Member Avatar for bjg5858

I have a form which takes a string from a database and posts it to another page problem is that post seems to be shortening the variable.

So if post should be "product name" it is shortened to "product" by post I think.

Any help would be great thanks.

  • 3 Contributors
  • 5 Replies
  • 124 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by bjg5858

Dani AI

Generated

The symptom described here was an HTML parsing issue rather than a PHP bug: an unquoted attribute value in the generated <option> made the browser treat the value as ending at the first space. identified the fix (quote the value), and confirmed that solved it. The HTML attribute rules explain why unquoted values stop at whitespace (MDN — HTML attributes).

A few best-practice steps that extend the thread answers:

  • Always HTML-escape any data placed into an attribute to avoid breaking markup or introducing XSS. For example, escape with htmlspecialchars (ENT_QUOTES) before outputting into value (see the PHP manual on htmlspecialchars).
$optValue = htmlspecialchars($type, ENT_QUOTES, 'UTF-8');
echo '<option value="' . $optValue . '">' . $optValue . '</option>';

  • Prefer using a short, stable identifier (numeric id) as the option value and keep the human-readable name as the label. That avoids spaces and special-character issues in the value.

  • Do not insert raw $_POST values directly into SQL. Use prepared statements (PDO or mysqli) and bound parameters to prevent SQL injection and to be compatible with modern PHP (the old mysql_* extension is removed in current PHP versions). Example PDO usage is documented here: PDO prepared statements.

Troubleshooting pointers that complement ’s remark about CMS/API limits: log or dump the raw POST array early to see what arrived server-side; check PHP ini settings like post_max_size and max_input_vars if large forms are involved; and remember that CMSs or web application firewalls can alter or truncate submitted data.

Recommended Answers

All 5 Replies

Member Avatar for Menster

Hi there,
Is "product name" the name of the input box & post variable or is that the value of the variable/text in the input box?

Member Avatar for bjg5858

Here is the real code "product name" was just an example.
This is the part of the input form;

echo "<select name='type'>";
include("mysql_conn.php");
include("db_conn.php");

// Get a specific result from the "type" table
$result = mysql_query("SELECT * FROM type") or die(mysql_error());

while($row = mysql_fetch_array( $result )) {
$type = $row['type'];
echo  "<option value=$type>$type</option>";
}
echo "</select>";

Here is a some code from the processing form which adds user input to the database;

$prod_type = $_POST['type'];

$qry = "INSERT INTO products(prod_name, prod_desc, prod_skincond, prod_application, prod_benefits, prod_type, prod_price, prod_img, prod_size, prod_code) VALUES('$prod_name','$prod_desc','$prod_skincond','$prod_application','$prod_benefits','$prod_type','$prod_price','$img','$prod_size','$prod_code')";
$result = @mysql_query($qry);
Member Avatar for Menster 
echo "<select name='type'>";
include("mysql_conn.php");
include("db_conn.php");

// Get a specific result from the "type" table
$result = mysql_query("SELECT * FROM type") or die(mysql_error());

while($row = mysql_fetch_array( $result )) {
$type = $row['type'];
echo  "<option value=$type>$type</option>";
}
echo "</select>";

I think the problem might be here, try enclosing the value attribute for the select statement in quotes:

while($row = mysql_fetch_array( $result )) {
$type = $row['type'];
echo  "<option value=\"$type\">$type</option>";
}

Another thing you can try is, on the page that you post this form to, at the top:

echo "<pre>";
print_r($_POST);
echo "</pre>";
die();

Which will tell exactly what is coming through from your form.

Member Avatar for kronikmedia

All variables have a limit on the legth of values it can hold. If you are using Joomla or another CMS then often restrictions are placed and you can only post values using the methods designated in the API.

Member Avatar for bjg5858

Thanks Menster Adding the quotes fixed the problem.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.