Displaying multiple checkbox values

[Unknown98]

What I have is a page with a list of cars, each with a checkbox next to them.

 

<?php
$sth = null; $count = 0;
$sth = $dbh->prepare("SELECT * FROM garage WHERE warehouse_id = ? ORDER BY car_name ASC");
$sth->execute(array($_POST['ware_id']));
echo "<table>";
echo "<tr>";
echo '<td>Choose Vehicles:</td>';
echo "</tr>";
echo "<tr>";
echo "<td>";

echo "<form action='warehouse_ship_3.php' method='POST'>";
while($row = $sth->fetch()){
echo "<input type='checkbox' name='cars' value='".$row['uci']."' /> ID: ".$row['uci'].", ".$row['car_year']." ".$row['car_name']."<br />";  
}
echo "<input type='hidden' name='ware_id' value='".$_POST['ware_id']."' />";
echo "<hr />";
echo '<div class="center"><input class="myButton" type="submit" name="submit" value="Next" /></div></form>';
echo "</td>";
echo "</tr>";
echo "</table>";

?>

 

That works fine. What I'm trying to do with this second page, is select all the car's info from a table called "garage" which stores data for all the cars (car name, year, etc) and display it. UCI stands for Unique car id, every car has a different id. It works when the user only selects one car on the previous page, but if they select two or more cars, only the car with the highest UCI number shows up. How would I work it to display info on every car that they selected?

 

<?php
  if(empty($_POST['cars']))
  {
    echo("You didn't select any cars.");
  }
  else
  {
$sth = $dbh->prepare("SELECT * FROM `garage` WHERE `uci` = ?");
$sth->execute(array($_POST['cars']));
while($cars = $sth->fetch()){

echo"
".$cars['uci'].", ".$cars['car_year']." ".$cars['car_name']."
";
}
  }
?>

[DavidAM]

First you need to change the checkbox name in the form so that it POSTs an array of selected ids (note the empty square brackets):

 

<input type='checkbox' name='cars[]' value='" ...

 

Then you need to change your WHERE clause to select multiple cars.

 

SELECT * FROM garage WHERE uci IN (1, 2, 3)

 

I'd show the PHP for that, too, but I don't work with prepared statements, so I'm not sure how it would go. In standard code, it would be

 

$sql = 'SELECT * FROM garage WHERE uci IN (' . implode(',', $_POST['cars']) . ')';

 

Of course, you'd need to sanitize those inputs, first.

[Unknown98]

Thanks for your help. I did get it working with standard php, I guess just time to research how to do the same with prepared statements now.

[Unknown98]

I got it working with Prepared Statements. Here's the PDO query:

 

$ids = $_POST['cars'];
foreach($ids as &$val)
   	$val=$dbh->quote($val); //iterate through array and quote
$in = implode(',',$ids); //create comma separated list
$stmt = $dbh->query(
    		'SELECT *
     		FROM garage
     		WHERE uci IN('.$in.')'
);
while ($cars = $stmt->fetch()) {

 

 

Thanks again for your help!