Member Avatar for shamsidah

Hi..

I need some help. I have a problem to insert 2 values or variable from drop down list to database at the same time.

i want to insert name_relation into db, at the same time want to insert IcNo into db.

here my code:

<?php
 
	include ("ConnectDB.php");

?>
  <select name = "name_relation" id="name_relation">
    <option value="" selected>Please Select</option>
    <?php
			$strSQL = "SELECT * FROM family_detail WHERE EmployeeNo = '$EmployeeNo'";
			$objQuery = mysql_query($strSQL);
			while($objResuut = mysql_fetch_array($objQuery))
			{
			
			?>
    <option value="<?php echo $objResuut["Name"];?>"> <?php echo $objResuut["Name"]." - ".$objResuut["IcNo"] ." - ".$objResuut["relation"];?></option>
    <?php
			}
			?>
  </select>
 
  <?php
	mysql_close(); 
	
	
?>
Edited by Narue because: Added code tags
  • 4 Contributors
  • 8 Replies
  • 2K Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by RCrizt

Dani AI

Generated

You do not need to submit two values from the dropdown. Submit one stable key, then let the database give you both columns in the same statement. That keeps things normalized (as noted) and avoids trusting client input (a concern raised). A simple pattern is: render each option with the row id (or IcNo) as the value, then INSERT ... SELECT the Name and IcNo from familydetail using that key. Use prepared statements instead of mysql*.

Example with PDO (id is a PK on family_detail):

// Build the dropdown
$stmt = $pdo->prepare('SELECT id, Name, IcNo, relation
                       FROM family_detail
                       WHERE EmployeeNo = ?
                       ORDER BY Name');
$stmt->execute([$employeeNo]);
echo '<select name="family_id" required>';
echo '<option value="">Please Select</option>';
foreach ($stmt as $r) {
    $label = htmlspecialchars($r['Name'].' - '.$r['IcNo'].' - '.$r['relation'], ENT_QUOTES);
    echo '<option value="'.$r['id'].'">'.$label.'</option>';
}
echo '</select>';
// On form POST: fetch both fields by key and insert them together
$familyId   = filter_input(INPUT_POST, 'family_id', FILTER_VALIDATE_INT);
$employeeNo = filter_input(INPUT_POST, 'employeeNo', FILTER_VALIDATE_INT);

if ($familyId && $employeeNo) {
    $sql = 'INSERT INTO employee_family (EmployeeNo, Name, IcNo)
            SELECT ?, Name, IcNo
            FROM family_detail
            WHERE id = ?';
    $ins = $pdo->prepare($sql);
    $ins->execute([$employeeNo, $familyId]);
}

If you absolutely must send two values from the dropdown (as suggested), do not rely on a hyphen split that could break when a name contains the delimiter. Either JSON-encode the pair in the option value and json_decode on POST, or better, include data-icno="..." on the option and copy it to a hidden field with JS. In all cases, still verify the pair server-side against family_detail before inserting. Finally, add a UNIQUE constraint like (EmployeeNo, IcNo) on the target table to prevent accidental duplicates.

Recommended Answers

All 8 Replies

Member Avatar for skraps

Something like below etc etc blah blah

<?php

include ("ConnectDB.php");

if(isset($_POST['submit'])){
foreach($_POST as $key => $value){ //escapes any unwanted characters that can cause injections then also cut the variable off at 25 charaters to perevent the possibility of sql buffer overflows
$_POST['$key'] = mysql_real_escape_string(substr($value,25));
}
$sql="UPDATE family_detail SET some_value='some value', some_value='some_value', some_value='".$_POST['name_relation']."' WHERE EmployeeNo = '".$_POST['EmployeeNo']."'";
mysql_query($sql);   

}else{
?>
<form action="" method="post">
<input type="hidden" name="employeeNo" value="<?php echo $employeeNo;?>" />
<select name="name_relation" id="name_relation">
<option value="" selected>Please Select</option>
<?php
$strSQL = "SELECT * FROM family_detail WHERE EmployeeNo = '$EmployeeNo'";
$objQuery = mysql_query($strSQL);
while($objResuut = mysql_fetch_array($objQuery))
{

?>
<option value="<?php echo $objResuut["Name"];?>"> <?php echo $objResuut["Name"]." - ".$objResuut["IcNo"] ." - ".$objResuut["relation"];?></option>
<?php
}}
?>
</select>
<button type="submit" name="submit" />
<?php
mysql_close();


?>
Edited by skraps because: n/a
Member Avatar for skraps

Thats quick and dirty. You should actually check the employee number and make sure its a int with the function intval and if cut it off at 5 characters. if it's not a intval then make the script fail and block the ip address of the person who is submitting the data because they are obviously playing with the code to try injections.

Member Avatar for skraps 
<option value="<?php echo $objResuut["Name"];?>"> <?php echo $objResuut["Name"]." - ".$objResuut["IcNo"] ." - ".$objResuut["relation"];?></option>

and here in your code is the only value that is going to be passed to the database, and thats not a relation. $objResuut["Name"]; So you might want to adjust that also.

Member Avatar for shamsidah

thanks skraps for your kind action..

actually, i want to get name and also IcNo from the drop down list. If user select one of the name from drop down list, it will insert only name and i want to know how drop down list can insert name and IcNo at the same time into db. IcNo and Name are different field name in db. code that i given just now,code for drop down list. Can or not one drop down list having 2 parameter??

Thanks

Member Avatar for urtrivedi

why you want to add one more field, One thing I feel is that your database is not normalized.

Now if this it is mandatory requirement, then you can do one thing
you must be having action page to insert or update mysql data, while inserting query you join from the table where there is lcno and name

insert into TABLENAME (col1, col2, LCNO, NAME) 
select '{$_POST['col1']}' , '{$_POST['col2']}', '{$_POST['code']}', NAME FROM MASTERTABLE WHERE LCNO='{$_POST['code']}'

Here i assume {$_POST} is dropdown name and master table is table from where you populate dropdown

Edited by urtrivedi because: n/a
Member Avatar for urtrivedi

this is more precise to your case

insert into TABLENAME (col1, col2,  NAME,lcno) 
select '{$_POST['col1']}' , '{$_POST['col2']}', '{$_POST['name_relation']}', lcno FROM family_details WHERE name='{$_POST['name_relation']}'
Edited by urtrivedi because: n/a
Member Avatar for RCrizt

try this :
$value = $_POST;
list($value1,$value2) = explode("-",$value);

echo $value1;
echo "<br/>";
echo $value2;

<form method='post'>
<select>
<option value="abc-123">abc 123</option>
</select>
<input type='submit'>
</form>

Member Avatar for RCrizt

try this :
$value = $_POST;
list($value1,$value2) = explode("-",$value);

echo $value1;
echo "<br/>";
echo $value2;

<form method='post'>
<select name='val'>
<option value="abc-123">abc 123</option>
</select>
<input type='submit'>
</form>

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.