0

I have 3 php files in doing addition and deletion of medicine details. medicines detail are used to order drugs for each patient who comes for treatment. In order not to be a hassle, how do I prevent my application from needing to be reloaded with AJAX? The 3 files are: services.php , insertDetailMedicines.php and deleteDetail.php .

services.php

$data = mysqli_query($conn, "SELECT MAX(id_service) AS ids FROM tbl_services");
$final_data = mysqli_fetch_array($data);
$id1 = $final_data['ids'];
$id2 = substr($id1,3,3);  //MR for Medical Record
$id3 = $id2 + 1;
$id4 = 'MR'.sprintf('%03s' , $id3);  // <-- Auto generating unique id

<form method="POST" action="services.php"> 
<input type="hidden" name="id_medical_record" value="<?php echo $id4 ?>">
<select  name="medicineName" id="medicineName" required>
    <option value="">- Choose -</option>
    <?php  
    $medicines = mysqli_query($conn, "SELECT * FROM tbl_medicines ORDER BY id_medicines ASC");
    $m = mysqli_fetch_array($medicines);
    while($m = mysqli_fetch_array($medicines)){ ?>
        <option value="<?php echo $m['id_medicine'] ?>">
             <?php echo $m['medicine_name'] ?>
        </option>
    <?php } ?>
 </select>
 <input type="text" name="qty_medicines" id="qty_medicines" value="1" required />
 <button type="submit" name="add" style="cursor: pointer">ADD</button>
</form>
<table>  <!--this is to display the drugs that have been added-->
<?php  
$show_details = mysqli_query($conn, "SELECT * FROM tbl_detail_medicines LEFT JOIN tbl_medicines USING (id_medicine)");
$num = 1;
if(mysqli_num_rows($show_details) > 0)
{
while ($detail = mysqli_fetch_array($show_details))
{
?>
<tr>
    <td>
        <?php echo $num++.'.'; ?>
    </td>
    <td>
        <?php echo $detail['medicine_name'] ?>
    </td>
    <td>
        <?php echo $detail['qty'] ?>
    </td>
    <td>
        <a href="deleteDetail.php?delete=<?php echo $detail['id'] ?>">
            <b> X </b>
        </a>
    </td>
</tr>
<?php
}}
?>
</table>

insertDetailMedicines.php

<?php
if (isset($_POST['add'])) { 
    $idMR = $_POST['id_medical_record'];
    $medicineName = $_POST['medicineName'];
    $qty_medicines = $_POST['qty_medicines'];
    $insert_detail = "insert into tbl_detail_medicines (id,id_service,id_medicine,qty) 
                      VALUES
                      (null,'$idMR','$medicineName','$qty_medicines')";
    if (mysqli_query($conn,$insert_detail)) {
        //echo "inserting success!";
    }   
}
?>

deleteDetail.php

<?php 
require 'koneksi.php';
if(isset($_GET['delete'])){$delete = mysqli_query($conn, "DELETE FROM tbl_detail_medicines WHERE id = '".$_GET['delete']."' ");
header('location:services.php');
} 
?>

apppearance

  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) – Dharman Sep 05 '21 at 16:01
  • You may use a database classs like https://github.com/ThingEngineer/PHP-MySQLi-Database-Class then you can build better queries – endo.anaconda Sep 06 '21 at 16:09

0 Answers0