How to pass the dropdown list selected value from a php form to a mysql query

Question

The function of this web application is to: select a customer from the dropdown list (the dropdown list values are auto popup from the database), it will print the selected customer name and its postcode on the result page.

When I choose the customer name from the dropdown list and click the submit button, the result page only prints the $customerv value (the 1st echo), but the $result value (2nd echo) was not printed. The customer name is unique in the database.

index.php:

<?php
require_once('config.php');
?>
<!DOCTYPE HTML>
<html>
<form action="result.php" method="post">
Customer:<br>
    <select Customer id="customer" name="Customer">
      <option value="">--- Select Customer ---</option>
      <?php
      $sql = "SELECT b.BPName from BP b  where b.BPCode  like 'C%' Order by b.BPName";
      $customer = mysqli_query($conn, $sql);
      while ($cat = mysqli_fetch_array(
        $customer,
        MYSQLI_ASSOC
      )) :;

      ?>
        <option value="<?php echo $cat['BPName']; ?>">
          <?php echo $cat['BPName']; ?>
        </option>
      <?php
      endwhile;
      ?>
    </select>
<input type="submit" value="Submit">
  </form>
</html>

config.php:

<?php
$servername = "localhost";
$username = "xxx";
$password = "xxx";
$databse = "xxx";

$conn = new mysqli($servername, $username, $password, $databse);

if ($conn->connect_error) {
  die("Connection failed: " . $conn->connect_error);
}
?>

result.php:

<table>
<?php 
require_once('config.php');

    $customerv = $_POST['Customer'];
    echo $customerv;

    $sql = "SELECT shiptozipcode FROM BP WHERE BPName ='$customerv'";
    $result = $conn->query($sql);
    echo $result;
?>
</table>

Why pass the name and not the primary identifier? You also are open to SQL injections, parameterize query and use prepared statements. You also should use OOP everywhere. — user3783243, Jun 19 '22 at 11:41

score 0 · Accepted Answer · answered Jun 19 '22 at 11:52

The query result itself isn't something that's "printable" to the page. It's not just a single value, it's a complex object. You need to fetch the record(s) from the result. For example:

$result = $conn->query($sql);
while ($row = $result->fetch_assoc()) {
  echo $row["shiptozipcode"];
}

If you're sure there will be only one row (it's still a good idea to add some error checking anyway) then you don't need the loop:

$result = $conn->query($sql);
$row = $result->fetch_assoc();
echo $row["shiptozipcode"];

But either way, you need to extract the data from the result set. (You could also use fetch_object() instead of fetch_assoc() if you prefer object syntax over array syntax.)

As an aside, be aware that your query is wide open to SQL injection. Now would be a good time to learn how to correct that.

How to pass the dropdown list selected value from a php form to a mysql query

1 Answers1