
@SakuraKinomoto It works when I use the SQL query mysql_query("UPDATE Table2 SET COL6=('$file1') "). But it updates all the column 6 in the database. I want it to only update it in selected option value of the drop down, for that row in the column 6. — Jay Borkar, May 28 '17 at 15:01
@Chris It is for a personal project. I used mysql_query("UPDATE Table2 SET COL6=('$file1') WHERE COL1=.$_POST['to_user']")or die('Error, query failed'); Still error is coming. — Jay Borkar, May 28 '17 at 15:04
Two things: First, is a bad idea to use directly $_POST on query. Please check the parameter, and, at least, use apostrophes to enclose them. Also, instead of die, use here a mysql_error() to get the error from SQL Server. — Sakura Kinomoto, May 28 '17 at 15:05
@SakuraKinomoto I did the changes still the error is coming. — Jay Borkar, May 28 '17 at 15:11
If you try to use mysql_error, please post message given. Also, on your add.php, check querys after if file_size2, you have double die() statements. — Sakura Kinomoto, May 28 '17 at 15:13
Of course `or die('Error, query failed')` achieves nothing here, because this has nothing to do with the database, it is a PHP syntax error. Go read http://php.net/manual/en/language.types.string.php#language.types.string.parsing, it contains the absolutely basic knowledge that you are missing here. — CBroe, May 28 '17 at 16:07

score 0 · Accepted Answer · answered May 28 '17 at 15:58

Try:

mysql_query(" UPDATE TABLE2 SET COL6=('$filename') WHERE COL1=" . $_POST['to_user'] . " ")

PHP gives problem including arrays inside strings, the same way you added $filename.

Depending on the variable type, you might have to add quotes to the query:

mysql_query(" UPDATE TABLE2 SET COL6=('$filename') WHERE COL1='" . $_POST['to_user'] . "' ")

How to use the selected option value of the drop down in a SQL query in php file?

1 Answers1