How to choose mysqli table id number from dropdown menu and output select values from that row

Question

I have a drop down menu that is populated by pulling the IDs and company_names from a mysqli table with fields that look something like this

      id - company_name - first_name - last_name - phone - email ...
row1   1       ----          ----        ----       ---     ---
row2   2       ----          ----        ----       ---     ---

I then use the following code to pull the id and company_name to populate the dropdown menu

 $mysqli = new mysqli('localhost', 'root', '', 'clients');
    $sql = "SELECT id,company_name FROM clients";
    $get = $mysqli->query($sql)

    ?>

<h1>Invoices</h1>

<form method="post" action="processinvoices.php">
    <select name="id">
        <option value="0">Please Select</option>
        <?php
        while($row = mysqli_fetch_assoc($get))
        {
            ?>
            <option value = "<?php
            $id = $row['id'];
            $company_name = $row['company_name'];
            echo($id . $company_name)?>" >
                <?php echo($id ." ".  $company_name) ?>
            </option>
            <?php
        }

Which produces something that looks like this

Please Select
id1 companyname1
id2 companyname2
id3 companyname3

When I make a selection, say ID1 Company, I want the following code to select the appropriate row and echo the appropriate first_name associated with the ID selected. I think my problem is that when I try to $_POST['id '] to the variable $ids the id number isn't being collected making the code from echo $ids not work.

$ids = $_POST['id'];
echo $ids;
if( $mysqli->query( "SELECT * FROM clients WHERE ID = $ids" ) ) {
    if( $result = $mysqli->use_result() ) {
        while( $row = $result->fetch_assoc() ) {
            echo $row['company_address'];
        }
        $result->close();
    }
}

The closest answer I've seen to this issue is using jquery/ajax here but I'm looking for a purely php solution to this issue. Thanks in advance for any help provided and apologies if I haven't expressed my requirements perfectly.

Answer 1

You are concatenating the ID and the company name as the value for your drop down (which is the one you send). This will make your actual query to look like this:

SELECT ..... WHERE ID = id1companyname1

...which is wrong for multiple reasons.

You should only add the ID as the value:

<option value="<?= $row['id'] ?>">
    <?= $row['id'] . ' ' . $row['company_name']?>
</option>

You should also secure your PHP and SQL query a bit:

// Make sure the index exist with isset(), and cast it 
// as an integer (for security, since ID's are only integers)

$ids = isset($_POST['id']) ? (int) $_POST['id'] : 0;
echo $ids;

// Also, change ID in the query to id (small letters).
if ($result = $mysqli->query( "SELECT * FROM clients WHERE id = $ids" )) {
    while ($row = $result->fetch_assoc()) {
        echo $row['company_name'];
    }
}

Note: In this case, casting the value as integer works and is enough to protect you from SQL Injections, but in general, you should use Prepared Statements instead of concatenating your queries. Specially when dealing with user inputs, which can never be trusted.