posting and displaying information on the same php page - php

Question

I'm working on a frequently asked questions, but for administration I want to be able to see the current frequently asked questions that have been stored in the database, and below that a form to post a new question & answer, which upon submitting will refresh the page with the new question and answer.
Here's the thing:
I've gotten it to post just fine, but I can only display the most recent one...
here's my code so far:
Getting:
<?php
//select database table
$sql = "SELECT question, answer FROM faq";
$queryresult = mysql_query($sql) or die (mysql_error());
//Request Values
while ($row = mysql_fetch_array($queryresult)){
$faqQuestion = $row['question'];
$faqAnswer = $row['answer'];
}
//echo variables
echo "<p>$faqQuestion</p>" . "<p>$faqAnswer</p>" . "<br />";
//if question and answer have null values
if ((empty($faqQuestion))&&(empty($faqAnswer))){
echo("<div><p>No Questions available</p></div>");
}
?>
<?php
mysql_free_result($queryresult);
mysql_close($conn);
?>
Posting:
<?php
include("database_conn_dcs.php");
if($_POST){
$question = ($_POST['question'])? $_POST['question']:null;
$answer = ($_POST['answer'])? $_POST['answer']:null;
$sql="INSERT INTO faq (talen_idtalen, question, answer)
VALUES ('$idtalen', '$question', '$answer')";
if (!mysql_query($sql)) {
die('Error: ' . mysql_error());
}
header("location: faq_admin.php");
}
?>
My other issue is that it also posts blank stuff. how do i prevent PHP sending null values to the database (it's already stated the variables are non-null?
Thank you so much in advance!!!

Answer 1

First, your echo should be in the while loop, otherwise each time it loops, your two variables are being overwritten.
Secondly, you only want to display no questions available if no results were returned, which is checked by the mysql_num_rows.
Thirdly, your input code is vulnerable to SQL Injection, which could get your website compromised. To prevent this, use prepared statements, and bind your user input ($_POST variables) instead of including them directly in the query.
<?php
//select database table
$sql = "SELECT question, answer FROM faq";
$queryresult = mysql_query($sql) or die (mysql_error());
//Request Values
while ($row = mysql_fetch_array($queryresult)){
$faqQuestion = $row['question'];
$faqAnswer = $row['answer'];
//echo variables
echo "<p>$faqQuestion</p>" . "<p>$faqAnswer</p>" . "<br />";
}
if(mysql_num_rows($queryresult) <= 0) {
echo("<div><p>No Questions available</p></div>");
}
mysql_free_result($queryresult);
mysql_close($conn);
?>