How to use IF statement on PHP MYSQL query - php

Question

Currently i'm doing my final year project about hotel management system. Now I'm stuck on using IF STATEMENT on PHP MYSQL query. I had create column named roomtype and roomprice under reservation table. The case are like this:
If guest selected single on roomtype, it automatically shown the
price on roomprice. Let say the price was 100.
Then if guest selected superior, the price is 200.
And then if deluxe was selected, the price is 300.
Below are my codes to store to database
$link = mysql_connect('localhost', 'root', '') or die('Could not connect: ' . mysql_error());
mysql_select_db('hotel_reservation3') or die('Could not select database');
// Store query in variable
$query = "INSERT INTO reservation (user_id,fullname,contactno,passport,roomtype,roomprice,num_of_rooms,dor,dco,bookingdate,length_of_stay)
VALUES
(
'".$_SESSION['user_id']."',
'".$_POST['fullname']."',
'".$_POST['contactno']."',
'".$_POST['passport']."',
'".$_POST['roomtype']."',
'".$_POST['num_of_rooms']."',
'".$_POST['dor']."',
'".$_POST['dco']."',
sysdate(),
DATEDIFF(dco,dor)
)";
// Performing SQL query
$result = mysql_query($query)
or die('Query failed: ' . mysql_error());
//echo "Success inserting record!";
// Closing connection
mysql_close($link);
header("Location:reservation.php?success");
I'm using POST method which comes from a form. Below are partial code of the form
<form action="" method="post">
<ul>
<li>
Full name*: <br>
<input type="text" name="fullname">
</li>
<li>
Contact No.: <br>
<input type="text" name="contactno">
</li>
<li>
IC/Passport*: <br>
<input type="text" name="passport">
</li>
<li>
Room Type*: <br>
<select name="roomtype" id="roomtype">
<option value="Single">Single</option>
<option value="Superior">Superior</option>
<option value="Deluxe">Deluxe</option>
</select>
</li>
<li>
Number of Rooms*:</li>
<input type="text" size="3" name="num_of_rooms">
<br>
<li>
Date of reservation*: <br>
<input type="text" size="12" id="dor" name="dor"/>
</li>
<li>
Check-out Date*: <br>
<input type="text" size="12" id= "dco" name="dco"/>
</li>
<input type="submit" value="Submit">
<input type="reset" value="Clear" >
<li>
<br>
<br>
<br>
<br>
<br>
<br>
</ul>
</form>
Does anyone know the code?

Answer 1

As everyone has mentioned, please protect your SQL from injection.
You should calculate your price in PHP.
if($_POST['roomtype'] == "deluxe"){
$roomprice = 300;
}else if($_POST['roomtype'] == "superior"){
$roomprice = 200;
}else{
$roomprice = 100;
}
// Store query in variable
$query = "INSERT INTO reservation (user_id,fullname,contactno,passport,roomtype,roomprice,num_of_rooms,dor,dco,bookingdate,length_of_stay)
VALUES
(
'".$_SESSION['user_id']."',
'".mysql_real_escape_string($_POST['fullname'])."',
'".mysql_real_escape_string($_POST['contactno'])."',
'".mysql_real_escape_string($_POST['passport'])."',
'".mysql_real_escape_string($_POST['roomtype'])."',
$roomprice,
'".mysql_real_escape_string($_POST['num_of_rooms'])."',
'".mysql_real_escape_string($_POST['dor'])."',
'".mysql_real_escape_string($_POST['dco'])."',
NOW(),
DATEDIFF(dco,dor)
)";