PHP使用表单传递数据

Question

I have a form which passes data from the index.php to the update.php. The code successfully passed the date of birth variable but it didn't pass the $leadid variable. What is wrong with my code?

part of code in index.php

<form method="post" action="update.php">
<table width="400" border="0" cellspacing="1" cellpadding="2">

<tr>
<td width="100">Lead ID</td>
<td>
<?php

mysql_connect('localhost', 'root', '');
mysql_select_db('test');

$sql = "SELECT leadid FROM table WHERE lead_no ='$lead_no'";
$result = mysql_query($sql);
$row = mysql_fetch_row($result);
$leadid = $row[0];

echo $leadid;

?>
</td>
</tr>

<tr>
<td width="100">Date of Birth</td>
<td><input name="birth" type="date" id="birth"></td>
</tr>
</table>
</form>

In my update.php i have POST

 $id = $_POST['leadid'];
 $birth = $_POST['birth'];

Answer 1

In your code there is no input field for the leadid variable. Try adding a hidden field like this:

<input type="hidden" value="<?php echo $leadid;?>" name="leadid" />

Then, that POST variable should be transferred.

Answer 2

Post does only pass the variables that are wrapped by a html form element like <input> <textarea> or others inside the <form> tag.

Since you did not create such a tag for your $leadid variable it's not available for the update.php file.

Put the following code inside your <form> tag to pass the leadid to the second script.

<input type="hidden" value="<?php echo $leadid;?>" name="leadid" />

Relating to your database query: It is recommended to use prepared statements instead of unprepared. The way you're currently selecting values from your database is a huge security leak and can be abused for SQL injections! I know you're currently using it for local testing but it's important to know that the code could cause security problems. Here is an example on how to do it with prepared statements:

$mysqli = new mysqli('localhost', 'root', '');
$stmt = $mysqli->prepare("SELECT leadid FROM table WHERE lead_no = ?");
$stmt->bind_param("i", $lead_no); // assuming lead_no is an integer value
$stmt->execute();
$stmt->bind_result($leadid);
$stmt->fetch();

// your lead id is now stored inside $leadid

More information can be found here: http://php.net/manual/de/mysqli.quickstart.prepared-statements.php