I'm following through a tutorial from a book I have but want to add some extra columns to a table. I have added the columns, buy and sell, and in each of those I want to display a button. I am unsure of how to do this, is it possible?
Here's my code from the page with the table:
<?php // Example 21-9: members.php
include_once 'header.php';
if (!$loggedin) die();
echo "<div class='main'>";
$con=mysqli_connect("localhost","root","usbw","stocktrading");
// Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$result = mysqli_query($con,"SELECT * FROM stocks");
echo "<table border='1 '>
<tr>
<th>ID</th>
<th>Name</th>
<th>Price</th>
<th>Buy</th>
<th>Sell</th>
</tr>";
while($row = mysqli_fetch_array($result)) {
echo "<tr>";
echo "<td>" . $row['id'] . "</td>";
echo "<td>" . $row['name'] . "</td>";
echo "<td>" . $row['price'] . "</td>";
echo "</tr>";
}
echo "</table>";
mysqli_close($con);
?>
echo "<tr>";
echo "<td>" . $row['id'] . "</td>";
echo "<td>" . $row['name'] . "</td>";
echo "<td>" . $row['price'] . "</td>";
echo "<td><input type='radio' name='buysell' value='buy'></td>";
echo "<td><input type='radio' name='buysell' value='sell'></td>";
echo "</tr>";
Something like this will add radio buttons. Use checkboxes or another kind of button if you prefer.
I know that you must be a new programmer, but there's some cool things that you can use for avoid string concatenation. String concatenation sometimes can make your code messy and unreadable, and it's not cool.
You can use HEREDOC for avoid concatenation(please, avoid concatenation). Also, when using HEREDOC or double quotes " you can use {} to access array keys or object attributes.
i.e with HEREDOC:
// Guys, look, it's a HEREDOC, it make the HTML more readable :)
$html = <<<EOF
<tr>
<td>{$row['id']}</td>
<td>{$row['name']}</td>
<td>{$row['price']}</td>
<td><button>Sell</button><td>
<td><button>Buy</button><td>
</tr>
EOF;
i.e with double quotes ":
$html = "<tr>
<td>{$row['id']}</td>
<td>{$row['name']}</td>
<td>{$row['price']}</td>
<td><button>Sell</button><td>
<td><button>Buy</button><td>
</tr>";
But, if i need to call some functions?
sprintf or printf can be the solution
spritnf: returns a string produced according to the formatting string format.
printf: prints a string produced according to the formatting string format.
i.e:
$str = sprintf("My name is <b>%s</b>", ucfirst("i am not procrastinating"));
echo $str;
//OR
printf("My name is <b>%s</b>", ucfirst("i am not procrastinating"));
Or using an template way(may be hard) using str_replace, array_keys and array_values.
$template = "My name is <b>:name:</b>, i'm from :from:.";
$templateVars = array(
":name:" => "I am not procrastinating",
":from:" => "Brazil"
);
echo str_replace(array_keys($templateVars),array_values($templateVars),$template);
Happy Coding.
Sorry for the English, but i'm Brazilian, and we don't speak English, not even Spanish haha.
just add the button inside the td
echo "<tr>".
"<td>" . $row['id'] . "</td>" .
"<td>" . $row['name'] . "</td>" .
"<td>" . $row['price'] . "</td>" .
'<td><button>Sell</button><td>' .
'<td><button>Buy</button><td>' .
"</tr>";
Related
Here is a little demonstration of what I want achieved.
What I want, is a clickable row with additional information fetched from the database.
I've seen some examples with Jquery, but those have some kind of static information in the expanded area. I want to load in this additional information, only after the row is clicked - so I wont have to load in too much information that might not be used.
Now, inside the expanded area, I need the additional information to be fetched like:
while($row = mysql_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['manufacturer'] . "</td>";
echo "<td>" . $row['describtion'] . "</td>";
echo "<td>" . $row['rdate'] . "</td>";
echo "<td>" . $row['locked'] . "</td>";
echo "</tr>";
}
But only if a specific row is clicked.
<?php
$con = mysql_connect("localhost","root","");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("phone", $con);
$result = mysql_query("SELECT * FROM info");
echo "<table border='1'>
<tr>
<th>Model</th>
<th>Software</th>
<th>Carrier</th>
<th>Price</th>
</tr>";
while($row = mysql_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['model'] . "</td>";
echo "<td>" . $row['os'] . "</td>";
echo "<td>" . $row['carrier'] . "</td>";
echo "<td>" . $row['price'] . "</td>";
echo "</tr>";
}
echo "</table>";
mysql_close($con);
?>
I have really done extensive searching, but that didn't get me closer to a solution.
Would it be better if I added HTML to the code, and somehow fetched the data inside the td tags?
I ended up using Datagrid.
It has the exact functionality I was looking for, and alot of tutorials to get you started.
http://www.jeasyui.com/tutorial/datagrid/datagrid21.php
I have no idea how to explain myself which is why the question isn't even a question. I need to have a table dynamically created from data on mysql (which I've done) but I need to be able to have input in the cells under some of the headings (responsibility, organization, independent work...) When this data is submitted, I need it to be student specific. In other words, when I pull up Johnny Rotten's data, I need to be able to see all the comments under those headings that were submitted (yes this is for teaching). The number of students can vary which is why i need the whole thing to be dynamic. If this is not possible, please let me know. AND if you haven't figured it out already, I am brand new and self-taught!
Here's what I have...
<?php
include 'connect.php';
if ($db_found) {
$SQL = "SELECT * FROM studentlist WHERE teacher1='smith' OR teacher2 ='smith' OR
teacher3='smith' ORDER by homeroom";
$result = mysql_query($SQL);
echo "<table border='1'>
<tr>
<th>Student</th>
<th>Homeroom</th>
<th>Responsibility</th>
<th>Organization</th>
<th>Independent Work</th>
<th>Collaboration</th>
<th>Initiative</th>
<th>Self Regulation</th>
</tr>";
while ($row = mysql_fetch_array($result)) {
echo "<tr>";
echo "<td>" . $row['student'] . "</td>";
echo "<td>" . $row['homeroom'] . "</td>";
echo "<td>" . "" . "</td>";
echo "<td>" . "" . "</td>";
echo "<td>" . "" . "</td>";
echo "<td>" . "" . "</td>";
echo "<td>" . "" . "</td>";
echo "<td>" . "" . "</td>";
echo "</tr>";
}
echo "</table>";
}
mysql_close($connect);
?>
I'm still quite new to this and have come across a problem I have been looking through a lot of tutorials and cannot figure a way to get over the problem.
I have a select query getting data out of my sql database however I need the data to be custom for each user who accesses it, so need to add a further query, I have a cookie read in with the user value '$user' and there is a collumn in the database that isnt put into the table however need to check that if the collumn 'privacy' has a value set as '1' and the $user is not the investigator of that row discard and do not put into the table. however populate with all data that isn't set to privacy='1' or is set to privacy=1 and the investigator='$user'
$sql="SELECT * FROM evidence WHERE $evidencevariable = '".$evidencespecify."'";
$result = mysql_query($sql);
if($result === FALSE) {
die(mysql_error());}
echo "<table class='sortable' border='1' id='table'>
<thead><tr>
<th>Id</th>
<th>Case Id</th>
<th>Investigator</th>
<th>Evidence Type</th>
<th>Created</th>
<th>Modified</th>
<th>LS</th>
<th>PS</th>
<th>Length</th>
<th>Importance</th>
<th>Information</th>
</tr></thead><tbody>";
while($row = mysql_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['Id'] . "</td>";
echo "<td>" . $row['Case_ID'] . "</td>";
echo "<td>" . $row['Investigator'] . "</td>";
echo "<td>" . $row['Evidence_Type'] . "</td>";
echo "<td>" . $row['Created'] . "</td>";
echo "<td>" . $row['Modified'] . "</td>";
echo "<td>" . $row['LS'] . "</td>";
echo "<td>" . $row['PS'] . "</td>";
echo "<td>" . $row['Length'] . "</td>";
echo "<td>" . $row['Importance'] . "</td>";
echo "<td>" . $row['Information'] . "</td>";
echo "</tr>";
}
echo "</tbody></table>";
How can I get around this problem do I need to add more to the select statement at the beginning or is there a way of querying the array to remove the data before its put into the table?
Any help would be appreciated!
It seems you can easily modify the sql to something like:
$sql="SELECT * FROM user WHERE $evidencevariable='$evidencespecifiy' AND (Privacy=0 or (Privacy=1 AND investigator='$user'))";
echo '<td><input type="checkbox" name="items[]" value="' . $row['0'] . '" /></td>';
Hi, I'm trying to get a reference number which comes from a an array called items from another page as shown above, and to find it in the table and print out the reference row, like "Title,Platform...." into another table, but I can't seem to get it working...any help be appreciated
if (isset($_POST['items'])) {
$n = count($_POST['items']);
for($i=0; $i < $n; $i++){
// echo $_POST['items'][$i];
}
$items = array();
foreach ($_POST['items'] as $item) {
$items[] = pg_escape_string($con, $item);
}
if (!$_SESSION["selectingrows"]) {
$item_string = "'" . implode("','", $items) . "'";
$result = pg_query ($con, "SELECT title, platform, description, price FROM CSGames WHERE 'refnumber' IN ($item_string)");
while($rows = pg_fetch_assoc($result))
{
echo "<tr>";
echo "<td>" . $rows['1'] . "</td>";
echo "<td>" . $rows['2'] . "</td>";
echo "<td>" . $rows['3'] . "</td>";
echo "<td>" . $rows['4'] . "</td>";
echo "</tr>";
}
}
}
One thing, you need to put {} braces after your while loop.
Here is what you are doing:
while($rows = pg_fetch_assoc($result))
echo"<tr>"; echo "<td>" . $rows['1'] . "</td>"; echo "<td>" . $rows['2'] . "</td>"; echo "<td>" . $rows['3'] . "</td>"; echo "<td>" . $rows['4'] . "</td>";
echo"</tr>";
By not putting braces around the code after the while statement, here is what your code really does:
while($rows = pg_fetch_assoc($result))
{
echo"<tr>";
}
echo "<td>" . $rows['1'] . "</td>"; echo "<td>" . $rows['2'] . "</td>"; echo "<td>" . $rows['3'] . "</td>"; echo "<td>" . $rows['4'] . "</td>";
echo"</tr>";
You should always put braces in to define what code is in the while loop.
You want your code to be something like this:
while($rows = pg_fetch_assoc($result))
{
echo "<tr>";
echo "<td>" . $rows['1'] . "</td>";
echo "<td>" . $rows['2'] . "</td>";
echo "<td>" . $rows['3'] . "</td>";
echo "<td>" . $rows['4'] . "</td>";
echo "</tr>";
}
Format your code neatly and properly. By doing this your code is clearer and it is much easier to notice possible mistakes like the above. Always use braces for if, while, for statements. When putting an end line semicolon ; put in a new line break. Indent your code correctly. It's little things like formatting that make coding easier.
Now the next problem I can see is the values you are getting from the $rows array:
$rows['1'];
$rows['2'];
$rows['3'];
$rows['4'];
This is trying to get something from the $rows array which has the key of string '1'.
Usually you access array values by index, which uses an integer beggining from 0. Or you access it by a key.
Either you can try this:
$rows[0];
$rows[1];
$rows[2];
$rows[3];
Or this:
$rows['title'];
$rows['platform'];
$rows['description'];
$rows['price'];
Another (basic) question here. I need to know how to use html forms to filter the results of a mysql query using PHP. I have been looking at w3schools and I can see how using $_POST on one page can output to another page. But I cannot see exactly how to put the $_POST into my query. For example I have one page as below:
<form action="orderlist.php" method="post">
OrderNo: <input type="int" name="order_no" />
<input type="Submit" />
</form>
This is a page where the user can enter an order_no and click submit, which links to the 'orderslist.php' page. On that page I have the following code:
$result = mysql_query("SELECT * FROM orders");
echo "<table border='5'>
<tr>
<th>order_no</th>
<th>ord_date</th>
<th>est_completion_date</th>
<th>status</th>
<th>invoice_date</th>
<th>inv_amount</th>
<th>name</th>
<th>fName</th>
<th>lName</th>
</tr>";
// -- Use 'while' to check each row in $result in turn:
while($row = mysql_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['order_no'] . "</td>";
echo "<td>" . $row['ord_date'] . "</td>";
echo "<td>" . $row['est_completion_date'] . "</td>";
echo "<td>" . $row['status'] . "</td>";
echo "<td>" . $row['invoice_date'] . "</td>";
echo "<td>" . $row['inv_amount'] . "</td>";
echo "<td>" . $row['name'] . "</td>";
echo "<td>" . $row['fName'] . "</td>";
echo "<td>" . $row['lName'] . "</td>";
echo "</tr>";
}
echo "</table>";
This outputs everything from 'orders' into a table, but I want it to only output the row with the order_no that the user entered on the previous page. How do I do this? Is it something like:
$result = mysql_query("SELECT * FROM orders WHERE order_no = $_POST[order_no]");
Thank a lot
For starters, you should switch to PDO or mysqli -- the mysql_* functions are in the process of deprecation.
On to your question: yes, that's how you do it, with a WHERE clause. However, it is very (very very very) insecure to concatenate a variable directly out of $_POST without sanitation.
That said, at a minimum you should do this:
mysql_query('SELECT * FROM orders WHERE order_no = '.mysql_real_escape_string($_POST[order_no]));
Another thing... don't use SELECT *. You should always list the columns you expect to get from the database -- that way, if there is a problem (like the columns have changed), the query can let you know. With SELECT * you get back a magical grab-bag of data -- you have no idea what it is, and more importantly, if it has the values your code relies on.
So, putting it together:
$pdo = new PDO("mysql:host=localhost;dbname=database", '-username-', '-password-');
$sth = $pdo->prepare('
SELECT
`order_no`,
`ord_date`,
`est_completion_date`,
`status`,
`invoice_date`,
`inv_amount`,
`name`,
`fName`,
`lName`
FROM
orders
WHERE
order_no = :order_no
');
$sth->execute(array(':order_no'=>$_POST[order_no]));
while ($order= $sth->fetch()) {
echo "<tr>";
echo "<td>" . $order->order_no . "</td>";
echo "<td>" . $order->ord_date . "</td>";
echo "<td>" . $order->est_completion_date . "</td>";
echo "<td>" . $order->status . "</td>";
echo "<td>" . $order->invoice_date . "</td>";
echo "<td>" . $order->inv_amount . "</td>";
echo "<td>" . $order->name . "</td>";
echo "<td>" . $order->fName . "</td>";
echo "<td>" . $order->lName . "</td>";
echo "</tr>";
}
Edit: One last note, the input you're using is not valid; type="int" is not a recognized input type. Here's a list of types for HTML 4, and a list for HTML 5:
As you can see, HTML 5 does have a new input type "number". It is not fully adopted, but if you wanted to use it:
<input type="number" name="order_no" />
Be aware, however, that not all browsers will restrict the input to numeric: http://caniuse.com/#feat=input-number
Documentation
mySql SELECT - http://dev.mysql.com/doc/refman/5.0/en/select.html
mysql_query (DEPRECATED) - http://php.net/manual/en/function.mysql-query.php
PDO - http://www.php.net/manual/en/book.pdo.php
PDO::prepare - http://www.php.net/manual/en/pdo.prepare.php
PDOStatement::fetch - http://www.php.net/manual/en/pdostatement.fetch.php
PDOStatement::execute - http://www.php.net/manual/en/pdostatement.execute.php
Without injection vulnerability (require 'mysql_connect' before) :
if(isset($_POST['order_no']))
{
$orderNo = mysql_real_escape_string($_POST['order_no']);
$result = mysql_query("SELECT * FROM orders WHERE order_no = $orderNo");
echo "<table border='5'>";
echo " <tr>";
echo " <th>order_no</th>";
echo " <th>ord_date</th>";
echo " <th>est_completion_date</th>";
echo " <th>status</th>";
echo " <th>invoice_date</th>";
echo " <th>inv_amount</th>";
echo " <th>name</th>";
echo " <th>fName</th>";
echo " <th>lName</th>";
echo " </tr>";
if(mysql_num_rows($result) == 0)
{
echo '<tr><td colspan="9">Order not found</td></tr>';
}
else
{
while($row = mysql_fetch_assoc($result))
{
echo "<tr>";
echo " <td>" . $row['order_no'] . "</td>";
echo " <td>" . $row['ord_date'] . "</td>";
echo " <td>" . $row['est_completion_date'] . "</td>";
echo " <td>" . $row['status'] . "</td>";
echo " <td>" . $row['invoice_date'] . "</td>";
echo " <td>" . $row['inv_amount'] . "</td>";
echo " <td>" . $row['name'] . "</td>";
echo " <td>" . $row['fName'] . "</td>";
echo " <td>" . $row['lName'] . "</td>";
echo "</tr>";
}
}
echo "</table>";
}
Try this:
$orderNumber = mysql_real_escape_string($_POST['order_no']);
$result = mysql_query("SELECT * FROM orders WHERE order_no = $orderNumber");
This takes the value of $_POST['order_no'] and somewhat sanitizes it. You then apply the value of $orderNumber to MySQL.
However, you're much better off using PDO or MySQLi. Both protect you (if used correctly) from SQL injection. Currenly, your code is VERY prone to SQL injection.
Your form should be something like this:
<form action="orderlist.php" method="post">
OrderNo: <input type="text" name="order_no" />
<input type="Submit" value="Submit"/>
</form>
To get any value that is typed by user in the form you should use type="text".
There is nothing like type="int" in standard HTML.
Don't get confused, the Input TYPE in HTML is not the same as one you use in Programming languages to declare Data type. Here TYPE is just to let the browser know that its a text field / Radio Button etc.
To understand Valid Input Types better read this w3.org recommendation on HTML forms.
On orderlist.php you can query to retrieve the required data:
if(isset($_POST['order_no'])) {
$orderNo = mysql_real_escape_string($_POST['order_no']);
$result = mysql_query("SELECT * FROM orders WHERE order_no = $orderNo");
while($row = mysql_fetch_array($result)) {
//code to print table.
}
}
Note:
This type of code is Vulnerable to easy attacks, and it is never recommended to put user input directly into SQL query, it should always be filtered first.