value gating with document.write() not working in php where condition

Question

there is a product id f800 in product table I want to get the name of product using product id and I am get id by using var y=document.getElementById('cod').value;.

f800 store in y perfect .and store in php variable $cod="<script>document.write(y);</script>";

if use echo $cod out put is f800. problem is this if I use $sql = "SELECT * FROM product WHERE pro_id='$cod' "; out put is noting. But if I use $cod="f800"; and now this $cod use in $sql result is fresh up this is the name of product.

I tried my best .I have this problem from three days

CODE # 1 start

<!DOCTYPE html>
<html>
<head>
  <title></title>
</head>
<body>
 <form class="create_invoice" method="POST">
         <span id="c">#Code</span>
         <span id="n">Name</span>
         <span id="t">Type</span>
         <span id="co">Company</span>
         <span id="u">Unit price</span>
         <span id="q">Quantity</span>
         <span id="t">Total Price</span> 

         <table class="create_table" id="new_row">
           <tr>
             <td><input id="cod" class="code" type="text" name="code" value="f800"></td>

             <td><input id="in" class="name" type="text" name="name" placeholder="Name" ></td>

             <td><input id="in" type="text" name="type" placeholder="Type" ></td>
             <td><input id="in" type="text" name="company" placeholder="Company"></td>
             <td><input id="in" type="text" name="unit_price" placeholder="Price"></td>
             <td><input id="in" type="text" name="quantity" placeholder="Quantity"></td>
             <td><input id="in" type="text" name="total_amount" placeholder=""></td>
             <td><button type="button" id="add"  name="add" >+</button></td>
           </tr>
         </table>
         <input id="submit" type="submit" name="insert" value="Submit" style="margin-left: 38%;">


      </form>
</body>
</html>
<script type="text/javascript">
  var y=document.getElementById('cod').value;
</script>

<?php
               $out=NULL;
                $servername="localhost";
                $username="root";
                $password="";
                $dbname="SMS";
                $conn = new mysqli($servername, $username, $password, $dbname);
                // Check connection
               if ($conn->connect_error) {
                die("Connection failed: " . $conn->connect_error);
              } 
               else{
                      $cod="<script>document.write(y);</script>";

                      echo $cod;


                 $sql = "SELECT * FROM product WHERE pro_id='$cod' ";
                    echo $sql;
                         $result = $conn->query($sql);

                              if ($result->num_rows > 0) {
                           // output data of each row
                       while($row = $result->fetch_assoc()) {

                         $id=$row["pro_id"];



                        echo $row["pro_name"];


                         }
                 }else{
                  echo "0 row";
                 } 

                  }
          ?>

CODE#1 end

code#2 start

<!DOCTYPE html>
<html>
<head>
  <title></title>
</head>
<body>
 <form class="create_invoice" method="POST">
         <span id="c">#Code</span>
         <span id="n">Name</span>
         <span id="t">Type</span>
         <span id="co">Company</span>
         <span id="u">Unit price</span>
         <span id="q">Quantity</span>
         <span id="t">Total Price</span> 

         <table class="create_table" id="new_row">
           <tr>
             <td><input id="cod" class="code" type="text" name="code" value="f800"></td>

             <td><input id="in" class="name" type="text" name="name" placeholder="Name" ></td>

             <td><input id="in" type="text" name="type" placeholder="Type" ></td>
             <td><input id="in" type="text" name="company" placeholder="Company"></td>
             <td><input id="in" type="text" name="unit_price" placeholder="Price"></td>
             <td><input id="in" type="text" name="quantity" placeholder="Quantity"></td>
             <td><input id="in" type="text" name="total_amount" placeholder=""></td>
             <td><button type="button" id="add"  name="add" >+</button></td>
           </tr>
         </table>
         <input id="submit" type="submit" name="insert" value="Submit" style="margin-left: 38%;">


      </form>
</body>
</html>
<script type="text/javascript">
  var y=document.getElementById('cod').value;
</script>

<?php
               $out=NULL;
                $servername="localhost";
                $username="root";
                $password="";
                $dbname="SMS";
                $conn = new mysqli($servername, $username, $password, $dbname);
                // Check connection
               if ($conn->connect_error) {
                die("Connection failed: " . $conn->connect_error);
              } 
               else{
                      $cod="f800";

                      echo $cod;


                 $sql = "SELECT * FROM product WHERE pro_id='$cod' ";
                    echo $sql;
                         $result = $conn->query($sql);

                              if ($result->num_rows > 0) {
                           // output data of each row
                       while($row = $result->fetch_assoc()) {

                         $id=$row["pro_id"];



                        echo $row["pro_name"];


                         }
                 }else{
                  echo "0 row";
                 } 

                  }
          ?>

code #2 end

code#1 result
f800SELECT * FROM product WHERE pro_id='f800' 0 row
code#2 result
f800SELECT * FROM product WHERE pro_id='f800' fresh up

You should read up on SQL Injection with your planned SQL statements in mind. — devlin carnate, Jan 02 '19 at 19:29
Possible duplicate of [What is the difference between client-side and server-side programming?](https://stackoverflow.com/questions/13840429/what-is-the-difference-between-client-side-and-server-side-programming) — rickdenhaan, Jan 02 '19 at 19:32
You cannot transfer variables between javascript and php in that way. They operate at different times. Read up on AJAX for information on how to accomplish what you need. — rickdenhaan, Jan 02 '19 at 19:34

value gating with document.write() not working in php where condition

0 Answers0