PHP MySQL: User selects the fields to create mysql query array variable - php

Question

here's my problem:
I have a form in which user inputs 3 things (ID key, Date from and Date To) and also from a group o checkboxes he chooses which columns he wants to see in the result. (the form is way to big because its database table has about 15 columns each, so I don't post it here)
here is the (part of the) code which handles these inputs and generates the query. (I'll explain after it what exactly does)
<?php
//Check the columns that should be shown in the table
if(empty($_POST['vesselcolumns']) && empty($_POST['expeditioncolumns'])){
$columns='*';
}else if (isset($_POST['vesselcolumns']) || isset($_POST['expeditioncolumns'])) {
if (empty($_POST['vesselcolumns'])){
$columns='';
}else{
$vesselcolumns= implode(',', $_POST['vesselcolumns']);
$columns=$vesselcolumns;
}
if (empty($_POST['expeditioncolumns'])){
$columns.='';
}else{
$expeditioncolumns = implode(',', $_POST['expeditioncolumns']);
if($columns!=''){
$columns.=','.$expeditioncolumns;
}
}
}
//AMAS check
if(empty($_POST['searchv'])){
echo 'No AMAS given, will print ALL expedition data<br />';
}else{
$amas = $_POST['searchv'];
}
//Deploy Date FROM and TO check
if(empty($_POST['deploydatefrom'])){
$datefrom = '0000-00-00';
}else{
$datefrom = $_POST['deploydatefrom'];
}
if(empty($_POST['deploydateto'])){
$dateto = '9999-12-31';
}else{
$dateto = $_POST['deploydateto'];
}
if(isset($amas)){
$expeditionq="SELECT '$columns'
FROM vessel
INNER JOIN vessel_expeditions
ON vessel.AMAS=vessel_expeditions.vexpedition_AMAS AND vessel.AMAS= '$amas'
INNER JOIN expedition
ON vessel_expeditions.expedition_ID=expedition.expedition_ID
WHERE expedition.deployDate >= '$datefrom' AND expedition.deployDate <= '$dateto'";
$result=mysqli_query($con,$expeditionq);
if($columns=='*'){
$takefields=mysqli_query($con, "SHOW COLUMNS FROM vessel");
while ($vcol = mysqli_fetch_array($takefields)){
$vcolu= array( $vcol['Field']);
}
$takefieldse=mysqli_query($con, "SHOW COLUMNS FROM expedition");
while ($ecol = mysqli_fetch_array($takefieldse)){
$ecolu= array($ecol['Field']);
}
$vccounter = count($vcolu);
$eccounter = count($ecolu);
while($row = mysqli_fetch_array($result)){
for($i=0; $i<$vccounter; $i++){
echo $row[$vcolu[$i]] . '<br />';
}
for($i=0; $i<$eccounter; $i++){
echo $row[$ecolu[$i]] . '<br />';
}
}
}else{
$column = explode(',', $columns);
$counter = count($column);
$forexport='<table id="results">
<tr>';
for($i=0; $i<$counter; $i++){
$forexport .= '<th>' . $column[$i] . '</th>';
}
$forexport.='</tr>';
while($row = mysqli_fetch_array($result)){
for($i=0; $i<=$counter; $i++){
$forexport .= '<td>' . $row[$column[$i]] . '</td>';
}
$forexport.='</tr>';
}
$forexport .='</table>';
echo $forexport;
echo '<form name="exportanalysis" method="post" action="exportanalysis.php">
<input type="hidden" name="export" value="' . htmlspecialchars($forexport, ENT_QUOTES) . '" />
<label for="selectcsv"><img src="img/csv-icon.png" width="50" height="50" /> </label>
<input type="radio" name="filexport" value="csv" id="selectcsv" required />
<label for="selectxls"><img src="img/xls-icon.png" width="50" height="50" /> </label>
<input type="radio" name="filexport" value="xls" id="selectxls" />
<input type="submit" value="Download" />';
}
}else{
echo 'amas not set';
}
?>
First I check which columns has user selected (if none selected I put "*") and I break them in an array with implode (as from the checkboxes they come in string like this: column1,column2,column4, etc.).
Then I check the AMAS (which is the ID key user inputs) and finally I check the dates if given [strange thing here when I submitted the form without date values with isset() even though there was no value in them it kept passing the if(as they were set) so I changed it to empty()].
After multiple tests I've found out that the query ($expeditionq) works fine (I even tested it in MySQL directly). Also the "SHOW COLUMNS" queries work fine and I fetch their results and showed them.
The problem comes when I'm trying to show the results of the $expeditionq query and I assume that the problem is this: $row[$column[$i]] but I cannot figure out another way to do it :/

Answer 1

Puh. Sorry this code looks weired. Is this what you want to express:
if(!empty($_POST['vesselcolumns']) && !empty($_POST['expeditioncolumns'])){
$columns= implode(',', $_POST['vesselcolumns']) . ',' . implode(',', $_POST['expeditioncolumns']);
}
else if(!empty($_POST['vesselcolumns'])) {
$columns= implode(',', $_POST['vesselcolumns']);
}
else if(!empty($_POST['expeditioncolumns'])) {
$columns= implode(',', $_POST['expeditioncolumns'])
}
else {
$columns='*';
}
Anyway, the problem is just obvious:
SHOW COLUMNS will return all columns in that table.
You iterating over the result, which contains only the columns the user selected.
So you are trying to access alphanumeric indexes or "keys" within the row that dont exist unless the user has requested to show all columns.
EDIT: Sorry, this was an incomplete reading due to the unstructured way the source is organized. The query SHOW COLUMNS is only executed, when $columns == "*", so all fields are selected obviously.