echo not appearing when selecting a certain value

Question

I have a assessment drop down menu below:

<select name="session" id="sessionsDrop">
<option value="All">All</option>
<option value="2">EOWOW</option>
<option value="34">EOWOW</option>
</select>  


 <select name="student" id="studentsDrop">
    <option value="All">All</option>
    <option value="23">Jay Hart</option>
    <option value="32">Bubba Wright</option>
    </select>

Above is a simple drop down menu. I run a query below to get a selected student's details as well as get the selected assessment details. Now the selected assessment outputs the details fine with no problem, But the echo for selected student option does not work as if the user selects the All option, then echo "<p><strong>Students: </strong>All Students - Total:(" .$selstudentnum . ")</p>" . PHP_EOL;. But the problem is that it does not display this echo if the All option is chosen. In fact it does not display an echo at all if the All option is chosen. I tried both === and == bu can't see what I am doing wrong

$selectedsessionqry = "
SELECT
SessionName, SessionDate, SessionTime
FROM
Session
WHERE
(SessionId = ?)
";

global $mysqli;
$selectedsessionstmt=$mysqli->prepare($selectedsessionqry);
// You only need to call bind_param once
$selectedsessionstmt->bind_param("i",$_POST["session"]);
// get result and assign variables (prefix with db)
$selectedsessionstmt->execute(); 
$selectedsessionstmt->bind_result($selSessionName,$selSessionDate,$selSessionTime);

 while ($selectedsessionstmt->fetch()) {

     echo "<p><strong>Assessment: </strong>" . $selSessionName . " - " . date('d-m-Y',strtotime($selSessionDate)) . " - " . date('H:i',strtotime($selSessionTime)) . "</p>" . PHP_EOL;

 }


$selectedsessionstmt->close();   

    $selectedstudentqry = "
        SELECT
        StudentAlias, StudentForename, StudentSurname
        FROM
        Student
        WHERE
        (StudentId = ?)
        ";

        global $mysqli;
        $selectedstudentstmt=$mysqli->prepare($selectedstudentqry);
        // You only need to call bind_param once
        $selectedstudentstmt->bind_param("i",$_POST["student"]);
        // get result and assign variables (prefix with db)
        $selectedstudentstmt->execute(); 
        $selectedstudentstmt->bind_result($selStudentAlias,$selStudentForename,$selStudentSurname);
        $selectedstudentstmt->store_result();
        $selstudentnum = $selectedstudentstmt->num_rows();   

         while ($selectedstudentstmt->fetch()) {

        if($_POST["student"] === 'All') {
            echo "<p><strong>Students: </strong>All Students - Total:(" .$selstudentnum . ")</p>" . PHP_EOL;
        }else{
            echo "<p><strong>Students: </strong>" . $selStudentAlias . " - " . $selStudentForename . " " . $selStudentSurname . "</p>" . PHP_EOL;
        }
        }

You're binding $_POST['student'] to an int, but it could be a string too, right? — Damien Pirsy
@DamienPirsy Sorry for lateness, I have previous code which uses an int and that echos fine. Let me just sort the code out above — user1830984

Samy Samy · Accepted Answer · 2013-01-31T06:39:24

I think your condition fails here

 $selectedstudentstmt->bind_param("i",$_POST["student"]);

Its expecting integer value but you are sending string.

Don't use $_POST directly in your query.It will cause sql injection attack.

Sanitize the user input before use it in sql queries.

Changes: Add the below conditions before your query. Once again don't forget to sanitize.

if ($_POST["student"] == 'ALL') {
   $where = WHERE (StudentId = ?) ";
} else {
  $where  = "";
}
$selectedstudentqry = " SELECT StudentAlias, StudentForename, StudentSurname FROM    Student  $where

echo not appearing when selecting a certain value

1 Answers