MySQL Updates only first name instead of full name

Question

I have a table called assets in phpmyadmin which has a Responsible column. When an asset is created, with the help of $_SESSION["name"] I can put the right value into this column.

if($_SERVER["REQUEST_METHOD"] == "POST"){

    $id = $_POST['id']; 
    $name=$_POST['Asset_name'];
    $classification=$_POST['Classification'];
    $tag=$_POST['Tag'];
    $department=$_POST['Department'];
    $reviewdate=$_POST['Review_date'];
    $responsible=$_POST['Responsible'];
    $createdby=$_POST['Created_by'];

    // Making sure name is typed in and contains only letters
    if (empty(trim($name))) {
       $nameErr = "Name is required";
    } else {
        if (!preg_match("/^[a-zA-Z ]*$/", $name)) {
            $nameErr = "Only letters and white space allowed";
        }   
    }
    // Making sure tag is typed in and contains only letters
    if (empty(trim($tag))) {
        $tagErr = "Tag is required";
    } else {
        if (!preg_match("/^[a-zA-Z ]*$/", $tag)) {
            $tagErr = "Only letters and white space allowed";
        }
    }

    if (!empty($_POST) && ($nameErr == "") && ($tagErr == "")){    
        // Updating the table
        $result = mysqli_query($conn, "UPDATE assets SET Asset_name='$name',Classification='$classification',Tag='$tag',Department='$department',Review_date='$reviewdate', Responsible='$responsible' WHERE id='$id'");

        // Redirecting to assets.php
        header("Location: assets.php");
    }

However, these assets should be edited as well. I do it with a form where I loop through the users table "Name" column with this script:

mysqli_query($conn, "UPDATE assets SET Responsible='$responsible' WHERE id='$id'");

This is the script ("pdo" is the database specification but that works"):

$sql = "SELECT id,name FROM users";

// Prepare the select statement.
$stmt = $pdo->prepare($sql);

// Execute the statement.
$stmt->execute();

// Retrieve the rows using fetchAll.
$users = $stmt->fetchAll();

In the form this is what I use:

<?php   if($_SESSION['user_type'] == "admin") {
                        echo "<div class='form-group form-inline'>";
                        echo "<p class='formLabel'>Responsible</p>";                        
                        echo "<select class = 'select' name = 'Responsible' class='form-control' value=".$responsible.">";
                                foreach($users as $user):
                                    echo "<option value=".$user['name']."> ".$user['name']."</option>";
                                endforeach;
                                echo "</select>";
                    } else { echo "<input type='hidden' name = 'Responsible' value=".$_SESSION['name'].">";
                    }
            ?>  

When I choose the values from the list this script has created, they are the right ones, everything looks good. However, after clicking on Update, only the first name of that person is shown in the responsible column not the full name (e.g. John instead of John Williams) and I do not understand why. The users "Name" and the assets "Responsible" column are both varchar with 255 length. I suspect that my problem is with the query, but I dont know why. Can you help me? Thank you!

This are my tables: users assets

Answer 1

Your issue is that you aren't quoting your HTML attributes. This makes browsers break that value at the first space. Update your code to:

echo '<option value="' . $user['name']. '"> . $user['name']. '</option>';

This should resolve your issue. You also should look at XSS and SQL injections. This appears to be susceptible to both.

How can I prevent SQL injection in PHP?

Your select also shouldn't have a value attribute.

Each <option> element should have a value attribute containing the data value to submit to the server when that option is selected; if no value attribute is included, the value defaults to the text contained inside the element. You can include a selected attribute on an <option> element to make it selected by default when the page first loads.

-https://developer.mozilla.org/en-US/docs/Web/HTML/Element/select

So change:

echo "<select class = 'select' name = 'Responsible' class='form-control' value=".$responsible.">";

into:

echo '<select class="select" name="Responsible" class="form-control">
<option value="' . $responsible. '" selected="selected">Unchanged</option>';