dynamic drop down with php from postgresql database - php

Question

EDIT: CODE CHANGED AND QUESTION UPDATED FOR LATEST ERROR.
I need to populate a dropdown list of book titles from my postgreSQL database using a query such as SELECT title FROM books WHERE ownedBy = [users facebook ID] and then use the selection by the user to display the rest of the information on that book. The page is a facebook app, which is how I'm getting the facebook ID.
This is the relavent section of code so far, mostly created from various answers to similar questions I have found.
<form action="updateform.php" method="post">
<input type="hidden" name="userid" id="userid" value="<?php echo htmlspecialchars($user_id); ?>"
<select name="booktitle" id="booktitle">
<option>Select book</option>
<?php
$db = pg_connect("host=ec2-54-243-190-226.compute-1.amazonaws.com port=5432 dbname=d6fh4g6l0l6gvb user=zmqygfamcyvhsb password=1Apld4ivMXSK8JZ_8yL7FwIuuz sslmode=require options='--client_encoding=UTF8'") or die('Could not connect: ' . pg_last_error());
$sql = pg_query("SELECT title FROM books WHERE ownedby='$user_id'";
while ($row = pg_fetch_assoc($sql)) {
echo '<option value="'.htmlspecialchars($row['title']).'"></option>';}
pg_close($db);
?>
</select>
//other form elements here
</form>
Currently, no drop down box is displaying, and the server log says pg_query() expects parameter 1 to be resource, string given in /app/www/update.php on line 275 and the same error for pg_fetch_assoc
If anyone can help me get the drop down box part to work, that would be great for now, I'll work on figuring the rest out myself once this part is working.

Answer 1

Unescaped quotes inside quotes
This
$sql = pg_query("SELECT title FROM books WHERE ownedby=("$user_id")");
Should be
$sql = pg_query("SELECT title FROM books WHERE ownedby='$user_id'");
Or
$sql = pg_query("SELECT title FROM books WHERE ownedby=\"$user_id\"");

Answer 2

try this:
<form action="updateform.php" method="post">
<select name="bookTitle">
<?php
$db = pg_connect("host=ec2-54-243-190-226.compute-1.amazonaws.com port=5432 dbname=d6fh4g6l0l6gvb user=zmqygfamcyvhsb password=[removed] sslmode=require options='--client_encoding=UTF8'") or die('Could not connect: ' . pg_last_error());
$sql = pg_query(sprintf("SELECT title FROM books WHERE ownedby=%d", $user_id));
while ($row = pg_fetch_assoc($sql)) {
echo '<option value="'.htmlspecialchars($row['title']).'"></option>';
}
pg_close($db);
?>
</select>
Note the use of 'echo' instead of closing the PHP tags.
Also, you should probably use an ID, rather than a title for the option value :)
Regards,
Phil

Answer 3

The line
$sql = pg_query("SELECT title FROM books WHERE ownedby=("$user_id")");
contains an error because the double quotes before $user_id closes the string "SELECT ....
A quick fix is to change "$user_id" with '$user_id' and remove the braces ()
In general it is not a good practice to directly put variables in SQL queries because your code becomes vulnerable to SQL Injection. Consider using prepare, bind and execute statements.

Answer 4

You haven't escaped the quotes on Line 275. It should be
$sql = pg_query("SELECT title FROM books WHERE ownedby=\"$user_id\"");
or
$sql = pg_query('SELECT title FROM books WHERE ownedby="'.$user_id.'"');