Member Avatar for webfan16

i'm sorry my title is confusing

here's my problem

i've created this

echo "<table border='1'>
<tr>
<th>Idno</th>
<th>Name</th>
<th>Specialty</th>
<th>Email</th>
<th></th>
</tr>";
    while($row = mysql_fetch_array($result))
    {
  echo "<tr>";
  echo "<td>" . $row['Idno'] .  "</td>";
  echo "<td>" . $row['LastName'] . " " . $row['FirstName'] . " " . $row['MiddleName'] . "</td>";
  echo "<td>" . $row['Specialty'] . "</td>";
  echo "<td>" . $row['Email'] . "</td>";
  echo "<td>" . 'Please <a href="/view.php">try again</a>.' . "</td>";
  echo "</tr>";
   }

my problem is how could i view the profile of that specific person from a specific row into a form or a new table...

here's a pic of the table

btw,i'm still a noobie about php so please bear with me T__T i really need a help

Edited by Dani because: Formatting fixed
  • 3 Contributors
  • 3 Replies
  • 112 Views
  • 17 Hours Discussion Span
  • Latest Post Latest Post by Lsmjudoka

Dani AI

Generated

Short version: put the row id into each row’s link (so the view page knows which record to fetch), validate that id on the view page, fetch only that row, and—if you allow edits—present a POST form that updates the same row with a parameterized query. was right to suggest passing an id; was right to remind you about escaping. Do both, but use modern parameterized queries instead of the old mysql_* functions.

Example workflow for view (validate id, fetch, escape output):

$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if (!$id) { /* show "invalid id" */ }

$pdo = new PDO(...);
$stmt = $pdo->prepare('SELECT Idno, FirstName, LastName, Specialty, Email FROM doctors WHERE Idno = :id');
$stmt->execute([':id' => $id]);
$row = $stmt->fetch(PDO::FETCH_ASSOC);
// echo fields after running them through htmlspecialchars()

If you want to edit, show a form prefilled with the fetched values (method="post", include the record id in a hidden field). On submit, validate each field (length, FILTER_VALIDATE_EMAIL for emails), then run a parameterized UPDATE and redirect (Post/Redirect/Get) to avoid duplicate submissions:

$update = $pdo->prepare('UPDATE doctors SET FirstName = :fn, LastName = :ln, Specialty = :s, Email = :e WHERE Idno = :id');
$update->execute([':fn'=>$fn,':ln'=>$ln,':s'=>$spec,':e'=>$email,':id'=>$id]);
header('Location: view.php?id='.$id); exit;

Extra notes: use filter_input/filter_var for validation, htmlspecialchars() when printing into HTML, enable PDO exceptions for easier debugging, implement a CSRF token for edit forms, and do not create a new table just to view/edit—re-use the existing row. For PDO docs and PHP input/output functions see the PHP manual: PDO, filter_input, htmlspecialchars.

Recommended Answers

All 3 Replies

Member Avatar for fobos

You have this

echo "<td>" . 'Please <a href="/view.php">try again</a>.' . "</td>";

Try this

echo "<td>Please <a href=\"view.php?id=".$row['id']."\">try again</a></td>";

What this will do is when the user clicks on the link, the link will contain the id to the row in the database. Then when it goes to try.php, just use the $_GET in your mysql statement to display the row.

Edited by fobos because: n/a
Member Avatar for webfan16

^ yout try.php are you referring to the view.php in the code

so i'm gonna make another php that contains get $_GET

like this


<html>
<?php
$db = mysql_connect("localhost","root","");
mysql_select_db("Hospital",$db);
$d_idno = $_GET;
$d_lastname = $_GET;
$d_firstname = $_GET;

how about the sql= what will i use INSERT,UPDATE or what?

do i have to make a table or form? how should i do it.. i'm really sorry

Member Avatar for Lsmjudoka

What exactly do you need to do? It seems like you might be trying to edit the profile information? In which case, you need to do two things:

1) Use mysql_real_escape_string() on the $_GET variables.

$d_idno = mysql_real_escape_string($_GET['d_idno']);
$d_lastname = mysql_real_escape_string($_GET['d_lastname']);
$d_firstname = mysql_real_escape_string($_GET['d_firstname']);

Then, use UPDATE on the table:

$query ="UPDATE Table_name SET 
Idno=$d_idno, 
Name='$d_firstname $d_lastname' 
WHERE Idno = $d_idno LIMIT 1";
mysql_query($query) or die(mysql_error());
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.