Echoing html with php code inside - php

Question

<?php
$sample = 0;
if($sample ==0)
{
$displayinner = '<option value =' . $row['privilege_ID'] . '>' . $row['privilege_name'] . '</option>';
$displayouter = '<td><label>Privileges:</label></td>
<td><select name = "Privilege" id = "Privilege" multiple="multiple">
<?php
$PrivilegeNames = mysql_query("SELECT * FROM privilege");
while($row = mysql_fetch_array($PrivilegeNames))
echo $displayinner;
?>
</select></td>
</tr>
<tr>';
echo $displayouter;
}
?>
I only get a dropdownbox without any data inside it. Please help, what am i doing wrong?

Answer 1

Yeah that won't work - there's a lot of issues, your "template" code will be parsed which will cause errors, and you can't nest <?php blocks like that. To get what you want, try this for starters:
$displayouter = '<td><label>Privileges:</label></td><td><select name = "Privilege" id = "Privilege" multiple="multiple">';
$PrivilegeNames = mysql_query("SELECT * FROM privilege");
while($row = mysql_fetch_array($PrivilegeNames)) {
$displayouter .= '<option value =' . $row['privilege_ID'] . '>' . $row['privilege_name'] . '</option>';
}
$displayouter .= '</select></td></tr><tr>';
echo $displayouter;
If you don't need the variable $displayouter later, you can just echo everything instead, or break out of the PHP block entirely if this is template code. Note the use of .=, which appends data to the existing variable.
There's a lot of possible security holes here, but hopefully this helps to see some working code. Make sure to use htmlspecialchars on all unknown HTML output, for one thing.

Answer 2

<?php
$sample = 0;
if($sample == 0)
{
$displayPre = '<td><label>Privileges:</label></td>
<td><select name = "Privilege" id = "Privilege" multiple="multiple">';
$displayPost = '</select></td>
</tr>
<tr>';
$PrivilegeNames = mysql_query("SELECT * FROM privilege");
echo $displayPre;
while($row = mysql_fetch_array($PrivilegeNames))
echo '<option value =' . $row['privilege_ID'] . '>' . $row['privilege_name'] . '</option>';
echo $displayPost;
}
?>
The inner php tags were not parsed correctly, try the code above, it implements the form with a pre and post part so you don't need to put a new php block inside the string

Answer 3

Wesley Murch is close, but missing a few things: Quotes around the value, and using htmlentities to prevent XSS injection.
$displayouter = '<td><label>Privileges:</label></td><td><select name = "Privilege" id = "Privilege" multiple="multiple">';
$PrivilegeNames = mysql_query("SELECT * FROM privilege");
while($row = mysql_fetch_array($PrivilegeNames)) {
$displayouter .= '<option value="' . htmlentities($row['privilege_ID']) . '">' . htmlentities($row['privilege_name']) . '</option>';
}
$displayouter .= '</select></td></tr><tr>';
echo $displayouter;

Answer 4

I haven't tested syntax, but you have made a few misplacements.
<?php
$sample = 0;
if($sample ==0)
{
$displayinner = '<option value =' . $row['privilege_ID'] . '>' . $row['privilege_name'] . '</option>';
?>
<td><label>Privileges:</label></td>
<td><select name = "Privilege" id = "Privilege" multiple="multiple">
<?php
$PrivilegeNames = mysql_query("SELECT * FROM privilege");
while($row = mysql_fetch_array($PrivilegeNames))
echo $displayinner;
?>
</select></td>
</tr>
<tr>
<?php
}
?>