Populate form from drop down menu with mysql more efficiently - php

Question

Evening everyone, I have a page that updates a mysql table record/row using a form. When you go to page xyz.php there is a drop down list. Upon selecting the artID from the drop down list and hitting submit, a form is displayed. The form is pre-populated using artId and matching to the mysql query that is pulled from at the beginning of the script. The code below works perfectly.
My question however is, can this be down more efficiently? Specifically the pre-populated form. I'm using an if statement to find the index of the array that the 'artId' is nested in. Then using the vars of the indexed array to populate the form. This seams it would be pretty taxing if the sql query is large.
I'm also using 2 foreach constructs for the same data. I'm still working on how to eliminate one of them without botching up the whole form.
Any suggestions or thoughts for a direction to run to are much appreciated as always.
Thanks
JR
$sqllst = "SELECT artId, artName, artSummary, artContent FROM article";
$dba = new PDO($dsn, $usr, $pas);
$dba->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
$getlist = $dba->prepare($sqllst);
$getlist->execute();
$res = $getlist->fetchAll();
if ($_SERVER['REQUEST_METHOD'] != 'POST') {
echo '<form method="post">
<select name="dro">';
foreach ($res as $red){
echo '<option name="dro" value=' . $red['artId'] . '>ID# ' .$red['artId'] . '-' . $red['artName'] . '</option>';
}
echo '</select>
<input type="submit" value="Select Article">
</form>';
} else {
$arrayIndex = $_POST ['dro'];
foreach ($res AS $searchValue) {
if ($searchValue['artId'] == $arrayIndex) {
$name = $searchValue['artName'];
$sumry = $searchValue['artSummary'];
$cont = $searchValue['artContent'];
}
}
echo "<form method=post id=setArticle>
Article Id: <input type=text name=id value=" . $arrayIndex . "><br>
Article Name: <input type=text name=name value=" . $name . "><br>
Article Summary: <input type=text name=sum value=" . $sumry . "><br>
Article Content: <textarea name=content rows=4 cols=10>" . $cont . " </textarea><br>
<input type=submit value=SUBMIT>
</form>";
}

Answer 1

Yours else statement is quite strange. Why there isn't parametrized query ?
Foreach statement is useless if you use something like this:
$sth = $dba->prepare('SELECT artId, artName, artSummary, artContent FROM article WHERE artId = :id');
$sth->bindValue(':id', $_POST ['dro'], PDO::PARAM_INT);
$sth->execute();
Prepare statement to avoid SQL injections.
So now it should looks like that:
$sqllst = "SELECT artId, artName, artSummary, artContent FROM article";
$dba = new PDO($dsn, $usr, $pas);
$dba->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
if ($_SERVER['REQUEST_METHOD'] != 'POST') {
$getlist = $dba->prepare($sqllst);
$getlist->execute();
$res = $getlist->fetchAll();
echo '<form method="post">
<select name="dro">';
foreach ($res as $red){
echo '<option name="dro" value=' . $red['artId'] . '>ID# ' .$red['artId'] . '-' . $red['artName'] . '</option>';
}
echo '</select>
<input type="submit" value="Select Article">
</form>';
} else {
$sth = $dba->prepare('SELECT artId, artName, artSummary, artContent FROM article WHERE artId = :id');
$sth->bindValue(':id', $_POST ['dro'], PDO::PARAM_INT);
$sth->execute();
$result = $sth->fetch(PDO::FETCH_ASSOC);
//Please remember to purify everything which is provided by users
echo "<form method=post id=setArticle>
Article Id: <input type=text name=id value=" . $result['artId']. "><br>
Article Name: <input type=text name=name value=" . $result['artName']. "><br>
Article Summary: <input type=text name=sum value=" . $result['artSummary']. "><br>
Article Content: <textarea name=content rows=4 cols=10>" . $result['artContent']. " </textarea><br>
<input type=submit value=SUBMIT>
</form>";
}
O course the next step is to separate view from controller. It looks very ugly when everything is in one file.