Can't search href in form upon clicking button - php

Question

When I click the borrow button, it should execute my borrowing.php but it just returns to itself. It's not executing the action. Is there some way I can solve this?
<form id = "myform" action="includes/borrowing.php" method = "POST" enctype ="multipart/form-data">
<div class = "form-group pull-left">
<label>Student Name:</label>
<br />
<select name = "fIDNumber" id = "student">
<option value = "" selected = "selected" disabled = "disabled">Select an option</option>
<?php
$qborrow = $con->query("SELECT * FROM `tblstudents` ORDER BY `fLastName`") or die(mysqli_error());
while($fborrow = $qborrow->fetch_array()){
?>
<option value = "<?php echo $fborrow['fIDNumber']?>"><?php echo $fborrow['fFirstName']." ".$fborrow['fMiddleName']." ".$fborrow['fLastName']?></option>
<?php
}
?>
</select>
</div>
<div class = "form-group pull-right">
<button name = "save_borrow" class = "btn btn-primary"><span class = "glyphicon glyphicon-thumbs-up"></span> Borrow</button>
</div>
<table id = "table" class = "table table-bordered">
<thead>
<th>Select</th>
<th> Code </th>
<th> Title </th>
<th> Author </th>
<th> Category </th>
<th> Shelf Location </th>
<th> Edition </th>
</thead>
<tbody>
<?php
$sql = $con->query("SELECT * FROM `tblbooks`") or die(mysqli_error());
while($row = $sql->fetch_array()){
$q_borrow = $con->query("SELECT * FROM `tblbooks` WHERE `fBookCode` = '$row[fBookCode]' and `fStatus` = '$row[fStatus]'") or die(mysqli_error());
$status = $q_borrow->fetch_array();
?>
<tr>
<td>
<?php
if($status == 'Borrowed'){
echo "<center><label class = 'text-danger'>Not Available</label></center>";
}else{
echo '<input type = "hidden" name = "fBookCode[]" value = "'.$row['fBookCode'].'"><center><input type = "checkbox" name = "selector[]" value = "1"></center>';
}
?>
</td>
<td><center> <?php echo $row['fBookCode']; ?>  </center></td>
<td> <?php echo $row['fTitle']; ?> </td>
<td> <?php echo $row['fAuthor']; ?>  </td>
<td> <?php echo $row['fCategory']; ?>  </td>
<td> <?php echo $row['fShelfLocation']; ?>   </td>
<td> <?php echo $row['fEdition']; ?>  </td>
</tr>
<?php
}
?>
</tbody>
</table>
</form>
Here's my borrowing.php This is not yet fully finished but atleast it should be able to read this. I tried using a link but it won't read my fields anymore. I want to use the form method but it really is not seeing this.
<?php
require_once 'connection_db.php';
if(!ISSET($_POST['fIDNumber'])){
echo '
<script type = "text/javascript">
alert("Select student name first");
window.location = "../borrow.php";
</script>
';
}else{
if(!ISSET($_POST['selector'])){
echo '
<script type = "text/javascript">
alert("Selet a book first!");
window.location = "../borrow.php";
</script>
';
}else{
foreach($_POST['selector'] as $key=>$value){
$fIDNumber = $_POST['fIDNumber'];
$fBookCode = $_POST['fBookCode'][$key];
$date = date("Y-m-d", strtotime("+8 HOURS"));
$conn->query("INSERT INTO `tbltransactions` VALUES('', '$fBookCode', '$fIDNumber', '$book_qty', '$date', 'Borrowed')") or die(mysqli_error());
echo '
<script type = "text/javascript">
alert("Successfully Borrowed");
window.location = "../borrow.php";
</script>
';
}
}
}

Answer 1

Looks like you were trying to access the $row in an incorrect manner. Try this:
$fBookCodeVal = $row['fBookCode'];
$fStatus = $row['fStatus'];
$q_borrow = $con->query("SELECT * FROM `tblbooks` WHERE `fBookCode` = '$fBookCodeVal' and `fStatus` = '$fStatus'") or die(mysqli_error());
Also I noticed that you were not using prepared statements(with binded parameters). It seems as though $row is being populated via a query which of course if a row's fBookCode value contained malicious code then SQL injection could be performed.
Also change:
$status = $q_borrow->fetch_array();
to
$status = $q_borrow->mysqli_fetch_assoc();
and then update:
if($status['status'] == 'Borrowed')