I have a few forms on my page and everyone works fine appart from one, and there is no difference at all in them only where it is drawing the data from.
Each one of the forms is a different table, and drawing in the data so that the user can select a value to insert into the main table in the database.
Like I said all the others work fine, but the one below doesnt, it just will not display the correct value from the dropdown.
Here is the first part:
$gName="";
if(isset($_GET["ID"]))
{
$iD=$_GET["ID"];
$queryEdit="select * from Intranet where ID=$iD";
//$rowsEdit = sqlsrv_query($conn, $queryEdit);
$rowsEdit = sqlsrv_query($conn, $queryEdit) or die(sqlsrv_errors());
//if(sqlsrv_has_rows($rowsEdit)){ echo 'rows fetched from DB';}
while ($rows = sqlsrv_fetch_array($rowsEdit, SQLSRV_FETCH_ASSOC)) {
$gName=$rows["Group_Name"];
echo $gName;
}
All is fine with this, and when I echo out $gName the value on display is correct.
Again I echo out $gName and all is fine, and also the drop down fills up with the correct vales from Group. BUT it will not ‘select’ the correct value to display when it should.
$gName is fine as shown by echoing it out, and Group_Names is fine to as shown by the fact that the drop down does contains the correct data from that table.
I have tried everything to resolve it, and i cant work it out, seeing that other drop down above and below this one work fine, and the only change I make in all of them is the variables when selecting * from Groups.
sings
One of these things just doesnt belong here… one of these things just isnt the same… (really. normalize your names and you wont have 99% of issues with table linkages)
What is the type on Group_Name in your Intranet table? You sure it’s not a numerical association? (and if not, why not? waits for inevitable scolding from mysql boys about not creating an artificial key)
Basically what is happening is that in the main area where all the contracts can be seen there a edit button next to each contract, when you click the edit button it takes you to the edit form where all the data from the contract you selct fills in the form for the user to see and change if needed.
$gName=$rows[“Group_Name”];
That is drawing the value from that contract and $gName is its value.
Then in the drop down in the form, its pulling its data from another table called Groups, and the field in use in this drop down is Group_Names.
So whats happening is that your matching the value from the contract with the values in the other table, and using select you get to see that value, but its not working.
You are correct, multichild, you need to sanitize your $_GET[‘id’] before using it. For example, run it through $iD = intval($_GET[‘ID’]);
As for your select problem, can you give us the HTML output. The from the echo statement of $gName and the <select> field that is outputted so we can compare the values?
I think my answer was far more helpful than anyone elses.
The total lack of security is a BIGGER problem than the one he was asking about. He should solve that first, everywhere on his site, and come back to this other issue later.
Because when building a bridge what you should first do is build the guardrails, forget about the whole deck thing. Who needs that! It’ll be perfectly safe.
Oh right, but noone can actually cross the bridge.
Security doesnt have to come before the actual code. If you can do both at the same time, great. If you dont have a site because you’re spending all your time trying to secure the first three lines? Well, good luck to you on actually delivering anything.
Dropping straight to personal insults, obviously a true professional.
He has an issue here that means that anybody anywhere could delete his entire database, just by adding a few statements to a publicly available url. It’s a fundamental error that makes his entire website extremely insecure.
An insecurity of this magnitude should be priority number 1. It DOES come above all else.
He should fix this problem first, then go back to his functional issues.
And I’m only ‘insulting’ you because you told me to “please stop posting”, when I was the only one giving the actual advice he requires.
I get irritated by people who think they’re experts, yet will completely look over such a huge flaw as this one because “that’s not the question being asked”.
To the original poster: seriously, make this a priority. Learn how to use prepared statements and convert all of your database queries to prepared statements (or PDO).
Then come back to this issue and solve it. That way, even if I know your code, I still won’t be able to delete your database like that.
