Unknown column ' ' in 'where clause - php

Question

I have been scouring the stack-overflow site and tried most of the similar questions that had been asked/answered, but unfortunately none of the solutions have worked for me so far. I am trying to have a list that is being populated by an sql database (which is working) and then once selecting the item, hitting the "generate" button and grabbing the data from the table and posting ONLY the selected data into the table. Previously I had an issue where the tables where being populated with ALL the data from the weapons list. After working on it some I have am now getting the error "Unknown column (whichever weapon name I choose) in where clause 107 (which I am assuming is my line number). Any suggestions?
Here is the entirety of the form from populating the list from the database to trying to select the weapon from the list.
<form action="#" method="post">
<table class="table">
<thead>
Martial Weapon Name
</thead>
<tr>
<th>
<select name="Choosen">
<?php
echo'<option>Select Weapon</option>';
//Check if at least one row is found
if($result->num_rows >0){
//Loop through results
while($row = $result->fetch_assoc()){
//Display weapon info
$output = $row['weapon_name'];
echo '<option>'.$output.'</option>';
}
}
?>
</select>
</th>
</tr>
</table>
<input class="btn btn-default" type="submit" name="submit" value="Generate">
<h3>
Weapon
</h3>
<table class="table table-striped">
<tr>
<th>
Weapon Name
</th>
<th>
Weapon Type
</th>
<th>
Damage
</th>
</tr>
<?php
if (isset($_POST['submit'])) {
$selected_weapon = $_POST['Choosen'];
$choose = "SELECT
weapon_types_martial.id,
weapon_types_martial.weapon_name,
weapon_types_martial.weapon_type,
weapon_types_martial.weapon_damage
FROM weapon_types_martial WHERE weapon_types_martial.weapon_name = " . $selected_weapon;
$result = $mysqli->query($choose) or die($mysqli->error . __LINE__);
foreach ($result->fetch_assoc() as $item) {
//Display weapon
$show = '<tr>';
$show .= '<td>' . $item['weapon_name'] . '</td>';
$show .= '<td>' . $item['weapon_type'] . '</td>';
$show .= '<td>' . $item['weapon_damage'] . '</td>';
$show .= '</tr>';
//Echo output
echo $show;
}
}
?>
</table>
</form>
And lastly here is the screenshot of what I am getting

Answer 1

1)You will not get data in $_POST['choosen'] As you haven't pass value in dropdown(select)
2)In your database table may be field weapon_name is varchar so you have to pass it into single quote.
Change your code as below:
<form action="#" method="post">
<table class="table">
<thead>
Martial Weapon Name
</thead>
<tr>
<th>
<select name="Choosen">
<?php
echo '<option>Select Weapon</option>';
//Check if at least one row is found
if($result->num_rows >0){
//Loop through results
while($row = $result->fetch_assoc()){
//Display weapon info
$output = $row['weapon_name'];
echo '<option value="'.$output.'">'.$output.'</option>'; //<--------------change here
}
}
?>
</select>
</th>
</tr>
</table>
<input class="btn btn-default" type="submit" name="submit" value="Generate">
<h3>
Weapon
</h3>
<table class="table table-striped">
<tr>
<th>
Weapon Name
</th>
<th>
Weapon Type
</th>
<th>
Damage
</th>
</tr>
<?php
if (isset($_POST['submit'])) {
$selected_weapon = $_POST['Choosen'];
$choose = "SELECT
id,
weapon_name,
weapon_type,
weapon_damage
FROM weapon_types_martial WHERE weapon_name = '$selected_weapon'"; //<--------------change here
$result = $mysqli->query($choose) or die($mysqli->error . __LINE__);
if ($result->num_rows > 0) {
while($item = $result->fetch_assoc()) {
//Display weapon
$show = '<tr>';
$show .= '<td>' . $item['weapon_name'] . '</td>';
$show .= '<td>' . $item['weapon_type'] . '</td>';
$show .= '<td>' . $item['weapon_damage'] . '</td>';
$show .= '</tr>';
//Echo output
echo $show;
}
}
else
{
echo "No data found";
}
}
?>
</table>
</form>

Answer 2

You need to place quotes in your SQL query.
Try:
$choose = "SELECT
weapon_types_martial.id,
weapon_types_martial.weapon_name,
weapon_types_martial.weapon_type,
weapon_types_martial.weapon_damage
FROM weapon_types_martial WHERE weapon_types_martial.weapon_name = '" . $selected_weapon . "'";
Word of advice, this query is very unsafe. I suggest using a framework or library for database queries.

Answer 3

You need to give value inside single quotes,
$choose = "SELECT
weapon_types_martial.id,
weapon_types_martial.weapon_name,
weapon_types_martial.weapon_type,
weapon_types_martial.weapon_damage
FROM weapon_types_martial
WHERE weapon_types_martial.weapon_name = '" . $selected_weapon ."'";

Answer 4

$choose = "SELECT id, weapon_name, weapon_type, weapon_damage FROM weapon_types_martial WHERE weapon_name = '".$selected_weapon."'";
or
$choose = "SELECT weapon_types_martial.id, weapon_types_martial.weapon_name, weapon_types_martial.weapon_type, weapon_types_martial.weapon_damage FROM weapon_types_martial as weapon_types_martial WHERE weapon_types_martial.weapon_name = '" . $selected_weapon ."'";

Answer 5

The options in your select element don't have a value=.. attribute, meaning that nothing is present in your query.
So $_POST['Choosen'] will = ''.
Not to mention that you're trying to pass a string, so your query will need to be wrapped in ':
$choose = "SELECT id, weapon_name, weapon_type, weapon_damage FROM weapon_types_martial WHERE weapon_name = '".$selected_weapon."'";