PHP inputbox to database - php

Question

I am trying to teach myself PHP. I want to know how to interact with a database and insert data from a website and to display the data back into a table on the webpage.
I am trying to let the user edit the results or have them shown in an input box. This way, the user can edit the data and send it back to the database. But, I am stuck. I have tried different ways and none of them seem to work. I'm opened to suggestions.
The bookingid is what the user picks.
I know all table names are not that good but I am learning.
$query = "SELECT * FROM Trip_Booked Where bookingId = $bookingid";
//executes the query
$result = mysqli_query($db,$query);
// create table and display top row
echo "<td>".$row['email']."</td>";
echo "<div align='center'>";
echo "<table cellpadding=2 border=1>";
echo "<tr>";
echo "<td><strong>booking ID</strong></td>";
echo "<td><strong>boatdate</strong></td>";
echo "<td><strong>fromdate</strong></td>";
echo "<td><strong>saleto</strong></td>";
echo "<td><strong>salefrom</strong></td>";
echo "<td><strong>NoOfAdults</strong></td>";
echo "<td><strong>NoOfWheelchair</strong></td>";
echo "<td><strong>NoUnder2</strong></td>";
echo "<td><strong>NoChild3–10</strong></td>";
echo "<td><strong>NoChild11–16</strong></td>";
echo "<td><strong>TotalPassgers</strong></td>";
echo "</tr>";
// print each record one after another
while($row = mysqli_fetch_assoc($result))
{
echo "<tr>";
echo "<td>".$row['bookingId']."</td>";
echo "<td>".$row['boatDate']."</td>";
echo "<td>".$row['fromDate']."</td>";
echo "<td>".$row['saleto']."</td>";
echo "<td>".$row['salefrom']."</td>";
echo "<td>".$row['NoOfAdults']."</td>";
echo "<td>".$row['NoOfWheelchair']."</td>";
echo "<td>".$row['NoUnder2']."</td>";
echo "<td>".$row['NoChild3–10']."</td>";
echo "<td>".$row['NoChild11–16']."</td>";
echo "<td>".$row['TotalPassgers']."</td>";
echo "</tr>";
}
echo "</table>";
echo "</div>";
?>
I would like the result be shown in an input box for the user to edit as it will go in a table and check it is pulling the right information from the database.

Answer 1

A very simplified example; double check mysqli usage because I don't use mysqli...
Things to take note of:
Use prepared statements. period.
A common practice is to do all your script stuff, then output HTML. Don't mix logic with presentation.
Pay attention to whether a variable is GET or POST. The reason I used both GET and POST is because I use GET to display a specific record; but POST is used for anything that changes a record.
I use camelCase for variables but lowercase for #id. Just be aware of it, that can be confusing if you're not aware.
I first check if this is a request to update the record. If it is, do the update, then redirect back to the same page in order to prevent resubmissions. (This is only possible if no output has been sent. See point 2)
Using the <?= ?> format is personal preference; I like it because it keeps the HTML code cleaner and makes the PHP as unobtrusive as possible.
Using <form method='{GET | POST}'> with no action simply sends back to the same URL.
// Create connection
$db = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($db->connect_error) {
die("Connection failed: " . $db->connect_error);
}
// first, take action on POST results if this is an update
if($_POST['action']=='update') {
// use prepared query to avoid SQL injection
$query = "UPDATE Trip_Booked SET boatDate=?, fromDate=?, saleto=?, salefrom=?, NoOfAdults=?, NoOfWheelchair=?, NoUnder2=?, NoChild3_10=?, NoChild11_16=?, TotalPassgers=? WHERE bookingId=?";
$result = $db->prepare($query);
$result->bind_param("ssssiiiiiii", $_POST['boatDate'],$_POST_['fromDate'],$_POST_['saleto'],$_POST_['salefrom'],$_POST_['NoOfAdults'],$_POST_['NoOfWheelchair'],$_POST_['NoUnder2'],$_POST_['NoChild3_10'],$_POST_['NoChild11_16'],$_POST_['TotalPassgers'],$_POST['bookingId']);
$result->execute();
// since we don't want post data resent on back button press, redirect back to this page (change url to match)
header("Location: http://www.example.com/?bookingId=" . $POST['bookingId']);
exit;
}
// if not an update, but we do have the booking ID, find the row using BookingId
// use prepared query to avoid SQL injection
if($_GET['bookingId']) {
$query = "SELECT * FROM Trip_Booked Where bookingId = ?";
$result = $db->prepare($query);
$result->bind_param("s", $_GET['bookingId']);
$result->execute();
}
Now, we have everything we need to output the HTML. Remember, PHP is a templating language, so don't be afraid to use it as such.
<!-- language: lang-html -->
// continuing from above
?><html>
<head>
<title>Edit a Booking</title>
</head>
<body>
<h1>Choose a Page</h1>
<form method="get">
<label for="bookingid">Page</label><input type="text" id="bookingid" name="bookingId" />
<input type="submit" value="Go to page" />
</form>
<?php if($_GET['bookingId']): ?>
<!-- better way to enter values: -->
<!-- <div><label for="fieldname">Label</label><input type="text" id="fieldname" name="fieldname" value="{value}" /></div> -->
<h1>Edit Fields</h1>
<form method="post">
<input type="hidden" name="action" value="update" />
<input type="hidden" name="bookingId" value="<?= htmlentities($_GET['bookingId']) ?>" />
<table>
<thead>
<tr>
<th>bookingId</th>
<th>boatDate</th>
<th>fromDate</th>
<th>saleto</th>
<th>salefrom</th>
<th>NoOfAdults</th>
<th>NoOfWheelchair</th>
<th>NoUnder2</th>
<th>NoChild3_10</th>
<th>NoChild11_16</th>
<th>TotalPassgers</th>
</tr>
</thead>
<tbody>
<!-- since this is an edit of only one record, you could use 'if' instead of 'while' -->
<?php while($row = $result->fetch_object())): ?>
<tr>
<th><input type="text" name="bookingId" value="<?= $row->bookingId ?>" /></th>
<th><input type="text" name="boatDate" value="<?= $row->boatDate ?>" /></th>
<th><input type="text" name="fromDate" value="<?= $row->fromDate ?>" /></th>
<th><input type="text" name="saleto" value="<?= $row->saleto ?>" /></th>
<th><input type="text" name="salefrom" value="<?= $row->salefrom ?>" /></th>
<th><input type="text" name="NoOfAdults" value="<?= $row->NoOfAdults ?>" /></th>
<th><input type="text" name="NoOfWheelchair" value="<?= $row->NoOfWheelchair ?>" /></th>
<th><input type="text" name="NoUnder2" value="<?= $row->NoUnder2 ?>" /></th>
<th><input type="text" name="NoChild3_10" value="<?= $row->NoChild3_10 ?>" /></th>
<th><input type="text" name="NoChild11_16" value="<?= $row->NoChild11_16 ?>" /></th>
<th><input type="text" name="TotalPassgers" value="<?= $row->TotalPassgers ?>" /></th>
</tr>
<?php endwhile; ?>
</tbody>
</table>
<input type="submit" value="Edit" />
</form>
<?php endif; ?>
</body>
</html>

Answer 2

You need to output the data into the input fields you want. Small example:
<input type="hidden" name="bookingId" value="<?php echo $row["bookingId"];?>" />
<input type="text" name="NoOfAdults" value="<?php echo $row["NoOfAdults"];?>" />
Using a form action of POST you can then run the UPDATE query using the $_POST['NoOfAdults'] and using the $_POST['bookingId'] as the WHERE