Problems updating from dynamic select box

[andy98]

Hi

I am trying to generate a dynamic select box and then to update the database with the value selected if it has been altered.

This is what I currently have:

$cust_id = $_GET['cust_id'];
  $rainbow_order_id = $_GET['rainbow_order_id'];
  $update = $_GET['update'];
  $acc_order_id = $_GET['acc_order_id'];
  $sales_id = $_GET['sales_id'];
  
include("conn.php");  
  
    $query = "SELECT * FROM sales ORDER BY sales_person ASC";
    $result = mysql_query($query) or die (mysql_error()); 

include("Header.htm");  

echo "<img src=./images/editSalesperson.gif>";
?>

<?
     
echo "<form method='POST' action='updateordersalesperson.php?cust_id=$cust_id&sales_id=$sales_id&update=1&acc_order_id=$acc_order_id'>";
echo "<select name='sales_id' id='$sales_id'>";
   
     while ($row = mysql_fetch_row($result)){
                 $sales_id = $row[0];
                 $sales_person = $row[1];
				 $sales_office = $row[2];
                 print("<option value=\"$sales_id\">$sales_person, $sales_office</option>\n");
          }
?>
   
 </select><input type="submit" value="Submit">         
</form>

I don't think I have worked out how to pass the new SALES_ID from the select box.

Any help, would be appreciated! Many thanks

 

[Chacalinc]

what's the problem?

 

[andy98]

Thanks Chacalinc! Your reply lead me to believe that it was only probably a small error somewhere and I found it. On my update, I was using the variable incorrectly. A _POST instead of a _GET.

 

[kenrbnsn]

Why aren't you using POST instead of GET? If you use POST there is less likely hood of someone hijacking your processing code.

You would need some minor modifications to your code:

echo '<form method="POST" action="updateordersalesperson.php"';
echo '<input type=hidden name=cust_id value="' . $cust_id . '">';
echo '<input type=hidden name=sales_id value="' . $sales_id . '">';
echo '<input name=update value="1">';
echo '<input name=acc_order_id value=' . $acc_order_id . '>';

echo '<select name="sales_id" id="' . $sales_id .'>';
     while ($row = mysql_fetch_assoc($result)){
//
//  I am assuming that you have designed your tables logically, so the associative array has the 'right'
//  index strings
//                 $sales_id = $row[0];
//                 $sales_person = $row[1];
//                 $sales_office = $row[2];
                 echo '<option value="' . $row['sales_id'] . '">' . $row['sales_person'] . ',' . $row['sales_office'] . '</option>'."\n";
          }
?>
   
 </select><input type="submit" value="Submit" name="submit">         
</form>

Giving a name to the Submit button allows you to easily check whether it was pressed in your processing program/

<?
if (isset($_POST['submit'])) { // ok to process }
else { // we have a problem here }
?>