0

everyone! I am making a form consisting of fully drop down selectable menus where the user will populate the field. After pressing the submit form, I plan that information will be pulled from a database to display search results to the user. I am a little new to SQL and PHP, so any help would be appreciated! I attached the form and PHP code separately.

            <form autocomplete="on" class="form-horizontal" action="" enctype="multipart/form-data" method="POST" name= "unit_assignments">
                <div class="col-sm-4">
                    <h4></h4>
                    <div class="panel panel-default background-light padded">
                        <div class="form-group">
                            <label for="course_designation" class="col-lg-4 control-label">Course</label>
                            <div class="col-lg-8">
                                <select type="hidden" class="form-control" name="course_designation" id="course_designation">
                                    <option value="" selected disabled>Please Select</option>
                                    <option value="_105">105</option>
                                    <option value="_105i">105i</option>
                                </select>
                            </div>
                        </div>
                    </div>
                </div>
                <div class="col-sm-4">
                    <h4></h4>
                    <div class="panel panel-default background-light padded">
                        <div class="form-group">
                            <label for="year" class="col-lg-4 control-label">Year</label>
                            <div class="col-lg-8">
                                <select type="hidden" class="form-control" name="year" id="year">
                                    <option value="" selected disabled>Please Select</option>
                                    <option value="_2018">2018</option>
                                    <option value="_2017">2017</option>
                                    <option value="_2016">2016</option>
                                    <option value="_2015">2015</option>
                                    <option value="_2014">2014</option>
                                    <option value="_2013">2013</option>
                                    <option value="_2012">2012</option>
                                    <option value="_2011">2011</option>
                                </select>
                            </div>
                        </div>
                    </div>
                </div>
                <div class="col-sm-4">
                    <h4></h4>
                    <div class="panel panel-default background-light padded">
                        <div class="form-group">
                            <label for="semester" class="col-lg-4 control-label">Semester</label>
                            <div class="col-lg-8">
                                <select type="hidden" class="form-control" name="semester" id="semester">
                                    <option value="" selected disabled>Please Select</option>
                                    <option value="fall">Fall</option>
                                    <option value="spring">Spring</option>
                                    <option value="summer">Summer</option>
                                    <option value="maymester">Maymester</option>
                                </select>
                            </div>
                        </div>
                    </div>
                </div>
                <div class="col-sm-4">
                    <h4></h4>
                    <div class="panel panel-default background-light padded">
                        <div class="form-group">
                            <label for="discipline" class="col-lg-4 control-label">Discipline</label>
                            <div class="col-lg-8">
                                <select type="hidden" class="form-control" name="discipline" id="discipline">
                                    <option value="" selected disabled>Please Select</option>
                                    <option value="nat_sciences">Natural Sciences</option>
                                    <option value="health_medicine">Health Medicine</option>
                                    <option value="social_sciences">Social Sciences</option>
                                    <option value="humanities">Humanities</option>
                                    <option value="digital_humanities">Digital Humanities</option>
                                    <option value="law">Law</option>
                                    <option value="business">Business</option>
                                </select>
                            </div>
                        </div>
                    </div>
                </div>
                <div class="col-sm-4">
                    <h4></h4>
                    <div class="panel panel-default background-light padded">
                        <div class="form-group">
                            <label for="digital_literacy" class="col-lg-4 control-label">Type</label>
                            <div class="col-lg-8">
                                <select type="hidden" class="form-control" name="digital_literacy" id="digital_literacy">
                                    <option value="" selected disabled>Please Select</option>
                                    <option value="podcast">Podcast</option>
                                    <option value="video">Video</option>
                                    <option value="webpage">Webpage</option>
                                    <option value="sparks">Sparks</option>
                                    <option value="illustrator">Illustrator</option>
                                    <option value="in_design">In Design</option>
                                    <option value="canvas">Canvas</option>
                                    <option value="pitochart">Pitochart</option>
                                    <option value="power_point">Power Point</option>
                                    <option value="spreadsheet">Spreadsheet</option>
                                </select>
                            </div>
                        </div>
                    </div>
                </div>
                <div class="col-sm-4">
                    <h4></h4>
                    <div class="panel panel-default background-light padded">
                        <div class="form-group">
                            <label for="genre" class="col-lg-4 control-label">Genre</label>
                            <div class="col-lg-8">
                                <select type="hidden" class="form-control" name="genre" id="genre">
                                    <option value="" selected disabled>Please Select</option>
                                    <option value="book_review">Book Review</option>
                                    <option value="film_review">Film Review</option>
                                    <option value="play_review">Play Review</option>
                                    <option value="literature_review">Literature Review</option>
                                    <option value="peer_reviewed_journal_articles">Peer Reviewed Journal Article</option>
                                    <option value="conference_paper">Conference Paper</option>
                                    <option value="conference_presentation">Conference Presentation</option>
                                    <option value="grant_proposal">Grant Proposal</option>
                                </select>
                            </div>
                        </div>
                    </div>
                </div>
                <div class="col-sm-4">
                    <h4></h4>
                    <div class="panel panel-default background-light padded">
                        <div class="form-group">
                            <label for="method" class="col-lg-4 control-label">Method</label>
                            <div class="col-lg-8">
                                <select type="hidden" class="form-control" name="method" id="method">
                                    <option value="" selected disabled>Please Select</option>
                                    <option value="archival_research">Archival Research</option>
                                    <option value="textual_analysis">Textual Analysis</option>
                                    <option value="rhetorical_analysis">Rhetorical Analysis</option>
                                    <option value="reviewing_the_literature">Reviewing the Literature</option>
                                </select>
                            </div>
                        </div>
                    </div>
                </div>

                <center>
                    <div class="col-sm-4">
                        <h4></h4>
                        <div class="panel panel-default background-light padded">
                            <center>
                                <input class="btn btn-primary btn-block" type="submit" value="submit">
                                </center>
                            </div>
                        </div>
                    </center>
                </form>

This is the PHP portion of the code. The page just keeps returning an empty number for conditions and only prints out "SELECT * FROM unit_assignments". It never ends up executing the rest of the code and I was wondering if it was because my PHP code is wrong or my form code. My page does connect to the database, so I don't think there are any database errors.I have tried varying methods of writing the PHP code but to no avail, which leaves me to believe maybe the PHP code and the form just aren't connecting.

    <?php

 // define the list of fields
                        $fields = array('course_designation', 'year', 'discipline', 'digital_literacy', 'genre', 'method');


                        $conditions = array();
                        // loop through the defined fields
                        foreach($fields as $field){
                            // if the field is set and not empty

                                    if(!empty($_POST[$field])) {
                                // create a new condition while escaping the value inputed by the user (SQL Injection)
                                $conditions[] = "`$field` LIKE '%" . mysqli_real_escape_string($_POST[$field]) . "%'";
                            }
                        }
                //  }
                        // builds the query
                        $query = "SELECT * FROM unit_assignments ";

                        echo count($conditions);

                        // if there are conditions defined
                        if(count($conditions) > 0) {
                            // append the conditions
                            $query .= "WHERE " . implode (' AND ', $conditions); // you can change to 'OR', but I suggest to apply the filters cumulative
                        }

                            echo "$query";

                        $result = mysqli_query($mysqli_link, $query);


                        mysqli_close($mysqli_link);

                            if(isset($_POST['submit'])) {
                                while($row = mysqli_fetch_array($result)) {
                                $course_designation = $row['course_designation'];
                                $year = $row['year'];
                                $discipline = $row['discipline'];
                                $digital_literacy = $row['digital_literacy'];
                                $genre = $row['genre'];
                                $method = $row['method'];

                        echo "Course: $course_designation<br>Year: $year<br>Discipline: $discipline<br>digital_literacy: $digital_literacy<br>Genre: $genre<br>Method: $method<br>";
                            }
                            }


                                ?>
Rachel
  • 1
  • 1
  • `enctype="multipart/form-data" method="GET"` dont go well together. Change your method to `POST` and then be sure to use `$_POST` for vars. – IncredibleHat Nov 26 '18 at 20:15
  • 1
    When checking the fields are set you have `if(isset($_[$field])` which is missing `GET`. – Nigel Ren Nov 26 '18 at 20:16
  • Procedural `mysqli_real_escape_string` requires a connection string. You'd be better off parameterizing this. – user3783243 Nov 26 '18 at 20:17
  • Could probably even swap `isset($_[$field]) && $_GET[$field] != ''` with `!empty($_GET[$field])` unless `0` is a valid value – user3783243 Nov 26 '18 at 20:19
  • Thank you, everyone! I updated the above code to reflect the changes you all suggested in order to check if I interpreted them all correctly. The only thing I didn't know how to do is parameterizing `mysqli_real_escape_string` Would this be a part of the array? Sorry about my lack of knowledge, guys, I am a noob. The only "error" I get now is the console not saying anything is wrong, but the page stays blank/won't load which tells me otherwise. – Rachel Nov 28 '18 at 17:48
  • Ah, I forgot to tag you for the question! @user3783243 – Rachel Nov 28 '18 at 23:52
  • Enable PHP error reporting a blank page is usually a fatal error. For parameterized queries see https://stackoverflow.com/questions/4712037/what-is-parameterized-query Roughly your query would be `"\`$field\` LIKE concat('%', ?, '%')"` then you need to bind the `$_POST[$field]` in the execute. http://php.net/manual/en/mysqli.quickstart.prepared-statements.php – user3783243 Nov 29 '18 at 03:01

0 Answers0