PHP - what is wrong here? - php

Question

I'm making a Car rental system in school and i have run into an issue I cannot fix.
When I have completed my Query to ask for all the cars matching the users search I have a buttun they can click to rent that car and it redirects them to another page. Lets say you want to rent a Ferrari F12 and click on rent. When you get to the other page it says "Rent Opel Corsa" no matter what car i choose. Probably just a silly oversight on my side.
Here is the Search Function
function søk(){
define('DB_HOST', 'db-kurs.hit.no');
define('DB_NAME', 'v15gdb1');
define('DB_USER','v15g1');
define('DB_PASSWORD','pw1');
$con=mysql_connect(DB_HOST,DB_USER,DB_PASSWORD) or die("Kunne ikke koble til MySQL: " . mysql_error());
$db=mysql_select_db(DB_NAME,$con) or die("Kunne ikke koble til MySQL: " . mysql_error());
$sql = mysql_query("SELECT * FROM Biler WHERE Sted= '$_POST[by]' AND Merke = '$_POST[biler]'");
$resultat = $sql;
$mld = "Du har valgt å søke etter en <b>$_POST[biler]</b> i <b>$_POST[by]</b>.";
if ($_POST['by'] == 'Alle'){
$sql = mysql_query("SELECT * FROM Biler WHERE Merke = '$_POST[biler]'");
$resultat = $sql;
$mld = "Du har valgt å søke etter en <b>$_POST[biler]</b> i <b>alle</b> byer.";
}
if ($_POST['biler'] == 'Alle'){
$sql = mysql_query("SELECT * FROM Biler WHERE Sted= '$_POST[by]' ");
$resultat = $sql;
$mld = "Du har valgt å søke etter <b>alle</b> bilene i <b>$_POST[by]</b>.";
}
if ($_POST['by'] == 'Alle' and $_POST['biler'] == 'Alle'){
$sql = mysql_query("SELECT * FROM Biler");
$resultat = $sql;
$mld = "Du har valgt å søke etter <b>alle</b> bilene i <b>alle</b> byene.";
}
echo "<div id='søkmld'>$mld Husk at du må logge inn for å leie en bil.</div>";
while($row = mysql_fetch_array($resultat, MYSQL_ASSOC))
{
$merke = $_SESSION['merke'] = $row['Merke'];
$modell = $_SESSION['modell'] = $row['Modell'];
$reg = $row['RegNr'];
$pris = $row['Dagspris'];
$sted = $row['Sted'];
$status = $row['erLedig'];
$bilde = $row['Bilde'];
$_SESSION['name'] = $merke. " " .$modell;
echo" <div id='bilsøk'>
<div id='biltype'><h3> $merke $modell</div>
<div id='lei'>
<form method='POST' action='leibil.php' name='leibil'>";
if(isset($_SESSION['brukerID'])){
echo"<input type='submit' value='Lei Nå' name='lei $merke $modell'>
</div>
<div id='bilsøktxt'>
<table>
<tr>
<td>RegNr:</td>
<td>$reg</td>
</tr>
<tr>
<td>Pris:</td>
<td>$pris</td>
</tr>
<tr>
<td>Sted:</td>
<td>$sted</td>
</tr>
<tr>
<td>Status:</td>
<td>";
if ($status == 1){
echo'Ledig';}
if ($status == 0){
echo'Utleid';}
echo "</td>
</tr>
</table>
</div>
<div id='søkimg'><center><img src='images/cars/$bilde.jpg'></center></div>
</div>
";
}
}}
And here is the div on the page you are redirected to:
<div id="hoved">
<?php
echo"<h1>Lei $_SESSION[name]</h1>"
?>
<?php
status();
?> <hr/>
</div>
The Status() function is set just so you know.

Answer 1

#dbinns66 is correct, you are inconsistent with your session and post variables and this could cause problems.
Also, a stab in the dark here...
When you do:
while($row = mysql_fetch_array($resultat, MYSQL_ASSOC))
What happens if you have more than 1 row?
Lets say your query returns 2 rows. When you do:
$merke = $_SESSION['merke'] = $row['Merke'];
$modell = $_SESSION['modell'] = $row['Modell'];
...
$_SESSION['name'] = $merke. " " .$modell;
$_SESSION['name'] will always contain the make and model of the car that is in the last row of your query (in this case, row 2).
Anyway...
To fix this, try adding:
...
echo"<input type='submit' value='Lei Nå' name='lei $merke $modell'>
<input type='hidden' value='$merke $modell' name='makeAndModel'>
...
In your redirected page (leibil.php):
<div id="hoved">
<?php
echo"<h1>Lei " . $_POST['makeAndModel'] . "</h1>"
?>
...
Close your form in your first echo statement:
...
<div id='søkimg'><center><img src='images/cars/$bilde.jpg'></center
</div>
</form>
...

Answer 2

For starters, could you try changing
$_SESSION[name]
to
$_SESSION["name"]
Also, I noticed in building your SQL you have clauses like
... Sted= '$_POST[by]' AND ...
Since "by" is the hash key of the value you're looking for, I'd try changing those to be more like
... Sted= '" . $_POST["by"] . "' AND