-2

So when I try to fetch the names of categories from my database which, for example will be "Information & Technology", "Maths & Physics" "Off topic" using this code

    <form method="POST" action="create_sub_cat.php">
    <input type="text" name="sub_cat_name" value="" /><br>
    <input type="text" name="sub_cat_desc" value""/><br>        
    <?
    $get_cats = $dbh->prepare("SELECT * FROM forum_categories");
    $get_cats->execute();

    ?>
    <select name="cat_selection">       
    <?      
    while($cat = $get_cats->fetch(PDO::FETCH_OBJ)) {      
    echo '<option value='.$cat->cat_name.'>'.$cat->cat_name.'</option>';              
    }       
    ?>
    </select>       
    <input type="submit" value="Create Category!" name="create_sub_cat">                
    </form>

And store the category names as $selected_cat = $_POST['cat_selection']; and echo it out it will echo out only the first word, so for example if I select "Information & Technology" it will only echo out "Information" or if I chose "Maths & Physics" it will only echo out "Maths" etc. Here's the full code so that you kinda know what I'm trying to do.

<?php
        if(isset($username) && $user_level == 3) {
        ?>
            <div id="userbar">  
            <div id="announcement">Hello <?php echo '<a href=user.php?id='.$poster_id.'>'.$username.'<a>';?>
            <a href="log_out.php">Log out</a></div>

            </div>

            <div id="menubar">
            <ul id="menu">
            <li ><a href="index.php" >Home</a></li>
            <li ><a href="forum.php" >Forum</a></li>        
            <li ><a href="guides.php" >Guides</a></li>      
            <li ><a href="esports.php">E-Sports</a></li>
            </ul>       
            </div>              

            <form method="POST" action="create_sub_cat.php">
            <input type="text" name="sub_cat_name" value="" /><br>
            <input type="text" name="sub_cat_desc" value""/><br>        
            <?
            $get_cats = $dbh->prepare("SELECT * FROM forum_categories");
            $get_cats->execute();

            ?>
            <select name="cat_selection">       
            <?      
            while($cat = $get_cats->fetch(PDO::FETCH_OBJ)) {        
            echo '<option value='.$cat->cat_name.'>'.$cat->cat_name.'</option>';                
            }       
            ?>
            </select>       
            <input type="submit" value="Create Category!" name="create_sub_cat">                
            </form> 
        <?php
    }
    else {
    die("You don't have the access to this page.");
    }
    $sub_cat_name = $_POST['sub_cat_name'];
    $sub_cat_desc = $_POST['sub_cat_desc'];
    $selected_cat = $_POST['cat_selection'];



    if(isset($_POST['create_sub_cat'])) {
     try{   
              echo $selected_cat;        
            $cat_id = $dbh->prepare("SELECT * FROM forum_categories WHERE cat_name = :cat");
            $cat_id->bindParam(':cat', $selected_cat, PDO::PARAM_STR);
            $cat_id->execute();
            $fetch_cat_id = $cat_id->fetch(PDO::FETCH_OBJ);
            $fetched_cat_id = $fetch_cat_id->id;   

            $create_sub_cat = $dbh->prepare("INSERT INTO forum_sub_categories (cat_id, sub_cat_name, sub_cat_description) VALUES (:cat_id, :sub_cat_name, :sub_cat_desc)");
            $create_sub_cat->bindParam(':cat_id', $fetched_cat_id, PDO::PARAM_INT);
            $create_sub_cat->bindParam(':sub_cat_name', $sub_cat_name, PDO::PARAM_STR);
            $create_sub_cat->bindParam(':sub_cat_desc', $sub_cat_desc, PDO::PARAM_STR);
            $create_sub_cat->execute();
            }catch(PDOException $e){
            echo "An error occured";
            error_log($e->getMessage());
     }
    }
    ?>  
2
  • 1
    Nope. it is not PDO, but your code. It seems you need to learn HTML Oct 28, 2013 at 13:11
  • Look into more detail what exactly is happening. PDO is working just fine. After that, you're outputting the value into HTML, after which it gets submitted as POST data back to the server. That's a long chain in which things can go wrong.
    – deceze
    Oct 28, 2013 at 13:15

1 Answer 1

2

Just use quotation marks for value. Also I recommend the use of htmlspecialchars() (thanks to deceze in 1st comment)

echo '<option value="' . htmlspecialchars($cat->cat_name) . '">'.$cat->cat_name.'</option>';
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.