pass value from textbox in sql query in php

Question

so, i am trying to display the value of movie_id using movie name by getting the name from textblock(html). But the page displayed is blank and if i add a name manually in the query e.g name="skyfall" instead of the variable the result is displayed.

include './connection.php';

$movie_tf=$_POST['movie_tf'];

$getMovieIdQuery="SELECT movie_id FROM MOVIE WHERE name='$movie_tf'";
$query=  mysql_query($getMovieIdQuery);

if (!$query){
    echo 'error' .  mysql_error($dbconn);
}

    $getMovieIdQueryFetchRow=  mysql_fetch_row($query);
    echo $getMovieIdQueryFetchRow[0];


mysql_close($dbconn);

html form:

<form action="operations.php" method="GET">
            Movie:<input type="text" name="movie_tf"/> </br>
            <input type="submit" value="submit"/>
        </form>

You should use prepared statements (php.net/manual/en/pdo.prepared-statements.php) to prevent SQL injection. Anyway. What is displayed in your browser console (or log file) ? — Seblor
– Seblor, Commented Mar 8, 2016 at 21:37
just a sql depricated warning is displayed. But it does display the wanted result when i add a name of the movie manually instead of the variable. is my query syntax correct with the variable? @Seblor — Nelson John
– Nelson John, Commented Mar 8, 2016 at 21:40
If you're getting the deprecated notice you should learn about prepared statements for PDO and MySQLi and consider using PDO, it's really pretty easy. — Jay Blanchard
– Jay Blanchard, Commented Mar 8, 2016 at 21:42

Community · Accepted Answer · 2017-05-23 11:45:16Z

1

You're using method="GET" for your form and then a POST array $_POST['movie_tf']

Either use method="post"

or $_GET['movie_tf'] the choice is yours.

Both the method and array type must match.

and strangely enough, you would not have gotten errors for it neither.

I learned that lesson the hard way once.

Your present code is open to SQL injection. Use mysqli_* with prepared statements, or PDO with prepared statements.

edited May 23, 2017 at 11:45

CommunityBot

11 silver badge

answered Mar 8, 2016 at 21:52

Funk Forty Niner

74.2k14 gold badges71 silver badges146 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Nelson John Over a year ago

bingo! #unknownForce

Funk Forty Niner Over a year ago

@NelsonJohn hehe yeah... that what the missing link ;-) Cheers

Funk Forty Niner Over a year ago

@NelsonJohn Cheers :-)

Collectives™ on Stack Overflow

pass value from textbox in sql query in php

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related