Member Avatar for jober

here the code,

<?php

$a = $_GET['Cors'];
$b = $_GET['sem'];
$c = $_GET['yrlvl'];

mysql_connect("localhost", "root", "") or die ('Error'.mysqlerror());
mysql_select_db("sched");

$query="INSERT INTO sked (crs,sm,yrlvl) values ('".$a."','".$b."','".$c."')";

mysql_query($query) or die ('Error Cannnot Insert Records!');

?>  

<?php

the listbox is "sem", tnx
  • 2 Contributors
  • 1 Reply
  • 201 Views
  • 12 Hours Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

is correct that the browser sends an option's value to PHP, and 's original snippet shows a couple of other common mistakes worth checking first: the form method must match the PHP superglobal used (GET vs POST), and the select needs a name attribute (an id alone does not submit). If the listbox allows multiple choices, the select name must end with [] so PHP receives an array rather than a single string.

Server-side validation and safe storage are essential. Avoid concatenating raw input into SQL and avoid the old mysql_* functions (they were removed from modern PHP). Read and validate inputs, then use parameterized queries. Example using PDO and basic filtering:

$pdo = new PDO('mysql:host=localhost;dbname=sched;charset=utf8mb4', 'dbuser', 'dbpass', [
  PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
]);

$crs  = filter_input(INPUT_POST, 'Cors', FILTER_SANITIZE_STRING);
$sem  = filter_input(INPUT_POST, 'sem', FILTER_SANITIZE_STRING);
$yrlv = filter_input(INPUT_POST, 'yrlvl', FILTER_SANITIZE_NUMBER_INT);

$stmt = $pdo->prepare('INSERT INTO sked (crs, sm, yrlvl) VALUES (:crs, :sm, :yrlvl)');
$stmt->execute([':crs'=>$crs, ':sm'=>$sem, ':yrlvl'=>$yrlv]);

If the select is multiple, handle it as an array and validate each entry (do not blindly implode unsanitized values):

if (!empty($_POST['sem']) && is_array($_POST['sem'])) {
  $vals = array_map('intval', $_POST['sem']); // validate/convert
  // insert each value with a prepared statement or store after validation
}

A small client-side fallback can fill missing option values before submit (useful if options were generated without values):

form.addEventListener('submit', function() {
  var s = this.querySelector('select[name="sem"]');
  var opt = s && s.options[s.selectedIndex];
  if (opt && !opt.value) opt.value = opt.text;
});

Quick debugging tips: inspect the request with browser devtools or dump $_POST/$_GET to see what keys arrive, enable exceptions/error reporting during testing, and restrict stored values to an allowlist where possible.

Member Avatar for Member #120589

You don't seem to mention the nature of the problem.

It may be that your options in the select widget (listbox) do not have a value. It is the value of the option tag that will be passed to the $_POST['sem'] variable not the text displayed in the widget.

<select id="sem">
  <option value = "Wales">Cymru</option>
  <option value = "Scotland">Alba</option>
  <option value = "Brittany">Breizh</option>
</select>

If the 'Cymru' option was selected in the listbox, then the $_POST['sem'] value will be 'Wales'.

If you are able to set the value attribute to the same as the text, this should sort it out.
If you can't do this for some reason, you could use javascript to programmatically set the value of the selected option to the displayed text prior to submission with an 'onsubmit' attribute.

BTW
Your line:

$query="INSERT INTO sked (crs,sm,yrlvl) values ('".$a."','".$b."','".$c."')";

Seems a little clunky and possibly dangerous. Clean your variables before passing it to the sql query:

$a = addslashes(htmlentities($_POST[...]));
 [etc.]

$query="INSERT INTO sked SET crs = '{$a}', sm = '{$b}',yrlvl ='{$c}';

If this is not the case, come back and explain your problem.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.