How to put PHP while loop inside a HTML option menu? - php

Question

I have downloaded a shopping cart for my site,
It has a PHP file to fill out the basket. the basket will show added items in rows, here is the code :
<?php
define('INCLUDE_CHECK',1);
require "XXXXX/XXXXX.php";
if(!$_POST['img']) die("There is no such product!");
$img=mysql_real_escape_string(end(explode('/',$_POST['img'])));
$row=mysql_fetch_assoc(mysql_query("SELECT * FROM XXXXXX WHERE img='".$img."'"));
$prsize=mysql_fetch_assoc(mysql_query("SELECT * FROM BBBBBB WHERE id='".$row['id']."'"));
echo '{status:1,id:'.$row['id'].',price:'.$row['price'].',txt:\'\
\
<table width="100%" id="table_'.$row['id'].'">\
<tr>\
<td width="60%">'.$row['name'].'</td>\
<td width="10%">$'.$row['price'].'</td>\
<td width="15%"><select name="'.$row['id'].'_cnt" id="'.$row['id'].'_cnt" onchange="change('.$row['id'].');">\
<option value="1">1</option>\
<option value="2">2</option>\
<option value="3">3</option></slect>\
\
</td>\
<td width="15%"><select name="'.$prsize['id'].'_cnt" id="'.$prsize['id'].'_cnt" onchange="change('.$prsize['id'].');">\
I need to put this
while($item = mysqli_fetch_array($result))
{
here to make a dynamic select menu for the size
<option value="'.$prsize['id'].'">'.$prsize['id'].'</option>\
end while
}
\
</td>\
<td width="15%">remove</td>\
</tr>\
</table>\'}';
?>
but I couldn't figure it out how to put the PHP while in there, I have tried to use "" or '' but no luck.
How should I quote the PHP while inside this HTML code?
Thanks

Answer 1

Maybe something like this:
$options = "";
while($item = mysqli_fetch_array($result))
$options .= "<option value=\"$item[id]\">$item[id]</option>\\\n";
and then just use it
echo '{status:1,id:'.$row['id'].',price:'.$row['price'].',txt:\'\
\
<table width="100%" id="table_'.$row['id'].'">\
<tr>\
<td width="60%">'.$row['name'].'</td>\
<td width="10%">$'.$row['price'].'</td>\
<td width="15%"><select name="'.$row['id'].'_cnt" id="'.$row['id'].'_cnt" onchange="change('.$row['id'].');">\
'.$option.'</select>\
...
Or you can simply break your echo in two and put your loop between the calls:
echo '{status:1,id:'.$row['id'].',price:'.$row['price'].',txt:\'\
\
<table width="100%" id="table_'.$row['id'].'">\
<tr>\
<td width="60%">'.$row['name'].'</td>\
<td width="10%">$'.$row['price'].'</td>\
<td width="15%"><select name="'.$row['id'].'_cnt" id="'.$row['id'].'_cnt" onchange="change('.$row['id'].');">\
';
while($item = mysqli_fetch_array($result))
echo "<option value=\"$item[id]\">$item[id]</option>\\\n";
echo '</select>\
\
</td>\
...
Btw, your </select> is missing one "e" (it says </slect>).

Answer 2

My eyes bleed whenever I see PHP and HTML mixed together like that.
There are 6 things that I'd like to highlight in your code:
1) It seems to me like you're trying to build some kind of JSON string with your php, here's my evidence:
echo '{status:1, id:'.$row['id'].'} //The rest of your code
I'd like to make you aware of the command json_encode that transforms a php array into JSON-like string that can be read by JavaScript (just to name one) and manipulated in whatever way you want.
This is the way you use it:
$myJSONobject = json_encode($myarray)
2) mysql_ functions are deprecated
I don't know how many times I have to type this per day, but they are, do not use them anymore. Even if you're reading an outdated tutorial or written by a bad programmer that still use mysql_* functions in 2013.
Deprecated means that those functions can go away at any point in time, if your server updates to a PHP version that no longer has deprecated functions, all your code will be broken and you're going to wonder why.
From now on, you have to use mysqli or PDO
4) Your SQL is vulnerable to SQL Injection
$prsize=mysql_fetch_assoc(mysql_query("SELECT * FROM BBBBBB WHERE id='".$row['id']."'"));
I'm pretty sure you're writing statements like that all over your program, I'm also pretty sure that at some point you're accepting input from the user and making a SQL query like that.
If a malicious user decides to enter 1 OR 1=1 that user is going to execute a SQL statement that he is not supposed to execute, something like:
SELECT * FROM BBBBBB WHERE id = 1 OR 1=1
That could have been prevented if instead of using mysql_* functions you would have used mysqli or PDO
Because those libraries come with prepared statements A prepared statements forces the SQL engine to understand your query BEFORE any data is passed to it. Therefore, if a malicious user tries the good ol' OR 1 = 1, it won't matter because the SQL engine will handle it as any other string, and not as a command.
5) Your code is an ugly mess.
Even if this comment doesn't look like constructive criticism, it actually is, read on to find out why.
The way you're coding this program, makes it hard to maintain. You shouldn't be mixing PHP and HTML together the way you're doing it.
Most of the time you should only echo or return raw data.
If you're markup code, the vast majority of time, you're doing it wrong.
6) Do not use onclick` in HTML anymore, it's TERRIBLE practice. Use Event Listeners instead
Click me
<script type="text/javascript">
var link = document.getElementById("test").
link.addEventListener("click", function() {
link.innerHTML = "Do not click me anymore please";
});
</script>
Back to your question, there's no need to write that mess if you want to mix PHP and HTML, I'm going to show you a cleaner way to output this:
$prsize=mysql_fetch_assoc(mysql_query("SELECT * FROM BBBBBB WHERE id='".$row['id']."'"));?>
{
status:1,
id:<?=$row['id']=?>,
price:<?=$row['price']?>,
txt:
<table width="100%" id="table_<?=$row['id']?>">
<tr>
<td width="60%"><?=$row['name']?></td>
<td width="10%">$<?=$row['price']?></td>
<td width="15%">
<select name="<?=$row['id']?>_cnt" id="<?=$row['id']?>_cnt" onchange="change(<?=$row['id']?>);">
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
</select>
</td>
<td width="15%">
<select name="<?=prsize['id']?>_cnt" id="<?=$prsize['id']?>_cnt" onchange="change(<?=$prsize['id']?>);">
<?php while($item = mysqli_fetch_array($result)): ?>
<option value="<?=$prsize['id']?>"><?=$prsize['id']?></option>
<?php endwhile; ?>
</td>
<td width="15%">
remove
</td>
</tr>
</table>
}
Hope this helps, then again... if you're creating JSON... use JSON_ENCODE

Answer 3

$SQL = "SELECT * from xxx WHERE img = '".mysql_real_escape_string($img)."'";
$result = mysql_query( $SQL );
while( $item = mysql_fetch_array( $result ) ) {
echo '<option value="'.$item['id'].'">'.$item['id'].'</option>';
}