Parse value of input field to query parameters - php

Question

Can I parse the value of an input field to a query parameter to get the values of a select field within the same form?
The code is following:
<FORM ACTION="login.php" METHOD=get>
<label for="email">Email: </label>
<input id="email" name="email" type="text" ><br>
<label for="pin">Password: </label>
<input id="pin" name="pin" type="password" ><br>
<label for="company">Company</label>
<select name="Company" id="company">
<option>Select Company:</option>
<?php
$conn= new mysqli($servername,$username,$password,$db);
if ($conn->connect_error) {
die("Connection failed: " . $conn->connet_error);
}
$email = isset($_GET['email'])?$_GET['email']:"";
$sql="select company from accounts WHERE email = '$email';";
$results = mysqli_query($conn, $sql);
if ($results->num_rows > 0){
while ($row = mysqli_fetch_array($results)){
echo "<option value=\"company1\">" .$row['company'] . "</option>";
}
}
?>
</select>
<input class="submit_btn" type="submit" value="Login"></input><br>
<a id="cust-nopin" href="javascript:;"><p class="text_centered_pass">Click here if you don't have a password</p></a>
</FORM>
Is that not possible?

Answer 1

In this scenario your best bet would be Ajax.
Your Form Page:
<form action="login.php" method=get>
<label for="email">Email: </label>
<input id="email" name="email" type="text" ><br>
<label for="pin">Password: </label>
<input id="pin" name="pin" type="password" ><br>
<label for="company">Company</label>
<select name="Company" id="company">
<option value="">Select Company:</option>
</select>
<input class="submit_btn" type="submit" value="Login"></input><br>
<a id="cust-nopin" href="javascript:void(0);"><p class="text_centered_pass">Click here if you don't have a password</p></a>
</form>
Now the JQuery Part:
$(function () {
$(document).on("change, blur, keydown", "#email", function () {
$.ajax({
url: 'path/to/ajaxfile.php',
type: 'GET',
dataType: 'json',
data: {email: $(this).val()},
})
.done(function(response) {
if (response.status) {
var html = '<option value="">Select Company:</option>' + response.html;
$("#company").html(html);
} else {
console.log(status.message);
}
})
.fail(function(data) {
alert("Something went wrong please try again later.");
console.log(data.responseText);
});
});
});
And then the path/to/ajaxfile.php:
$conn = new mysqli($servername,$username,$password,$db);
if ($conn->connect_error) {
die("Connection failed: " . $conn->connet_error);
}
if (! empty($_GET['email'])) {
$email = mysqli_real_escape_string($conn, $_GET['email']);
$sql = "SELECT company FROM accounts WHERE email = '$email'";
$results = mysqli_query($conn, $sql);
if ($results->num_rows > 0){
$html = "";
while ($row = mysqli_fetch_array($results)){
$html .= '<option value="' . $row['company'] . '">' . $row['company'] . '</option>';
}
echo json_encode(array("status" => true, "html" => $html));
} else {
echo json_encode(array("status" => false, "message" => "There is no company with that email address."));
}
} else {
echo json_encode(array("status" => false, "message" => "No email is there to lookup."));
}
This should help you achieve what you are trying to do...
I hope it helps.

Answer 2

Yes of course you can use an input field's value as a parameter for your query. It is a very common scenario.
Your query does not work because you have included the $email variable inside single quotes. So this should work:
$sql="select company from accounts WHERE email = $email";
(the semicolon at the end is not needed).
BUT
This way of using user input to query the database is a bad practice as it makes your code vulnerable to SQL Injection.
To safeguard against SQL Injection it is recommended to use Prepared Statements
So you should query the database like this:
$sql="select company from accounts WHERE email = ?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("s", $email);
$stmt->execute();