How to pass values from from to sql query - php

Question

I'm new to php programming. I'm kind of confused and I can't find any helpful information online. I'm trying to build a school manangement system from scratch. What I need is to get all the 'offered courses' from the database and put it in a form and allow the student to add the classes directly from the row. How can I do that?
I created a form and an input where the student might enter the course number and register for class. And it works fine. But I feel like it's not practical.
Here is my code
<?php
session_start();
// include("config.php");
include("functions.php");
// $sql="SELECT `course_num`, `professors`.`name` AS pName, `courses`.`name`AS cName , max_students FROM `courses`, `student_courses`,`professors` WHERE `professors`.`id`=`courses`.`professor_teaching` AND `student_id`= '".$_SESSION['student_id']."'";
// $result = mysqli_query($link, $sql);
$result = viewAllCourses();
?>
<form method="post" action="functions.php">
<table>
<tr>
<th><label>Course No.</label></th>
<th><label>Course Name</label></th>
<th><label>Professor</label></th>
<th><label>Max. Students</label></th>
<th><label>Action</label></th>
</tr>
<?php
if(mysqli_num_rows($result)){
while ($row = mysqli_fetch_assoc($result)) {
?>
<tr>
<td><label name="course_num"><?php echo $row['course_num'];?>
<input type="hidden" name ="coursenumber" value=<?php $row['course_num']?>>
</label></td>
<td><label><?php echo $row['cName'];?></label>
</td>
<td><label><?php echo $row['pName']; ?></label></td>
<td><label><?php echo $row['max_students']; ?></label></td>
<td><input type="submit" name="add" value="add"></td>
</tr>
</form>
</table>
<?php
}
}
?>
and then in the functions.php I have this code:
if (isset($_GET['add'])) {
$link = conn();
echo "TST";
exit;
$courseNum= $_POST['coursenumber'];
$record = mysqli_query($link, "INSERT INTO `student_courses`
(`student_id`, `course_id_num`)
VALUES ('".$_SESSION['student_id']."', '$courseNum')");
}
But it does nothing.
I tried adding an input tag for the course_number and passing it from there. But it doesn't work. What is the right way to do this?

Answer 1

You're the same names for the inputs in all the rows. When you submit the form, $_POST['coursenumber'] will just be the last course number in the table, not the one the user clicked on. You can put the course number in the value of the add button, rather than a hidden input. When a form has multiple submit buttons, the value comes from the one that was clicked.
You need to fix the order of the </form> and </table> tags, so they nest properly.
<?php
if(mysqli_num_rows($result)){
while ($row = mysqli_fetch_assoc($result)) {
?>
<tr>
<td><label name="course_num"><?php echo $row['course_num'];?>
</label></td>
<td><label><?php echo $row['cName'];?></label>
</td>
<td><label><?php echo $row['pName']; ?></label></td>
<td><label><?php echo $row['max_students']; ?></label></td>
<td><input type="submit" name="add" value="<?php echo $row['course_num'];?>"></td>
</tr>
</table>
</form>
<?php
}
}
?>
Also, since you're submitting the form with method="POST", the button will be $_POST['add'], not $_GET['add'].
You should use a prepared statement to protect against SQL-injection.
if (isset($_POST['add'])) {
$link = conn();
$courseNum= $_POST['add'];
$stmt = mysqli_prepare("INSERT INTO student_courses (student_id, course_id_num) VALUES (?, ?)");
mysqli_stmt_bind_param($stmt, "ii", $_SESSION['student_id'], $courseNum);
mysqli_stmt_execute($stmt);
}
If you want to pass multiple fields, you can put a separate form with multiple hidden inputs into each row, rather than making the whole table a form.
<?php
if(mysqli_num_rows($result)){
while ($row = mysqli_fetch_assoc($result)) {
?>
<tr>
<td><label name="course_num"><?php echo $row['course_num'];?>
</label></td>
<td><label><?php echo $row['cName'];?></label>
</td>
<td><label><?php echo $row['pName']; ?></label></td>
<td><label><?php echo $row['max_students']; ?></label></td>
<td><form action="functions.php" method="post">
<input type="hidden" name="coursenumber" value="<?php echo $row['course_num'];?>">
<niput type="hidden" name="something" value="<?php echo $row['something'];?>">
<input type="submit" name="add" value="add">
</form></td>
</tr>
</table>
<?php
}
}
?>
Then the functions.php script can use $_POST['course_num'] and $_POST['something'] to get these parameters.