php html database table redundancy

Question

I am trying to to display this table information from the database based on the location but no matter what email id i enetr its only displaying data from lacation oxford. Can anyone please let me know what is wrong with the code i am new to php and trying to get some hands on expirience Thanks in advance Here is a snippet of my code

<?php
 if (isset($_POST['submitbutton']))
        {
            $email = $_POST['email'];
            $password = $_POST['password'];
            $sql = "SELECT email,password from users WHERE email = '".$email."' AND password ='".$password."'";
            $result = $conn->query($sql);
                     if ($email = "oxford@connectone.com")
                     {
                         echo 'The email is'. $email;
                         $query = "Select * from stock WHERE location = 'oxford'";
                         $result1 = $conn->query($query);
                          if ($result1->num_rows > 0){
                              ?>
                           <table class="reports">>
                              <thead>
                              <tr> 
                              <th> Item name </th>
                              <th> Price </th>
                              <th> Quantity </th>
                              <th> Quantity Damaged </th>
                              </tr> </thead> <tbody>
                              <?php
                            while( $row = $result1->fetch_assoc() ){
                            echo
                                 "<tr>
                                     <td>{$row['item_name']}</td>
                                     <td>{$row['price']}</td>
                                     <td>{$row['quantity']}</td>
                                     <td>{$row['quantity_damaged']}</td>
                                     </tr>\n";
                          }  ?> </tbody>
                </table>  
                    <?php  
                          }

                     }
                     elseif ($email = "bridgport@connectone.com")
                     {
                         echo 'The email is'. $email;
                         $query1 = "Select * from stock WHERE location = 'bridgeport'";
                         $resut2 = $conn->query($query1);
                         if ($result2->num_rows > 0){
                               ?>
                           <table class="reports">
                              <thead>
                              <tr> 
                              <th> Item name </th>
                              <th> Price </th>
                              <th> Quantity </th>
                              <th> Quantity Damaged </th>
                              </tr> </thead> <tbody>
                              <?php
                            while( $row = $result2->fetch_assoc() ){
                            echo
                                 "<tr>
                                     <td>{$row['item_name']}</td>
                                     <td>{$row['price']}</td>
                                     <td>{$row['quantity']}</td>
                                     <td>{$row['quantity_damaged']}</td>
                                     </tr>\n";
                          }  ?>

Please be aware that directly interpolating strings into your queries (`email = ".$email."...`) is extremely dangerous and you should read why this is a problem: https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1. Also, storing passwords in plain text should never be done, you should use the inbuilt PHP password hashing functions: http://php.net/manual/en/faq.passwords.php — Scopey, Aug 31 '17 at 23:16

score 2 · Accepted Answer · answered Aug 31 '17 at 23:11

You are assigning values in your if statements:

if ($email = "oxford@connectone.com")

When you assign values, the value of the assignment is returned ("oxford@connectone.com"). This string is "truthy" (evaluates as true) so the first if statement runs and all the else's are ignored.

You should be using a comparison operator - == or ===.

if ($email === "oxford@connectone.com") { //... }
elseif ($email === "bridgport@connectone.com") { //... }

php html database table redundancy

1 Answers1