How to use the form value in php function?

Question

I am newbie to php.I have coded auto-complete text box using php,and i have a submit button.i have not given form action.

This is the HTML form code that i used for autocomplete textbox.this autocomplete textbox selects the value

<form  method="post" autocomplete="off">
    <p>
        <b>Theater Name</b> <label>:</label>
        <input type="text" name="theater" id="theater" />
    </p>
    <input type="submit" value="Submit" />
</form>

I have another php function that retrieves the values based on where clause.in the where statement i want to use selected value from form.

for ex: select address from theaters where theater_name ="form value"

How to use the form value in php function?can any one help me?

 <?php
$con = mysql_connect("localhost","root");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("theaterdb", $con);

$result = mysql_query("SELECT * FROM theter
WHERE theater_name="<!-- This could be value that we get after clicking submit button-->);

while($row = mysql_fetch_array($result))
  {
  echo $row['thearer_name'];
  echo "<br />";
  }
?>

Thanks in advance......

Not directly related, but given the fact that you're new to PHP, you'd do well not to use the functions that have begun the deprecation process, like mysql_*. Instead, use mysqli_ or PDO. Both of which allow you to deal with possible injection a lot better — Elias Van Ootegem
– Elias Van Ootegem, Commented Sep 17, 2012 at 8:17

Community · Accepted Answer · 2023-11-17 20:01:02Z

2

You could get the value from $_POST by $_POST['theater'].

And note, you should not use this value directly in the sql, you need to escape it to prevent sql injection.

$theater = mysql_escape_string($_POST['theater']);
$result = mysql_query("SELECT * FROM theter WHERE theater_name='$theater'";

Last, you could take a look at PDO, which is suggested over the old mysql_* functions.

edited Nov 17, 2023 at 20:01

CommunityBot

11 silver badge

answered Sep 17, 2012 at 8:13

xdazz

161k38 gold badges255 silver badges278 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

AdamGold · Accepted Answer · 2012-09-17 08:19:42Z

First, change your submit button code to the following:

<input name="submit" type="submit" value="Submit" />

Now, this is the code you should use for the query:

<?php
if (isset($_POST['submit'])) {
    $con = mysql_connect("localhost","root");
    if (!$con)
    {
        die('Could not connect: ' . mysql_error());
    }

    mysql_select_db("theaterdb", $con);

    $result = mysql_query("SELECT * FROM theater
    WHERE theater_name='" . mysql_real_escape_string($_POST['theater']) . "'");

    while($row = mysql_fetch_array($result))
    {
        echo $row['theater_name'];
        echo "<br />";
    }        
}

First, I check that the user submitted the form. Then, I escape the data he has submitted and inserting it into your query.

* NOTE: All of what I've wrote is based on the assumption that the code is executed after the form is submitted.

* ANOTHER NOTE: You should read about using PDO rather than MYSQL functions.

Jacob Kranz · Accepted Answer · 2012-09-17 08:22:48Z

First and foremost, try using mysqli instead of mysql (mysqli_query, mysqli_connect). There are numerous security / speed advantages to using it and it has pretty much the exact same functionality.

While the above answers mention using $_POST['theater'] (the name of your input), be SURE to escape your post before putting it into your query.

$con = mysqli_connect("localhost","root", "YOUR PASSWORD HERE", "YOUR DATABASE HERE");
if (!$con)
  {
  die('Could not connect: ' . mysqli_error());
  }

 // No need for this, please see the updated mysqli_connect as the 4th parameter selects your DB
 //mysqli_select_db("theaterdb", $con);

// Please notice the last parameter of the mysqli_real_escape_string is your Input's POST
$query = "SELECT * FROM theater WHERE theater_name=".mysqli_real_escape_string($con, $_POST['theater']);

$result = mysqli_query($con, $query);

while($row = mysqli_fetch_array($result))
  {
  echo $row['thearer_name'];
  echo "<br />";
  }

Julius F · Accepted Answer · 2012-09-17 08:13:30Z

0

$_POST["your_variable_name"] // for POST
$_GET["your_variable_name"] // for GET

For in-depth information please go to: http://www.php.net/manual/en/language.variables.external.php

answered Sep 17, 2012 at 8:13

Julius F

3,4544 gold badges32 silver badges45 bronze badges

Collectives™ on Stack Overflow

How to use the form value in php function?

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related