为什么不将此隐藏字段发送到数据库？ MySQL的/ PHP的

Question

HTML / PHP

            <?php if(!empty($_GET['pID'])) $the_pID = mysql_real_escape_string($_GET['pID']);
                       if(!empty($_POST['cID'])) $the_cID = mysql_real_escape_string($_POST['cID']);

            ?>

            <form action="inc/q/prof.php?pID=<?php echo $the_pID; ?>" method="post">            
        <select id="courseInfoDD" name="courseInfoDD" tabindex="1">
                        <?php while($row3 = $sth3->fetch(PDO::FETCH_ASSOC))
                                {echo "<option>".$row3['prefix']." ".$row3['code']."</option>";}
                        ?>
                </select>       
        <select id="commQuarter" name="commQuarter" tabindex="2">
                         <option value="Fall">Fall</option>
                         <option value="Winter">Winter</option>
                         <option value="Spring">Spring</option>
                         <option value="Summer">Summer</option>
                </select>  
 <select id="commYr" name="commYr" tabindex="3">
                        <?php
                        $startdate = 2000;$enddate = date("Y");$years = range ($startdate,$enddate);foreach($years as $year){echo "<option value='$year'>$year</option>";}?>
          </select>  

        <textarea type="text" id="addComment" name="addComment" tabindex="3" value="Enter comment"> </textarea>
    <input type="hidden" name="pID" value="<?php echo $the_pID; ?>" />
    <?php if($sth3->rowCount() > 0) {
                $row3 = $sth3->fetch(PDO::FETCH_ASSOC);
            echo "<input type='hidden' name='cID' value='<?php echo $the_cID; ?>' />";
    } else {
                echo "<h1>poop</h1>.";
            }
            unset($sth3);
    ?>
    <input type="submit" name="submit" id="submit" />
    </form> 



**PHP/MYSQL**

<?php // Get select box options 
$pID3 = filter_input(INPUT_GET, 'pID', FILTER_SANITIZE_NUMBER_INT);
        $pdo3 = new PDO('mysql:host=##;dbname=###', $u, $p);
        $pdo3->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
$sth3 = $pdo3->prepare('
    SELECT pID, cID, C.prefix, C.code
    FROM Department D, Course C, Professor P
    WHERE pID = ?
    AND D.dID = C.dID
    AND D.dID = P.dID; 
');
        $sth3->execute(array(
            $pID3
        ));
?>

    <?php

    $connect = mysql_connect("###", $u, $p) 
      or die ("Error , check your server connection.");
    mysql_select_db("##");

    //Get data in local variable
    if(!empty($_POST['addComment']))
        $INFOO=mysql_real_escape_string($_POST['addComment']);
    if(!empty($_POST['commQuarter']))
        $QTRR=mysql_real_escape_string($_POST['commQuarter']);
    if(!empty($_POST['commYr']))
        $YRR=mysql_real_escape_string($_POST['commYr']);
    if(!empty($_POST['pID']))
        $PIDD=mysql_real_escape_string($_POST['pID']);
    if(!empty($_POST['cID']))
        $CIDD=mysql_real_escape_string($_POST['cID']);
    if(!empty($_POST['courseInfoDD']))
        $COURSEE=mysql_real_escape_string($_POST['courseInfoDD']);

    #print_r($_POST);
    echo $the_pID;
    echo $the_cID;

    // check for null values
    if (isset($_POST['submit'])) {
    $query="INSERT INTO Comment (info, Qtr, Yr, pID, cID, CName) 
            VALUES ('$INFOO', '$QTRR', '$YRR', '$PIDD', '$CIDD','$COURSEE')";
    mysql_query($query)  or die(mysql_error());
    echo "Your message has been received";
    }
    #else if(!isset($_POST['submit'])){echo "No blank entries";}
    #else{echo "Error!";}
    ?>

Sample of What's Submitted:

The zero shown towards the end is the cID field, why isn't this being submitted?? Its giving no error.

In addition, what is wrong with this:

<?php if($sth3->rowCount() > 0) {
                    $row3 = $sth3->fetch(PDO::FETCH_ASSOC);
                        echo "<input type='hidden' name='cID' id='cID' value='$row3['cID']' />";
                } else {
                    echo "<h1>poop</h1>.";
                }
                unset($sth3);
                ?>

It's saying this: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in

Answer 1

Your code looks fine, and in fact you probably are receiving the parameter value. I think your use of empty is causing the problem. From http://php.net/manual/en/function.empty.php :

Returns FALSE if var has a non-empty and non-zero value.

The following things are considered to be empty:

    * "" (an empty string)
    * 0 (0 as an integer)
    * 0.0 (0 as a float)
    * "0" (0 as a string)
    * NULL
    * FALSE
    * array() (an empty array)
    * var $var; (a variable declared, but without a value in a class)

In other words even if cID is correctly sent from the browser to the server, if the value is anyone of the values in the list above that empty check will fail .

I'd suggest doing this:

if(isset($_POST['cID']))
    $CIDD=mysql_real_escape_string($_POST['cID']);

You might still get garbage, but it will at least verify that you are receiving the parameter.

Answer 2

It seems to me that cId is never really initialized: you read it from the $_POST array at the start, which means it has to be set before you access this page or else will be considered empty.

Check the html-output in your browser and you'll probably see that it reads

<input type="hidden" name="cID" value="" />

-> no value.

I think you mean it to be created on the database side (autoincrement) and then you have to get this value with something like mysql_last_insert_id / PDO::lastInsertId()