SQL statment not running with the value of a hidden field - php

Question

Peace be to you all, I am working on a "forgotten username" system and my code goes like follows :-
First form :-
`<form action="security.php" method="post">
Please Enter your email address:<br>
<input type="text" name="email" value="<?php $_POST['email']?>">
<input type="submit" value="submit">
</form>`
the php code:
`<?php
$mode_allowed = array('username','password');
if(isset($_GET['mode']) === true && in_array($_GET['mode'],$mode_allowed) === true){
if(isset($_POST['email']) === true && empty($_POST['email']) === false){
if(email_exists($_POST['email']) === true){
header('location:security.php');
}else{
echo "Sorry, we can't find this email";
}
}
}else{
header('location:index.php');
}
?>`
Now the other page:
<form action="security.php" method="POST">
<p> Answer this question <p>
<select type="text" selected="selected" name="security_question" value="<?php $security_question?>">
<option name="security_question" value="<?php $security_question =mysql_query("SELECT `security_question` FROM `users` WHERE `email`='".mysql_real_escape_string($_POST['email'])."' ");
$array = mysql_fetch_array($security_question);
echo $array[0];
?>">
<?php $security_question =mysql_query("SELECT `security_question` FROM `users` WHERE `email`='".mysql_real_escape_string($_POST['email'])."' ");
$array = mysql_fetch_array($security_question);
echo $array[0];
?>
</option> </select> <br>
<input type="text" name="answer"/> <br>
<input type="submit" value="recover"/>
</form>
and its PHP:
<?php
include "session.php";
include "database/db.php";
if(isset($_POST['answer'])){
$answer = $_POST['answer'];
if(!empty($answer)){
$sql = mysql_query("SELECT `username` FROM `users` WHERE `email`='".mysql_real_escape_string($_POST['email'])."' AND `answer`='".mysql_real_escape_string($answer)."'");
if(mysql_num_rows($sql) == 1){
echo"hello";
}else {
echo "no";
}
}else{
echo "<script type='text/javascript'>alert('you must answer this question');</script>";
}
}
?>
I have also included a hidden field for the email:-
<input type="hidden" name="email" value="<?php echo $_POST['email'];?>">
Now, the code works perfectly only when i remove the "email" part from the SQL statement!! what's the mistake here?!

Answer 1

You haven't given the <input> a name attribute, so it will NOT submit with the form.
<input type="hidden" name="email" value="<?php echo $_POST['email'];?>"></input>
^ ^^^^^^^^^^^---missing ^^^^^^^^--illegal html
Your HTML is fundamentally broken...

Answer 2

try to echo email within isset
echo $email=mysql_real_escape_string($_POST['email']);
if here $email is not empty then use it simply
$sql = mysql_query("SELECT `username` FROM `users` WHERE `email`='$email' AND `answer`='".mysql_real_escape_string($answer)."'");
may this help to resolve....