PHP getting data from HTML fields

Question

I'm having some problems with getting data from HTML fields. This is how it looks in HTML

<form action="getInfo.php">
    <span>Series</span>
    <input class="searchFieldAlign" type="text" name="seriesName" /><Br>

    <span>Volume</span>
    <input class="searchFieldAlign" type="text" name="volumeName" /><Br>

    <span>Nr</span>
    <input class="searchFieldALign" type="text" name="issueNR" /><Br>

    <p input class="searchFieldALign" type=submit></p>
</form>

This is my php script:

<?php
$seriesName = mysqli_real_escape_string($conn, $_POST['seriesName']);
$volumeName = mysqli_real_escape_string($conn, $_POST['volumeName']);
$issueNR = mysqli_real_escape_string($conn, $_POST['issueNR']);
$con=mysqli_connect("localhost","user","psswd","db");

// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }
$qryIssueInfo = mysqli_query($con,"select issueNR, issueVolume, issueName, issueImageURL from issue, series where (seriesName='$seriesName') and (issueVolume='$volumeName') and (issueNR=$issueNR)");
$rowIssueInfo = mysqli_fetch_array($qryIssueInfo);

The problem is I don't get output from my query. There are no problems if i change it to this:

$qryIssueInfo = mysqli_query($con,"select issueNR, issueVolume, issueName, issueImageURL from issue, series where seriesName='Buffy, the Vampire Slayer' and issueVolume= 'Season 8' and issueNR=1");

Be careful with user input, or you'll end up like Bobby Tables. — Matthew Johnson
– Matthew Johnson, Commented Dec 6, 2013 at 15:32
For mysqli_real_escape_string you use a connection named $conn but you create your connection a few lines later with the name $con. So...whats $conn? — PKeidel
– PKeidel, Commented Dec 9, 2013 at 9:53

Muhammet Arslan · Accepted Answer · 2013-12-09 09:38:07Z

1

If you not set form method = "post" it will be "get" and you should $_GET.

To correct:

<form method="post" action"getInfo.php">

Take it easy

answered Dec 9, 2013 at 9:38

Muhammet Arslan

9852 gold badges12 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

mcserep · Accepted Answer · 2013-12-06 15:33:10Z

0

The first version does not contain the apostrophes around the variables.

You should also consider security issues, like SQL injection.

answered Dec 6, 2013 at 15:33

mcserep

3,29925 silver badges37 bronze badges

3 Comments

Noosrep Over a year ago

Apostrophes make no difference

mcserep Over a year ago

It does. Think about an example when the input contains a space char, like: WHERE field='word1 word2'. Without apostrophes, the syntax would be incorrect.

Noosrep Over a year ago

I mean I tried it but the output stays the same. I didn't mean that the apostrophe itself had no function

Collectives™ on Stack Overflow

PHP getting data from HTML fields

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related