PHP + HTML: create a form dynamically

Question

I'm trying to creat a form dynamically depending on the number of rows of a table in a database. I tried this and it's nor working:

require_once('mysqli_connect.php');

//I select the colum w_spanish from the table selected by the user
$q="SELECT w_spanish FROM ".$_GET['name'];

$r=@mysqli_query($dbc, $q);

echo '<FORM METHOD="POST" ACTION="Correction.php">';
echo '<TABLE BORDER="1">';

//Here is where I generate dinamically a table that can be filled by user
while ($row=mysqli_fetch_array($r, MYSQLI_ASSOC)){

$aux=$row['w_spanish'];
echo '<TR><TD>'.$aux.'</TD><TD><INPUT TYPE="TEXT" NAME="Sol_'.$aux.'" SIZE="20"></TD></TR>';

}

echo '</TABLE>';
echo '<P><INPUT TYPE="SUBMIT" VALUE="Submit" ></P></FORM>'; 


mysqli_close($dbc);

So when I press submit, the information is not sent to "Correction.php", and I think it's because I creating the HTML form inside php code. How could I do it right??

Answer 1

First off - remove the @ from the @mysqli statement as it is masking any errors that maybe happening.

Secondly take the generated code and paste it into http://validator.w3.org/#validate_by_input and see if there are any HTML errors and adjust where necessary.

Thirdly, since the user can select which table to read then your data needs to be super-sanitised as you certainly don't want sql injection attacks here.

Answer 2

The problem may be the query you are running. Without knowing more information, my guess would be your query isn't getting anything. Try dumping the row in each iteration and see what spits out. You may be looking for something like:

$q="SELECT w_spanish FROM tableName WHERE name = " . $_GET['name'];

If that's not it, it could also be the fact that since you are only grabbing one column from the database, you don't need access the information with $aux=$row['w_spanish']; . You can just use:

$aux=$row;

That I'm not 100% on though. Try dumping each row with var_dump() and see what pops out.

Answer 3

First declare $row , then use a do-while loop.

$row = mysqli_fetch_array($r, MYSQLI_ASSOC) do{  
    $aux=$row['w_spanish']; 
    echo '<TR><TD>'.$aux.'</TD><TD><INPUT> TYPE="TEXT"NAME="Sol_'.$aux.'" SIZE="20"></TD></TR>';
 }while ($row=mysqli_fetch_array($r, MYSQLI_ASSOC))