foreach ($_POST) - php

Question

So I'm using a multiple checkboxs in a form and query the database with no problems. Now I want to add a dropdown list and combine it with the query with the checkboxs. When I run this I get a
Warning: Invalid argument supplied for foreach()
Here is my form
<form name="search_form" method="post" action="event_list">
<table>
<tr>
<td>Venue</td>
<td><input type="checkbox" name="check_list[]" value="AAC"><label >AAC</label><br />
<input type="checkbox" name="check_list[]" action="" value="AKC" id="check_list[]"/><label >AKC</label><br />
<input type="checkbox" name="check_list[]" action="" value="ASCA"/><label >ASCA</label><br />
<input type="checkbox" name="check_list[]" action="" value="CKE"/><label >CKE</label><br />
<input type="checkbox" name="check_list[]" action="" value="CPE"/><label >CPE</label><br />
<input type="checkbox" name="check_list[]" action="" value="DOCNA"/><label >DOCNA</label><br />
<input type="checkbox" name="check_list[]" value="NADAC"><label >NADAC</label><br />
<input type="checkbox" name="check_list[]" action="" value="TDAA"/><label >TDAA</label><br />
<input type="checkbox" name="check_list[]" action="" value="UKC"/><label >UKC</label><br />
<input type="checkbox" name="check_list[]" action="" value="UKI"/><label >UKI</label><br />
<input type="checkbox" name="check_list[]" action="" value="USDAA"/><label >USDAA</label><br />
</td>
</tr>
<tr>
<td style="text-align: left;">State:</td>
<td style="text-align: left;">
<select name="state" id="state" onChange="setCities();">
<option name="drop_down[]" value="Alabama">Alabama</option>
<option name="drop_down[]" value="Texas">Texas</option>
</select>
</td>
</tr>
<td align="right"><input type="submit" name="submit" value="Submit"></td>
</tr>
</table>
</form>
Here is my PHP
<?php
$options = Array();
$options2 = Array();
foreach ($_POST['check_list'] as $check)
$options[] = 'venue=' . "'$check'";
foreach ($_POST['drop_down'] as $drop)
$options2[] = 'state=' . "'$drop'";
$sql = "SELECT * FROM venue_event_all";
if (count($options))
$sql .= " WHERE " . implode(' OR ', $options);
if (count($options2))
$sql .= " AND " . implode(' OR ', $options2);
$result=mysql_query($sql) or die(mysql_error());
?>

Answer 1

In a <select> input, the value of <option> is sent paired with the name of the select to POST/GET.
Setting a name on the option itself will not do anything. The dropdown value will still go with the name of the select.
You can check it by using this
echo $_POST['state'];
So, use this value to set into your query.
Edit : Obligatory - Please don't use MySQL as it is deprecated and not maintained by PHP any more. Use MySQLi, or PDO. Also, please sanitize your inputs before using them in the query. This is what happens when you don't.

Answer 2

foreach will show you error, if array is empty or is not set, so you need to check it first:
if(isset($_POST[0]) and count($_POST) > 0)
{
foreach...
}

Answer 3

I won't just rant about sql injection but give you a solution.
The only way to have your query safe with sensible amount of code is safeMysql library
(Based on Jeffrey code, not tested, but use in production freely):
<?php
include 'safemysql.class.php';
$db = new SafeMysql();
$options = array();
if (!empty($_POST['check_list'])) {
$options[] = $db->parse('venue IN (?a)', $_POST['check_list']);
}
if (!empty($_POST['drop_down'])) {
$options[] = $db->parse('state IN (?a)', $_POST['drop_down']);
}
$sql = "SELECT * FROM venue_event_all";
if ($options) {
$sql .= " WHERE " . implode(' AND ', $options);
}
$data = $db->getAll($sql);