Filter SQL results with drop down menu in PHP

Question

I ve been stuck on this problem for about 3 days now. I would appreciate any help i can with this problem how ever please can you explain where and how i have gone wrong as i would like to learn and understand!

Basically what i am trying to achieve is the following.

A drop down menu, that will display the results of the selected column in my database.

My database has 3 columns "project_name","stage" and "project_details"

If the user selects "stage" it must only display / echo the results form the "stage" column on the screen.

The code below is what i have so far! I know i am subject to an SQL injection but i am trying to get the filter to work first then i will sort that out.

At the moment i keep getting an error on line 42 and 56, i would appreciate any help or input for anyone!

<form action='filter2.php' method='post' name='value' > 
    <select name="value"> 
        <option value="project_name">project_name</option> 
        <option value="stage">stage</option> 
        <option value="project_details">project_details</option> 
    </select> 
    <br /> 
    <input type='submit' value = 'Filter'> 
</form>



<?php 


    // Authentication Variables
$servername = "localhost";
$username = "basic";
$password = "redrobinX123";
$dbname = "basic_forms1";    

// Make connection
$con = mysql_connect($servername, $username, $password, $dbname);

// If error connecting
if (!$con) {
    die(mysql_error("could not connect"));
}

// If post value isset
if(isset($_POST['value'])) {

    $column = $_POST['value']; // Set Column

    $query = "SELECT". $column . "FROM photo"; // Create Query 

    $sql = mysql_query($query);  // Run Query

    // Loop through results
    while ($row = mysql_fetch_array ($sql)){   
        echo "<br>". $row[$column] . "<br>";
    }

    // Close connection
    mysql_close($con); 

}
?>

Answer 1

Set it up like this....

// Authentication Variables
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";    

// Make connection
$con = mysqli_connect($servername, $username, $password, $dbname);

// If error connecting
if (!$con) {
    die(mysqli_error("could not connect"));
}

// If post value isset
if(isset($_POST['value'])) {

    $column = $_POST['value']; // Set Column

    $query = "SELECT $column FROM photo"; // Create Query 

    $sql = mysqli_query($con, $query);  // Run Query

    // Loop through results
    while ($row = mysqli_fetch_array($sql, MYSQLI_ASSOC)){   
        echo "<br>". $row[$column] . "<br>";
    }

    // Close connection
    mysqli_close($con); 

}

Answer 2

I think you mixing mysql and mysqli functionalities. Try this

<form action='filter2.php' method='post' name='value' > 
<select name="value"> 
<option value="project_name">project_name</option> 
<option value="stage">stage</option> 
<option value="project_details">project_details</option> 
</select> 
<br /> 
<input type='submit' value = 'Filter'> 
</form>
<?php 
// Authentication Variables
 $servername = "localhost";
 $username = "basic";
 $password = "redrobinX123";
 $dbname = "basic_forms1";    
// Make connection
$con = mysqli_connect($servername, $username, $password, $dbname);
// If error connecting
if (!$con) {
die(mysqli_error("could not connect"));
}
// If post value isset
if(isset($_POST['value'])) {

$column = $_POST['value']; // Set Column

$query = "SELECT ". $column . " FROM photo"; // Create Query 

$sql = mysqli_query($con,$query);  // Run Query

// Loop through results
while ($row = mysqli_fetch_array ($sql)){   
    echo "<br>". $row[$column] . "<br>";
}

// Close connection
mysqli_close($con); 
}
?>