Selecting and Displaying mysql data through hidden form - php

Question

I'm having trouble displaying my selected data through MYsql. I have values already stored in the fields in my database and when the user clicks the submit button and the review of the selected movie should populate but its not.
Here is my code for the form in php.
echo "<tr><td>".$utitle."</td><td>".$ucategory."</td><td>".$ulength."</td><td>Thumbs up</td>t<td></td>";
echo '<form action = "videos.php" method="POST">';
echo "<td><input type='hidden' name='read' value=".$uid."><input type='submit' value='Read the Review' name='read'></td></tr></form>";
And here is my code when the button is clicked.
if(isset($_POST['read'])){
$readReview = "SELECT Review FROM MyVideos WHERE id='$_POST[read]'";
$read = $con->query($readReview);
if($read->num_rows>0){
while($row=$read->fetch_assoc()){
echo "Review:".$row['Review']."<br/>";
}
}
$read->close();
};
Thanks. Any help is greatly appreciated.

Answer 1

Putting my comment to an answer.
Both your hidden input and submit button bear the same name attribute. I'd call that a conflict. Plus, it's discarding the first attribute, being the hidden one.
Also, your present code is open to SQL injection. Use prepared statements, or PDO with prepared statements, they're much safer.
$id = mysqli_real_escape_string($con, $_POST['read']);
$readReview = "SELECT Review FROM MyVideos WHERE id='id'";
Sidenote: $_POST['read'] will need to be changed to the name attribute you'd of given to the hidden input.
Yet, prepared statements are the way to go here.
Remember to rename your hidden input to something else of your choice.
Add error reporting to the top of your file(s) which will help find errors.
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
// rest of your code
Sidenote: Error reporting should only be done in staging, and never production.
References:
http://php.net/manual/en/mysqli.real-escape-string.php
http://php.net/manual/en/function.error-reporting.php
Object oriented style
string mysqli::escape_string ( string $escapestr )
string mysqli::real_escape_string ( string $escapestr )
Procedural style
string mysqli_real_escape_string ( mysqli $link , string $escapestr )

Answer 2

In the code, this line:
$readReview = "SELECT Review FROM MyVideos WHERE id='$_POST[read]'";
the single quotes are missing around read. The single quotes appear as we expect them here:
if(isset($_POST['read'])){
^ ^
But beyond adding single quotes, the code is vulnerable to SQL Injection.
Use prepared statement with bind placeholder. Assuming that id column in MyVideos is character type:
if(isset($_POST['read'])){
$readReview = 'SELECT Review FROM MyVideos WHERE id=?';
$sth=$con->prepare($readReview);
$sth->bind_param('s',$_POST['read']);
$sth->execute();
$sth->bind_result($review);
while($sth->fetch()){
echo "Review:".htmlentities($review)."<br/>";
}
$sth->close();
}
To make the pattern more clear, the code example above doesn't check the return from the prepare or execute. We'd really want to check if the return from prepare is FALSE, we don't want to call bind_param or execute on that.
If id column is integer type, then replace 's' with 'i' (as the first argument in the bind_param.
The use of htmlentities assumes that the contents of the Review column does not contain any HTML markup that should not be escaped/encoded.

Answer 3

submit and hidden field is same (not sure check it by changing)
change query:-
$readReview = "SELECT Review FROM MyVideos WHERE id='". $_POST[read] . "'"; // If id is varchar type or
$readReview = "SELECT Review FROM MyVideos WHERE id=$_POST[read]"; // If numric type