How to display data from database When Selecting Multiple option from Dropdown using PHP Mysqli

Question

Script Page is working nicely. When I select the multiple options in next dashboard page, no records display. Please fix this problem. I think the selected value cannot recognize in dashboard page

Script.php

<?php include("connection.php") ?>
<form id="script" name="script" action="dashboard.php" method="post">
    <strong>Choose Script Name : </strong><select name="script[]" id="select3" multiple=multiple style="margin: 20px;width:300px;">   
        <?php
        $result = $conn->query("select script_name from script_details ORDER BY script_name");
        while ($row = $result->fetch_assoc()) {
            unset($script_name);
            $script_name = $row['script_name'];
            echo '<option value="' . $id . '">' . $script_name . '</option>'; // Generated From database
        }
        ?>
    </select>
    <input type="submit" name="submit" id="button" value="View Dashboard" />
</form>

Dashboard.php

<table border="1">
    <tr align="center">
        <th>Number </th>      <th>Script Name</th>    <th> Date</th> 
    </tr> 
    <?php
    include("connection.php");
    $select = $_POST['script'];
    $selects = "SELECT * FROM script_details where script_name='$select'";
    $result = $conn->query($selects);
    echo "<table>";
    while ($row = $result->fetch_assoc()) {
        echo "<tr><td>" . $row["id"] . "</td><td>" . $row["script_name"] . "</td></tr>" . "</td><td>" . $row["date"] . "</td></tr>";
    }
    echo "</table>";
[This is script page Image. Selecting option from script_details database. Field name : script_name.][1]?>

This is Dashboard page. when selecting script2, script3 option. Doesnot show record for selected items.

Answer 1

I would approach it in the following way:

$scriptsArr = $_POST['script'];
$scriptsStr = implode(',', $scriptsArr);

$selects = "SELECT * FROM script_details where script_name IN ($scriptsStr)";

I've split it to few variables so you can understand the process. Hope I could help!

I hope your understand is not safe at all, I would suggest you will read a bit more about prepared statements: http://php.net/manual/en/mysqli.quickstart.prepared-statements.php

Answer 2

Firstof all your code is sql vulnerable

In Scrip you didn't define values of options in <select> tag. define value first and for this you need to fetch is from database

Script.php

<?php include("connection.php") ?>
<form id="script" name="script" action="dashboard.php" method="post">
    <strong>Choose Script Name : </strong>
    <select name="script[]" id="select3" multiple=multiple style="margin: 20px;width:300px;">   
        <?php
        $result = $conn->query("select id, script_name from script_details ORDER BY script_name");
        while ($row = $result->fetch_assoc()) {
            unset($script_name);
            $script_name = $row['script_name'];
            $id = $row['id'];
            echo '<option value="' . $id . '">' . $script_name . '</option>'; // Generated From database
        }
        ?>
    </select>
    <input type="submit" name="submit" id="button" value="View Dashboard" />
</form>

In dashboard do proper markup

Dashboard.php

<table border="1">
    <tr align="center">
        <th>Number </th>      <th>Script Name</th>    <th> Date</th> 
    </tr> 
    <?php
    include("connection.php");
    $select = $_POST['script'];
    $ids = "'" . implode("','", $select) . "'";
    $selects = "SELECT * FROM script_details WHERE id IN ($ids)";
    $result = $conn->query($selects);
    while ($row = $result->fetch_assoc()) {
        echo "<tr>"
                . "<td>" . $row["id"] . "</td>"
                . "<td>" . $row["script_name"] . "</td>"
                . "<td>" . $row["date"] . "</td>"
            . "</tr>";
    }
    ?>
</table>