Category and subcategory does not match - php

Question

I have issues with category and subcategory fields.
shortly, I made category like this: literature, and want to make drop down sub menu like this: poetry, novel, non-fiction.
I receive all the categories on the website, but can't get subcategory field at all.
Here is my code:
$category=htmlspecialchars($_REQUEST['category']);
if(isset($category)){
$avt=mysql_query("select * from category order by id asc");
while($category_id=mysql_fetch_array($avt))
{
?>
<li><a href="#"> <k style="font-size:11px;"> <?
echo $category_id['catname'];
} }
?> </k> </a>
<?
$subcategory=htmlspecialchars($_REQUEST['subcategory']);
if(isset($subcategory)){
$sql = mysql_query("SELECT t1.*,t2.* FROM category as t1, subcategory as t2 WHERE t1.id=t2.'$_REQUEST[subcat_id]'");
while($data = mysql_fetch_array($sql))
{ ?>
<ul style="z-index:101;">
<li> <k> <?php echo $data["subcat_name"]; ?> </k></li>
<? } }
?>
And here is the mysql:
category
id
catname
Subcategory
id
subcat_id
subcat_name
That's all. I would be grateful if some can help me to solve this. (I am beginner obviously)
Thank you

Answer 1

Even though you are a beginner, I would suggest you probably heavily retool this. Start with your database connection. mysql_ functions are deprecated (not recommended for use) in the latest v5 of PHP and removed altogether in PHP v7 because they are security risk and are poorly implemented by most. Use PDO or MySQLi instead. I prefer PDO, so I will demonstrate that:
# Create the connection thusly, fill in your own credentials
$con = new \PDO("mysql:host=localhost;dbname=mydatabase", $username, $password);
Next, you should know the difference between isset and empty. In your case, your isset will throw a warning if $_REQUEST['category'] is not set. When you create your own variable, it's guaranteed to be set when you check it because you manually just created it.
This will throw a warning if $_REQUEST['category'] is not set because you assign it before you check it:
$category = htmlspecialchars($_REQUEST['category']);
This WILL NOT throw a warning because you are checking if $_REQUEST['category'] is set yet. If not, assign $category to false by default:
# I like to use a ternary when there are only two options, but you can use if/else
$category = (isset($_REQUEST['category']))? htmlspecialchars(trim($_REQUEST['category'])) : false;
# This part now checks if the value that you created is NOT EMPTY because you
# have just created it, so checking if it is set is illogical
if(!empty($category)):
# Now we use our connection here to query.
# Here we can use query() because we don't have any variables to add into the query,
# so it's safe to use this short version
$avt = $con->query("select * from category order by id asc");
# Same while loop, just use the PDO version of fetching the results
while($category_id = $avt->fetch(\PDO::FETCH_ASSOC)): ?>
<?php
/**
* I'm not sure why you are using a "k" tag, so just combine with "a" tag
* also, though you can use <? as a php open, it's not recommended
* lastly, you have the close tag for "a" outside the loop, that is bad syntax
* since the open is inside the loop
*/
?>
<li><?php echo $category_id['catname'] ?></li>
<?php endwhile ?>
<?php endif ?>
Now that the top part is finished, you have the same issues (plus a couple more) on this second part of the code:
# It's also worth noting here you have set this variable, but you don't actually use it...?
# Secondly, you are checking for "subcategory" here, but in the code below you are injecting "subcat_id"...should they match??
$subcategory = (isset($_REQUEST['subcategory']))? htmlspecialchars(trim($_REQUEST['subcategory'])) : false;
if(!empty($subcategory)):
# Here is where you need to make a detour with your script. What you are doing is unsafe.
# You can not inject that value right into the sql. You need to "prepare", "bind value", and "execute" it
$subcat_id = $_REQUEST['subcat_id'];
# First prepare using ? as placeholders for the value you want to search for
# The naming convention on the "subcat_id" column I assume is actually the
# the parent category? If so, maybe it should be called "parent_id" or "category_id"??
$sql = $con->prepare("SELECT t1.*, t2.* FROM category as t1, subcategory as t2 WHERE t1.id = ? AND t2.subcat_id = ?");
# Now you want to execute for those two question marks (?)
# There are a few ways to prepare and bind parameters, this way is easy
# and you can visually see what we are trying to accomplish
$sql->execute([$subcat_id, $subcat_id]) ?>
<!-- you probably don't want to be looping this (or it's close tag) -->
<ul style="z-index:101;">
<?php
# Same type of thing as your first block of code
while($data = $sql->fetch(\PDO::FETCH_ASSOC)): ?>
<li> <?php echo $data["subcat_name"] ?> </li>
<?php endwhile ?>
<!-- end list -->
</ul>
<?php endif ?>
The final conclusion here is that you have some work to be done before you get to the main problem which is likely your SQL statement and the value you are querying. I would suggest reading up on any of the concepts mentioned that you are not familiar with.