echo not appearing when selecting a certain value - php

Question

I have a assessment drop down menu below:
<select name="session" id="sessionsDrop">
<option value="All">All</option>
<option value="2">EOWOW</option>
<option value="34">EOWOW</option>
</select>
<select name="student" id="studentsDrop">
<option value="All">All</option>
<option value="23">Jay Hart</option>
<option value="32">Bubba Wright</option>
</select>
Above is a simple drop down menu. I run a query below to get a selected student's details as well as get the selected assessment details. Now the selected assessment outputs the details fine with no problem, But the echo for selected student option does not work as if the user selects the All option, then echo "<p><strong>Students: </strong>All Students - Total:(" .$selstudentnum . ")</p>" . PHP_EOL;. But the problem is that it does not display this echo if the All option is chosen. In fact it does not display an echo at all if the All option is chosen. I tried both === and == bu can't see what I am doing wrong
$selectedsessionqry = "
SELECT
SessionName, SessionDate, SessionTime
FROM
Session
WHERE
(SessionId = ?)
";
global $mysqli;
$selectedsessionstmt=$mysqli->prepare($selectedsessionqry);
// You only need to call bind_param once
$selectedsessionstmt->bind_param("i",$_POST["session"]);
// get result and assign variables (prefix with db)
$selectedsessionstmt->execute();
$selectedsessionstmt->bind_result($selSessionName,$selSessionDate,$selSessionTime);
while ($selectedsessionstmt->fetch()) {
echo "<p><strong>Assessment: </strong>" . $selSessionName . " - " . date('d-m-Y',strtotime($selSessionDate)) . " - " . date('H:i',strtotime($selSessionTime)) . "</p>" . PHP_EOL;
}
$selectedsessionstmt->close();
$selectedstudentqry = "
SELECT
StudentAlias, StudentForename, StudentSurname
FROM
Student
WHERE
(StudentId = ?)
";
global $mysqli;
$selectedstudentstmt=$mysqli->prepare($selectedstudentqry);
// You only need to call bind_param once
$selectedstudentstmt->bind_param("i",$_POST["student"]);
// get result and assign variables (prefix with db)
$selectedstudentstmt->execute();
$selectedstudentstmt->bind_result($selStudentAlias,$selStudentForename,$selStudentSurname);
$selectedstudentstmt->store_result();
$selstudentnum = $selectedstudentstmt->num_rows();
while ($selectedstudentstmt->fetch()) {
if($_POST["student"] === 'All') {
echo "<p><strong>Students: </strong>All Students - Total:(" .$selstudentnum . ")</p>" . PHP_EOL;
}else{
echo "<p><strong>Students: </strong>" . $selStudentAlias . " - " . $selStudentForename . " " . $selStudentSurname . "</p>" . PHP_EOL;
}
}

Answer 1

I think your condition fails here
$selectedstudentstmt->bind_param("i",$_POST["student"]);
Its expecting integer value but you are sending string.
Don't use $_POST directly in your query.It will cause sql injection attack.
Sanitize the user input before use it in sql queries.
Changes:
Add the below conditions before your query. Once again don't forget to sanitize.
if ($_POST["student"] == 'ALL') {
$where = WHERE (StudentId = ?) ";
} else {
$where = "";
}
$selectedstudentqry = " SELECT StudentAlias, StudentForename, StudentSurname FROM Student $where