How to get unique button id from a while loop? (PHP)

Question

First of all here's my code:

session_start();
require_once "config.php";
$email = $_SESSION["email"];
$result = mysqli_query($link,"SELECT * FROM cuponai WHERE gmail='$email' AND panaudoti=0");

echo "<table border='1'>
<tr>
<th>Cupono kodas</th>
<th>Apply code</th>
</tr>";

while($row = mysqli_fetch_array($result))
{
echo "<tr> ";
echo "<td>" . $row['cuponas'] . "</td>";
echo "<td> <form method='post'><input type='submit' name='". $row['cuponas'] ."' value='submit'></from></td>";
echo "</tr>";
}
echo "</table>";
if(isset($_POST['???????'])) {
$sql = "UPDATE cuponai SET panaudoti=1 WHERE cuponas='????????????' ";

if ($link->query($sql) === TRUE) {
  echo "YOU DID IT WOO";
} else {
  echo "Error updating record: " . $link->error;
    }
}
mysqli_close($link);
?>
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/bootstrap.min.css">
  <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
  <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js"></script>
</head>
<body>

</body>
</html>

The parts in question marks is where I'm strugling... Basically I'm making this site where you can see your purchased coupons and each of the coupons have an apply button near them so you basically have a list and need to apply them after you apply them I want it too refresh the page and applied coupons dissapear and are marked as used in the database. But I've been scratching my head this whole time and trying to make the buttons unique with javascirpt and all that but to no avail hopefully some of you could figure out a solution here?

-sorry for the spaggeti code

**Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) — hppycoder, Mar 30 '21 at 17:10
Please show the form as well that would make up the `$_POST` details — hppycoder, Mar 30 '21 at 17:11
Also this is for collage so I don't need it to be protected or anything at all it can be as simple as possible as long as it works — CrazymanWnT, Mar 30 '21 at 17:16
The form is printed out in a while loop because it prints out a coupon code from the database and a apply button for the form — CrazymanWnT, Mar 30 '21 at 17:17
You're pritning your HTML outside the body of the document. The browsers are mainly capable of fixing this automatically for you, but you should really output all this content where it belongs. — El_Vanja, Mar 30 '21 at 17:27

Alain Doe · Accepted Answer · 2021-03-31T14:20:50.270

In the case of the code you provided, you could add hidden input elements in your forms.

Use the same name and set the value to the unique id you want. This input's value and name will be sent to the PHP portion of your file where you can access it inside the $_POST array like so; $_POST['name_of_input']

In short, you would have to make the following adjustments to your code to make it work as you expect;

Change this

echo "<td> <form method='post'><input type='submit' name='". $row['cuponas'] ."' value='submit'></from></td>";

To this

echo "<td> <form method='post'><input type='hidden' name='couponid' value='". $row['cuponas'] ."'><input type='submit' name='". $row['cuponas'] ."' value='submit'></from></td>";

And then change this

if(isset($_POST['???????'])) {
$sql = "UPDATE cuponai SET panaudoti=1 WHERE cuponas='????????????' ";

To this

if(isset($_POST['couponid'])) {
$sql = "UPDATE cuponai SET panaudoti=1 WHERE cuponas='".$_POST['couponid']."' ";

Your $_POST['couponid'] will hold the data of $row['cuponas'] and your code should work as you expect.

A couple of extra notes beyond the scope of the question;

1. You are currently echoing the HTML you create in PHP before the <!DOCTYPE html> tag. Although a browser will correct for this, this isn't proper HTML form.

Rather than echoing everything at the top of the document, you might want to store it in a variable and echo that inside the <body> tag instead.

Instead of this;

echo "<table border='1'>
<tr>
<th>Cupono kodas</th>
<th>Apply code</th>
</tr>";

You could use;

$html_to_echo = "<table border='1'>
<tr>
<th>Cupono kodas</th>
<th>Apply code</th>
</tr>";

To add to this variable you can use something like this;

$html_to_echo .= "<tr> ";

And then in the HTML portion of your page;

<body>
    <?php echo $html_to_echo; ?>
</body>

It is possible to interweave PHP and HTML like this in a PHP document.

2. Although already mentioned in the comments of your question, here's an extra SQL Injection warning for people passing through in the future.

Warning: You are wide open to SQL Injections and should use parameterized prepared statements instead of manually building your queries. They are provided by PDO or by MySQLi. Never trust any kind of input! Even when your queries are executed only by trusted users, you are still in risk of corrupting your data. Escaping is not enough

Thank you so much I didn't know that "Your $_POST['couponid'] will hold the data of $row['cuponas']" so that was my problem all along! — CrazymanWnT, Mar 30 '21 at 17:50
That last line applies to my code modifications and in this particular case only, make sure to note that this isn't a universal rule. In this case `$_POST['couponid']` held the data that was defined here ``. — Alain Doe, Mar 30 '21 at 17:54

How to get unique button id from a while loop? (PHP)

1 Answers1