使用从php / database返回的数据来创建新表单

Question

I did some research already but can't find a good solution to this. I am sure it's simple, but I could use some help.

I am using HTML -> Javascript -> PHP to get info back from a database. My goal is to have the data return, but have it add check boxes at the end of each row where if the person check it, it will add them to another table.

In my example, it will return a list of cards and if the person uses the check box it will add each card they checked to a "have" list. For my code provided below, it's a "display all" so I didn't use any javascript. I put it straight from html to php. I figure if I can get the most simple example working, adding the js to my other search display will be easy.

HTML

<fieldset>
<form action="display_all.php" method="post">
Order by: <select name="order_all" id="order_all">
  <option value="parallel">Parallel</option>
  <option value="faction">Faction</option>        
</select>   
<input type="submit" value="display all cards">
</form>
</fieldset>

PHP (to save space I cut out some of the standard code)

$order_all = $_POST['order_all'];

// Create SQL statement
$query = "SELECT * FROM cards ORDER BY $order_all ASC";
// Execute SQL statement
if (!($result = @ mysql_query ($query, $connection)))
  showerror();
// Display results
while ($row = @ mysql_fetch_array($result)) {

  echo "<tr><td>{$row["parallel"]}</td>
<td>{$row["faction"]}</td>
<td>{$row["in_set"]}</td>
<td>{$row["card_name"]}</td>
<td>{$row["color"]}</td>
<td>{$row["number_in_set"]}</td>
<td>{$row["rarity"]}</td>
<td>{$row["sold_out"]}</td>
<td>{$row["series"]}</td>
</tr>";
}

I tried adding different things to the while { } at the end of the PHP file but I don't really know the proper way to do that. Based on what I saw around, people suggest doing this in javascript and creating a function for it. Start with my ajax call and callback? I planned on linking my checkboxes to the ID of each card (which is stored in the database, but not printed) I figure they will just be linked to query insert commands. Like if check [ insert command ] and form submit? idk looking for some suggestions, I am still new to using databases in this sort of way.

FOUND A SOLUTION TO MY PROBLEM, well sorta. It was a bunch of little things. I haven't added functionality, but I at least got the checkbox to show up.

while ($row = @ mysql_fetch_array($result)) {
echo"
<tr>
<td>{$row["parallel"]}</td>
<td>{$row["faction"]}</td>
<td>{$row["in_set"]}</td>
<td>{$row["card_name"]}</td>
<td>{$row["color"]}</td>
<td>{$row["number_in_set"]}</td>
<td>{$row["rarity"]}</td>
<td>{$row["sold_out"]}</td>
<td>{$row["series"]}</td>
";
echo'<td><input type="checkbox" value="submit" id="{$row["id"]}/></td>';
echo"</tr>";
}

Answer 1

1. Your code is paradise for SQL injection! You have to check user input, at least escaping with mysql_real_escape_string or
2. Switch to newer, better and safer mysqli (or PDO) interface and use prepared statements. I recommend mysqli anyway. Note: in this particular case is best to use switch with options.

To question: why don't you get checkbox value from post and then take actions, but I'm not sure what are you asking.