Getting the League Value in the Select Statement (PHP)

Question

I have this where i have a query to get the teams and filtering them by their league. My problem is that in the the console.log of the following code the data is being shown correctly but in the SELECT statement it's not working as it's not showing anything in the dropdown. When i do it hardcoded the SELECT statement works fine. Any idea what might be the problem. Thanks

Code

$league = '';

if(isset($_POST['selected'])):
   $league = $_POST['selected'];
endif;

$home_team = $dbh->prepare("SELECT * FROM teams WHERE competition = :league");

echo "<script>console.log($league)</script>";
$home_team->execute([ ':league' => $league ]);

Fetching Teams

 <?php
    while ($row = $home_team->fetchAll()) 
   {
       $hometeamlogo = $row['logo'];
       $hometeamstadium = $row['stadium'];
       echo "<option value='data:image/png;base64,".base64_encode( $hometeamlogo )."' data-stadium='$hometeamstadium'>" . $row['team_name'] . "</option>";
   }
 ?>

AJAX Call

 $('#input_competition').on('change', function () {
         var selectedLeague = $('#input_competition').find(":selected").text();
           
         $.ajax({
            url: 'queries/view_fixtures_queries.php',
            type: 'POST',
            data: {'selected' : selectedLeague},
            success: function(data) {
                console.log(data);
            }
        });
       });

1. You are open to SQL injections 2. You have no error handling 3. $league may have no value 4. You need to learn about server-side and client0side programming as your order of execution is clearly not correct — John Conde, Jan 02 '21 at 13:39
If your problem is that it isn't _outputting_ correctly; maybe it would be helpful if you showed that code? — Steven, Jan 02 '21 at 13:47
My question was if the code i gave is correct in terms of the SELECT statement since in the console.log it is being outputted correctly. — Freddy, Jan 02 '21 at 13:48
Does this answer your question? [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Alon Eitan, Jan 02 '21 at 13:51
Cause if i hard-code the WHERE clause with the league it would work correctly — Freddy, Jan 02 '21 at 13:51
To confirm: if you change ":league" with the actual value... It works? **And** that the `console` shows the correct value for `$league`? — Steven, Jan 02 '21 at 14:03
@Strawberry the question has been edited to use bound variables; previously it used `".$league."` in place of `:league` — Steven, Jan 02 '21 at 14:26
Are you sure that `$_POST['selected']` is what is being posted? — Strawberry, Jan 02 '21 at 14:41

score 0 · Answer 1 · answered Jan 02 '21 at 14:42

0

FWIW, this works just fine for me...

<?php
/*
DROP TABLE IF EXISTS teams;

CREATE TABLE teams
(team_id SERIAL PRIMARY KEY
,team VARCHAR(30) NOT NULL UNIQUE
,competition VARCHAR(30)
);

INSERT INTO teams VALUES
(1,'Arsenal','Premiership'),
(2,'Chelsea','Premiership'),
(3,'Crystal Palace','Premiership'),
(4,'QPR','Championship'),
(5,'Greenwich Borough','Isthmian');
*/


require('path/to/pdo/connect.ion');

$league = '';

$_POST['selected'] = 'Premiership';

if(isset($_POST['selected'])):
   $league = $_POST['selected'];
endif;

//'$pdo' is my connection object
$home_team = $pdo->prepare("SELECT * FROM teams WHERE competition = :league");

echo "<script>console.log($league)</script>";
$home_team->execute([ ':league' => $league ]);

$data  = $home_team->fetchAll();
print_r($data);
?>

answered Jan 02 '21 at 14:42

Strawberry

33,750
13
40
57

It works fine like this but i'm doing this part `$data = $home_team->fetchAll();` in another php file which was working fine before i included the WHERE clause – Freddy Jan 03 '21 at 11:18
I included this part in the Question where i'm fetching the teams data – Freddy Jan 03 '21 at 11:20
Also i added the AJAX call im making in the same file as the fetching teams – Freddy Jan 03 '21 at 12:14

Getting the League Value in the Select Statement (PHP)

1 Answers1