how to change field using decision control statement?

Question

code:

<?php
    if(isset($_POST['search']))
    {
      $college_id = $_POST['college_id'];
      $field = $_POST['field'];
      $city = $_POST['city'];
      $college_name = $_POST['college_name'];

      if($college_id == $_POST['college_id'])
      {
        $sql = "select * from all_colleges where college_id = '$college_id'";
        $result = mysqli_query($link,$sql) or die(mysqli_error($link));
        while ($fetch = mysqli_fetch_array($result,MYSQLI_BOTH)) 
        {
          echo "<tr>
                  <td>".$fetch['college_id']."</td>
                  <td>".$fetch['college_name']."</td>
                  <td>".$fetch['website']."</td>
                  <td>".$fetch['field']."</td>
                  <td>".$fetch['city']."</td>
                  <td>
                    <a class='view' title='view' href='view.php?id=".$fetch['college_id']."'>
                      <img src='gridview/view.png' alt='view' />
                    </a>

                    <a class='update' title='Update' href='update.php?id=".$fetch['college_id']."'>
                      <img src='gridview/update.png' alt='Update' />
                    </a>

                    <a class='delete' title='delete' href='delete.php?ad_id=".$fetch['college_id']."'>
                      <img src='gridview/delete.png' alt='delete' />
                    </a>
                  </td>
                </tr>";

        }  
      }

      elseif($field == $_POST['field'])
      {
        $sql = "select * from all_colleges where field = '$field'";
        $result = mysqli_query($link,$sql) or die(mysqli_error($link));
        while ($fetch = mysqli_fetch_array($result,MYSQLI_BOTH)) 
        {
          echo "<tr>
                  <td>".$fetch['college_id']."</td>
                  <td>".$fetch['college_name']."</td>
                  <td>".$fetch['website']."</td>
                  <td>".$fetch['field']."</td>
                  <td>".$fetch['city']."</td>
                  <td>
                    <a class='view' title='view' href='view.php?id=".$fetch['college_id']."'>
                      <img src='gridview/view.png' alt='view' />
                    </a>

                    <a class='update' title='Update' href='update.php?id=".$fetch['college_id']."'>
                      <img src='gridview/update.png' alt='Update' />
                    </a>

                    <a class='delete' title='delete' href='delete.php?ad_id=".$fetch['college_id']."'>
                      <img src='gridview/delete.png' alt='delete' />
                    </a>
                  </td>
                </tr>";

        }  
      }

      elseif($city == $_POST['city'])
      {
        $sql = "select * from all_colleges where city = '$city'";
        $result = mysqli_query($link,$sql) or die(mysqli_error($link));
        while ($fetch = mysqli_fetch_array($result,MYSQLI_BOTH)) 
        {
          echo "<tr>
                  <td>".$fetch['college_id']."</td>
                  <td>".$fetch['college_name']."</td>
                  <td>".$fetch['website']."</td>
                  <td>".$fetch['field']."</td>
                  <td>".$fetch['city']."</td>
                  <td>
                    <a class='view' title='view' href='view.php?id=".$fetch['college_id']."'>
                      <img src='gridview/view.png' alt='view' />
                    </a>

                    <a class='update' title='Update' href='update.php?id=".$fetch['college_id']."'>
                      <img src='gridview/update.png' alt='Update' />
                    </a>

                    <a class='delete' title='delete' href='delete.php?ad_id=".$fetch['college_id']."'>
                      <img src='gridview/delete.png' alt='delete' />
                    </a>
                  </td>
                </tr>";

        }  
      }

      elseif($college_name == $_POST['college_name'])
      {
        $sql = "select * from all_colleges where college_name = '$college_name'";
        $result = mysqli_query($link,$sql) or die(mysqli_error($link));
        while ($fetch = mysqli_fetch_array($result,MYSQLI_BOTH)) 
        {
          echo "<tr>
                  <td>".$fetch['college_id']."</td>
                  <td>".$fetch['college_name']."</td>
                  <td>".$fetch['website']."</td>
                  <td>".$fetch['field']."</td>
                  <td>".$fetch['city']."</td>
                  <td>
                    <a class='view' title='view' href='view.php?id=".$fetch['college_id']."'>
                      <img src='gridview/view.png' alt='view' />
                    </a>

                    <a class='update' title='Update' href='update.php?id=".$fetch['college_id']."'>
                      <img src='gridview/update.png' alt='Update' />
                    </a>

                    <a class='delete' title='delete' href='delete.php?ad_id=".$fetch['college_id']."'>
                      <img src='gridview/delete.png' alt='delete' />
                    </a>
                  </td>
                </tr>";

        }  
      }
    }
    else
    {
      $per_page=100;
      if (isset($_GET["page"])) 
      {
      $page = $_GET["page"];
      }
      else {
      $page=1;
      }
      $start_from = ($page-1) * $per_page;

      $sql="select * from all_colleges LIMIT $start_from, $per_page";
      $result = mysqli_query($link,$sql);
      while ($row = mysqli_fetch_array($result)) 
      {
      echo "<tr>
              <td>".$row['college_id']."</td>
              <td>".$row['college_name']."</td>
              <td>".$row['website']."</td>
              <td>".$row['field']."</td>
              <td>".$row['city']."</td>
              <td>
                <a class='view' title='view' href='view.php?id=".$row['college_id']."'>
                  <img src='gridview/view.png' alt='view' />
                </a>

                <a class='update' title='Update' href='update.php?id=".$row['college_id']."'>
                  <img src='gridview/update.png' alt='Update' />
                </a>

                <a class='delete' title='delete' href='delete.php?ad_id=".$row['college_id']."'>
                  <img src='gridview/delete.png' alt='delete' />
                </a>
              </td>
            </tr>";

      }
  }
  ?>

html code:

<form method="post">
  <div class="row">
    <label for="Producer_firstname">College Id</label>
    <input type="text" name="college_id" id="college_id" size="25" />   
  </div>

  <div class="row">
    <label for="Producer_firstname">Field</label>       
    <select name="field" id="field">    
      <option value="">Select Field</option>
      <option value='All'>All</option>  
      <option value='engineering'>Engineering</option>  
      <option value='law'>LAW</option>  
      <option value='medical'>Medical</option>  
      <option value='management'>Management</option>  
      <option value='pharmacy'>Pharmacy</option>
      <option value='hotel management'>Hotel Management</option>
      <option value='mass communication'>Mass Communication</option>
      <option value='agriculture'>Agriculture</option>
      <option value='architecture'>Architecture</option>
      <option value='education'>Education</option>
      <option value='paramedical'>Paramedical</option>
      <option value='design'>Design</option>
      <option value='commerce'>Commerce</option>
      <option value='film/tv/media'>Film /TV/ Media</option>
      <option value='General'>General</option>
    </select>
  </div>

  <div class="row">
    <label for="Producer_firstname">Location</label>
    <input type="text" name="city" id="city" size="25" />   
  </div>

  <div class="row">
    <label for="Producer_firstname">College Name</label>
    <input type="text" name="college_name" id="college_name" size="50" />   
  </div>

  <div class="row buttons">
    <button type="submit" name="search" id="search">Search</button> 
  </div>
</form>

In this code I want that when I post college_id it will run

select * from all_colleges where college_id = '$college_id'

and when I post field it will run

select * from all_colleges where field = '$field'

similarly for city and college_name. But it only run college_id query either I post college_id or field it remain run same query i.e.

select * from all_colleges where college_id = '$college_id'

How can I fix this problem please help ?

Thank You

Think about your logic here! You set `$college_id = $_POST['college_id'];` and then test `if($college_id == $_POST['college_id'])` ___Well they are always going to be equal if you think about it arn't they___ — RiggsFolly, May 03 '17 at 09:02
Also this option ``?? Do you have a `college_id` of `All` ?? If not that wont work either without some PHP to spot `ALL` and run a different query completely — RiggsFolly, May 03 '17 at 09:05
Also _Why are you using `MYSQLI_BOTH`_ thats just a waste of memory. Use `MYSQL_ASSOC` as you are using the assoc array to get at the column data — RiggsFolly, May 03 '17 at 09:06
Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) — RiggsFolly, May 03 '17 at 09:10

score 0 · Accepted Answer · answered May 03 '17 at 09:05

0

if($college_id == $_POST['college_id']) this will always going to be true try this instead:

if(isset($_POST['college_id']) && !empty($_POST['college_id']))

answered May 03 '17 at 09:05

Ndroid21

400
1
8
19

score 0 · Answer 2 · edited May 23 '17 at 12:02

When you submit your form all fields will be set you need to check there values and add in where condition like,

if(isset($_POST['search'])) {
    $where =[];
    if($_POST['college_id']){
        $where[] = ' college_id = "'.$_POST['college_id'].'"';
    }
    if($_POST['field']){
        $where[] = ' field = "'.$_POST['field'].'"';
    }
    if($_POST['city']){
        $where[] = ' city = "'.$_POST['city'].'"';
    }
    if($_POST['college_name']){
        $where[] = ' college_name = "'.$_POST['college_name'].'"';
    }
    // you are searching so I prefer OR in implode
    $where = !empty($where) ? ' WHERE '.implode(' OR ',$where) : '';
    $sql = "select * from all_colleges ".$where;
    $result = mysqli_query($link,$sql) or die(mysqli_error($link));
    while ($fetch = mysqli_fetch_array($result,MYSQLI_BOTH)) {
       ....
    } // end while
}// end if post search

Updated, as per @RiggsFolly comment you need to prevent your data from SQL attacks by using prepare and bind_param like(based on Gumbo's answer ),

if(isset($_POST['search'])) {
    $where =[],$values=[];
    if($_POST['college_id']){
        $where[] = ' college_id = ? ';
        $values['college_id']=$_POST['college_id'];
    }
    if($_POST['field']){
        $where[] = ' field = ? ';
        $values['field']=$_POST['field'];
    }
    if($_POST['city']){
        $where[] = ' city = ? ';
        $values['city']=$_POST['city'];
    }
    if($_POST['college_name']){
        $where[] = ' college_name = ? ';
        $values['college_name']=$_POST['college_name'];
    }
    // you are searching so I prefer OR in implode
    $where = !empty($where) ? ' WHERE '.implode(' OR ',$where) : '';
    $stmt = $mysqli->prepare($query);
    $params = array_merge(array(str_repeat('s', count($values))), array_values($values));
    call_user_func_array(array(&$stmt, 'bind_param'), $params);
    /* fetch result data */
    while ($stmt->fetch()) {
       // your code here
    }
} // end if

Maybe a little note about SQL Injection would also be appropriate here — RiggsFolly, May 03 '17 at 09:10

how to change field using decision control statement?

2 Answers2