Using PHP to declare a page url - php

Question

I am working on a project which allows me to create a customer database. I have made an Create.php and Delete.php but am having issues with the basic structure for an Edit page.
My initial idea is to create a populated drop down box (Which I can do) which on click will take the user to domain.com/Customer.php?Customer_name="JohnD"
I am having a few issues with regards to this as it is doing 2 things.
It is printing out ALL of the data in my table into the echo.
It isn't taking the values from the URL, However I know that I have missed something but am unsure of what I need to search for.
Here is my snippet so far:
<h2>
<?Php
$sql="SELECT id,customer_name FROM Customers";
$result =mysql_query($sql);
while ($data=mysql_fetch_assoc($result)){
?>
<?Php echo $data['customer_name']; } ?>
</h2>
As of yet I am getting this in the header:
John Doe Jimmy Timmy Test
These are all the values inside my rows for the table Customers.
Sorry if the question seems all over the place. I will correct if it is not easy to understand.
Thanks in advance

Answer 1

use this url
domain.com/Customer.php?CID=1
and the code should look like
<?php
$customer_id = (int) $_GET['CID'];
$query = "SELECT id, customer_name FROM Customers
WHERE id = {$customer_id}";
$result = mysql_query($query) or die('<p>' . $query . '</p><div>' .
mysql_error() . '</div>');
$customer = mysql_fetch_assoc($result);
?>
<h2><?php echo $customer['customer_name'] ?></h2>

Answer 2

You need to use $_GET to get the parameters from the URL.
<?php
//customer.php?Customer_name=JohnD (no quotes)
echo $_GET[Customer_name];
?>
You would then use mysqli_ or PDO to bind $_GET[Customer_name] and execute the query. If you don't bind parameters in your SQL query, you will be vulnerable to SQL injection.

Answer 3

You need to restrict the SQL select to the specific customer with a where clause. And you may be getting that customer id from the request. I would suggest that you use customer id rather than name in the drop down box. That way the URL will be:
domain.com/Customer.php?id=1
On the Customer.php page you can get the value using $id = $_GET['id'];
Now as for your SQL you should use some safer method for querying the database say:
$dsn = 'mysql:host=localhost;dbname=mydb';
$username = 'myun';
$password = 'mypw';
$options = array(
PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8',
);
$dbh = new PDO($dsn, $username, $password, $options);
$stmt = $dbh->prepare("select id, Customer_name from customers where id = :id");
$stmt->bindParam(':id', $id);
$stmt->execute();
while($c = $stmt->fetch()){
echo $c['customer_name'];
}
This way only data for the selected customer will be displayed.