How to execute query saving using a input that takes information from two different sql tables?

Question

How can I fix this because it only saves the IDNumber of the borrower on a table and I need to have the book as well as the borrowers information saved when I click the "Issue" on the table? Thank you so much.

This is my issue.php

<?php 
    $fBookCode = $_GET['fBookCode'];

    include_once('includes/connection_db.php');
    $sql = " SELECT * FROM tblbooks WHERE fBookCode = '$fBookCode'";
    $result = mysqli_query($con,$sql);
    while($row = mysqli_fetch_assoc($result))
    {
 ?>
<html>
<head>
    <title>BCT Library </title>

<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">



<link rel="stylesheet" href="css/bootstrap.min.css">
<!-- jQuery library -->
<script src="js/jquery.min.js"></script>
<!-- Popper JS -->
<script src="js/popper.min.js"></script>
<!-- Latest compiled JavaScript -->
<script src="js/bootstrap.min.js"></script>
<script src="js/myStyle.js"></script>
<link rel="stylesheet" href="css/font-awesome.min.css">
<link rel="stylesheet" type ="text/css" href="css/myStyle.css">
<link rel="stylesheet" href="js/myscript.js">   


<?php
include_once('includes/connection_db.php')
?>


</head>
<body>
<?php include_once('includes/header.php');?>
<!-- NAVIGATION BAR CODE :P -->
<br>
<div class="container">
<div class="col-md-offset-5">
  <ul class="nav nav-bar">
<div class="dropdown">
    <li class="nav-item">
      <a class="nav-link active" href="index.php">Books</a>
    </li>
</div>
<div class="dropdown">
  <button class="btn btn-warning dropdown-toggle" type="button" data-toggle="dropdown">TRANSACTIONS
  <span class="caret"></span></button>
  <ul class="dropdown-menu">
    <li><a href="borrow.php">Borrowing</a></li>
    <li><a href="return.php">Returning</a></li>
  </ul>
</div>
<div class="dropdown">
  <button class="btn btn-warning dropdown-toggle" type="button" data-toggle="dropdown">BORROWERS
  <span class="caret"></span></button>
  <ul class="dropdown-menu">
   <li><a href="students.php">Students</a></li>
    <li><a href="employees.php">Employees</a></li>
  </ul>
</div>
<div class="dropdown">
  <button class="btn btn-warning dropdown-toggle" type="button" data-toggle="dropdown">REPORTS
  <span class="caret"></span></button>
  <ul class="dropdown-menu">
   <li><a href="generatereport.php">Generate Report</a></li>
  </ul>
</div>
<div class="dropdown">
  <button class="btn btn-warning dropdown-toggle" type="button" data-toggle="dropdown">ACCOUNT
  <span class="caret"></span></button>
  <ul class="dropdown-menu">
    <li><a href="user.php">Users</a></li>
     <li><a href="logout.php">Logout</a></li>
  </ul>
</div>
  </ul>
</div>


    <br>


<!-- Modal for adding student-->

<div class="container">
<div class ="row">
<div class ="col-md-12">     
<div class = "row">

    </div>

    <hr>
    <h5><small><center><b>SELECT BORROWER</b></center></small></h5>
    <hr>


                    <h5> <?php echo $row['fBookCode']; ?> &emsp;</h5>
                    <h5> <?php echo $row['fTitle']; ?> &emsp;</h5>
                    <h5> <?php echo $row['fAuthor']; ?> &emsp;</h5>

  <form method="POST" action="">
             <form method="POST" action="">
            Search Borrower <input type="text" class = "search" name="fItems" />
            <button class = "submit1" name="Search"> Search </button> 
        </form>

        <table>
            <thead>
                <th> ID Number </th>
                <th> Name </th>
                <th> Strand/Course </th>
                <th> Grade/Year </th>
                <th> Gender </th>
                <th> Issue </th>
            </thead>
            <tbody>

                <?php
                if(isset($_POST['Search']))
                {   
                    $item = $_POST['fItems'];

                    $sql = "SELECT * FROM tblstudents WHERE fIDNumber LIKE '%".$item."%' or fLastName LIKE '%".$item."%'";
                    $result = mysqli_query($con, $sql);
                    while($row = mysqli_fetch_assoc($result))
                    {
                ?>
                <tr>
                    <td><center> <?php echo $row['fIDNumber']; ?> &emsp;</center></td>
                    <td> <?php echo $row['fLastName'].", ".$row['fFirstName']." ".substr($row['fMiddleName'],0,1)."."; ?>&emsp;</td>
                    <td> <?php echo $row['fCourse']; ?> &emsp;</td>
                    <td> <?php echo $row['fYear']; ?> &emsp;&emsp;</td>
                    <td> <?php echo $row['fGender']; ?> &emsp;</td>
                    <form method="POST" action="includes/transactionsaving.php?fIDNumber=<?php echo $row['fIDNumber'];?>">
                    <td> <input type="submit" name="btnIssue" value="Issue">&emsp;</td>
                    </form>

                </tr>
                <?php
                    }
                }   
                ?>
            </tbody>

        </table>


 <br>



        <table>
            <thead>
                <th> ID Number </th>
                <th> Name </th>
                <th> Position </th>
                <th> Gender </th>
                <th> Issue </th>
            </thead>
            <tbody>
                <?php
                if(isset($_POST['Search']))
                {   
                    $item = $_POST['fItems'];

                    $sql = "SELECT * FROM tblemployee WHERE fIDNumber LIKE '%".$item."%' or fLastName LIKE '%".$item."%'";
                    $result = mysqli_query($con, $sql);
                    while($row = mysqli_fetch_assoc($result))
                    {
                ?>
                <tr>
                    <td><center> <?php echo $row['fIDNumber']; ?> &emsp;</center></td>
                    <td> <?php echo $row['fLastName'].", ".$row['fFirstName']." ".substr($row['fMiddleName'],0,1)."."; ?>&emsp;</td>
                    <td> <?php echo $row['fPosition']; ?> &emsp;</td>
                    <td> <?php echo $row['fGender']; ?> &emsp;</td>
                    <form method="POST" action="includes/transactionsaving.php?fIDNumber=<?php echo $row['fIDNumber']; ?>">
                    <td> <input type="submit" name="btnIssue" value="Issue">&emsp;</td>
                    </form>
                </tr>
                <?php
                    }
                }   
                ?>
            </tbody>

        </table>
</form>
</div>
  </div>
  </div>



<br>



<br>
<!-- FOOTER -->
<div class="footer">
<div class = "row>"
<div class = "col-md-12">
<img src ="Images/footer.png" class = "img-responsive"/>
<br>
    <p class ="text-center2"> © Copyright 2015. Baguio College of Technology. <br>All Rights Reserved. 
37 Harrison Road, Baguio City <br>2600 Philippines</p>
</div>
</div>
</div>
</div>
  </div>
<?php
}
?>

<?php
include_once('includes/connection_db.php')
?>

</body>

</html>

This is my transactionsaving.php and it can only save the IDNumber of the borrower + incorrect datetime borrowed because it kept getting error of Undefined Index for the others..

 <?php

$fBookCode = "";
$fTitle = "";
$fAuthor = "";
$fIDNumber = "";
$fLastName = "";
$fFirstName = "";
$fMiddleName = "";
$fDateBorrowed = "";
$fDateReturned = "";
$fPenalty = "";


if(isset($_POST['btnIssue']))
{
    //$fBookCode = $_POST['fBookCode'];
    //$fTitle =  $_POST['fTitle'];
//  $fAuthor = $_POST['fAuthor'];
    $fIDNumber = $_GET['fIDNumber'];
    //$fLastName = $_POST['fLastName'];
    //$fFirstName = $_POST['fFirstName'];
    //$fMiddleName = $_POST['fMiddleName'];
    $fDateBorrowed = date("Y-m-d h:i:sa");
    //$fDateReturned = $_POST['fDateReturned'];
    //$fPenalty = $_POST['fPenalty'];


$localhost = 'localhost';
$username = 'root';
$password = '';
$dbname = 'bctlibrary db';

$con =  mysqli_connect($localhost, $username, $password, $dbname)
        or die("FAILED CONNECTION");


    $sql = "INSERT INTO tbltransactions
    (fBookCode,
    fTitle,
    fAuthor,
    fIDNumber,
    fLastName,
    fFirstName,
    fMiddleName,
    fDateBorrowed,
    fDateReturned,
    fPenalty)
    VALUES
    ('$fBookCode',
    '$fTitle',
    '$fAuthor',
    '$fIDNumber',
    '$fLastName',
    '$fFirstName',
    '$fMiddleName',
    '$fDateBorrowed',
    '$fDateReturned',
    '$fPenalty')";


    $result = mysqli_query($con,$sql)or die ("QUERY ERROR ". mysqli_error($con));



    mysqli_close($con);


}


?>

score 0 · Answer 1 · answered Feb 09 '19 at 15:35

0

There is a nested form in your code

<form method="POST" action="">
    <form method="POST" action="">

This is not a valid HTML. I think your problems are related to this. See answers to this StackOverflow question for workarounds.

Hope this helps! Cheers!

answered Feb 09 '19 at 15:35

Bharat Raj Saya

9
2

You are also vulnerable to SQL injection attacks. – Greg Schmidt Feb 09 '19 at 15:49

How to execute query saving using a input that takes information from two different sql tables?

1 Answers1