How to insert data to database table from $_GET value on PHP - php

Question

Why I can't insert into 1 field to my database table?
I loop the data of my other table to display each data and put the result to href tag so it clickable and concatenate with it's id so it will put the id result after the link like this:
<a href="scheduling.php?CID=<?php echo $rows['docID']; ?>">
Here is how I loop my data using php on page1:
<?php
$sel = "SELECT * FROM doctors ORDER BY docID";
$result = $conn->query($sel);
if($result->num_rows>0)
{
while($rows = $result->fetch_array())
{
?>
<a href="scheduling.php?CID=<?php echo $rows['docID']; ?>">
<div class="doc_item" style="width:310px; border:4px solid #009973;display:inline-block; margin-top:40px; margin-right:20px;">
<img src="images/ft-img.png" style="width: 300px;">
<div class="item-lvl" style="width: 100%; background:#009973; color:#fff; height:70px; padding-top:10px;">
<h4 style="font-size:20px; font-weight:bold;">Dr. <?php echo $rows['docFname']; ?></h4>
<span><?php echo $rows['docType']; ?></span>
</div>
<div style="width: 100%; background:#00664d;padding-top:15px; padding-bottom:20px;">
<h3 style="color:#fff;">Make a Schedule!</h3>
</div>
</div>
</a>
<?php
}
}
?>
Then I want to add the value of CID to my database table using this code on page 2:
<?php
if (isset($_POST['btn-submit'])) {
$cusID = $customerID;
$docID = $_GET['CID'];
$checkupType = $_POST['checkupType'];
$schedTime = $_POST['schedTime'];
$contact = $_POST['contact'];
$ins = "INSERT INTO schedule
(customerID, docID, checkupType, schedTime, contact)
VALUE ('$cusID','$docID','$checkupType','$schedTime','$contact')";
if($conn->query($ins)===TRUE) {
header('location:success_sched.php');
}else{
echo "SQL Query: " . $ins . "->Error: " . $conn->error;
}
}
Now, this code insert data to my database table except $docID which is the value is $_GET['CID'];
docID column is intiger.
please correct my code, this is my school project.
Form code on page 2:
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST">
<div class="sign-u">
<div class="sign-up1">
<h4>Form of Checkup* :</h4>
</div>
<div class="sign-up2">
<label>
<input type="radio" value="Virtual" name="checkupType" required>
Virtual Checkup
</label>
<label>
<input type="radio" value="Facetoface" name="checkupType" required>
Face to Face Checkup
</label>
</div>
<div class="clearfix"> </div>
</div>
<p style="color:gray;">*Take note that virtual checkup will require a you stable internet for better communication.</p>
<div class="sign-u">
<div class="sign-up1">
<h4>Date and Time* :</h4>
</div>
<div class="sign-up2">
<input type="date" name="schedTime" id="date" required>
</div>
<div class="clearfix"> </div>
</div>
<p style="color:gray;">*Please provide Skype id as a contact information if <span style="color:#ff5c33">Virtual Checkup</span> is your choice.</p>
<div class="sign-u">
<div class="sign-up1">
<h4>Contact Information :</h4>
</div>
<div class="sign-up2">
<input type="text" name="contact">
</div>
<div class="clearfix"> </div>
</div>
<div class="sub_home" style="text-align: right;">
<input style="background: #339966;" type="submit" name="btn-submit" value="Submit">
<div class="clearfix"> </div>
</div>
</form>

Answer 1

Please understand that when you submit a form, that is a new request to the server. It has a new URL. Your page 2 form submits to $_SERVER['PHP_SELF']; - which is the current URL but without the querystring variables. Therefore your GET parameter is not passed in the form submit. (If you use the "View Source" feature of your browser to examine the "action" attribute of the form after it's rendered, you'll see exactly what URL it makes the request to when submitting. You can also see the same thing by looking at your browser's Network tool, or your webserver's access logs.)
There are a couple of ways around that, but I'd suggest adding the value as a hidden field in the form, and populating it with the value of the GET parameter during the previous request.
e.g.
<input type="hidden" value="<?php echo $_GET["CID]; ?>" name="CID">
and then in the PHP, retrieve it via $_POST like all the other variables:
$docID = $_POST['CID'];
Finally, please ensure you update your code to use prepared statements and parameters, as recommended in the comments, so that you are protected against both SQL injection attacks and unexpected syntax errors. You can get more info and examples here