post not completely posted PHP

Question

I have a select value 'post', when someone wants to change the status of the post from unsolved to solved they have to choose a post en than click 'change to solved'

The problem is when I click on the button, it doesn't change because PHP takes not the whole title of the post. So when my post is called 'Photoshop crashes', it only sends 'Photoshop'. That's why it doesn't update in my database, the query can't find the right post, when the title of the post is only 1 word, my table gets updated.

<?php
if (isset($_POST['btnSolved'])) 
{
// wanneer er op de knop geklikt is proberen we user te saven in de databank
if (!empty($_POST['btnSolved'])) 
{
    $solved = $_POST['unsolved'];
    $conn = new mysqli("localhost","root","root","PhpProject");
    if ($conn -> connect_errno) {
        throw new Exception("No connection with database!");

    } else {
        $sql = "UPDATE Posts SET status = 'Solved' WHERE post='".$solved."'";
    }
   }
    $conn->query($sql);
  }
  ?>

In my body:

<h3>Change status</h3>
        <form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
            <?php
            if(mysqli_num_rows($showBugs) > 0)
            {
                echo "<select name= unsolved>"; 
                while ($row = mysqli_fetch_assoc($showBugs)) 
                {
                    echo "<option value=" . $row['subject'] . ">" . $row['subject'] . "</option>";
                }
                echo "</select>";
            }
            ?>
            <br />
            <input class="btn btn-info dropdown-toggle" type="submit" name="btnSolved" value="Change to solved" />
        </form>

This is what I get when I do a print of the $sql

UPDATE Posts SET status = 'Solved' WHERE post='Photoshop'

Does someone know why PHP can post 1 word, but not the whole title? It might be something stupid, but I don't know how to fix this.

Answer 1

Your problem is a absence of the quotes in your html. Fix this:

echo "<option value=" . $row['subject'] . ">" . $row['subject'] . "</option>";

to this:

echo '<option value="' $row['subject'] . '">' . $row['subject'] . "</option>";

Answer 2

The browser won't parse this properly if $row['subject'] comprises two words:

echo "<option value=" . $row['subject'] . ">" . $row['subject'] . "</option>";

Your browser will read

<option value=two words>

as

<option value=two>

and not know what to do with words

use escaped double quotes

echo "<option value=\"" . $row['subject'] . "\">" . $row['subject'] . "</option>";

Answer 3

尝试将值括在单引号中，

echo "<option value='" . $row['subject'] . "'>" . $row['subject'] . "</option>";

Answer 4

You need to add quotes for the value attribute. And if you have quotes in your value you need to pass $row['subject'] through htmlentities() like this:

echo '<option value="' . htmlentities($row['subject']) . '">' . htmlentities($row['subject']) . "</option>";

In this case htmlentities() for the label is not needed but it's good practice.