Drop down menu issues

[monstaface]

I've created a dropdown menu, however nothing below the dropdown shows so that I cannot go to the next page, neither is there a footlayout. I'm sure there's an issue with my code as i'm a new learner and not so talented! I would be grateful for some feedback

<?php
session_start();
include ("db.php");
$pagename="Purchases";


echo "<link rel=stylesheet type=text/css href=mystylesheet.css>";

echo "<title>".$pagename."</title>";

include("headlayout3.html");

//display the name of the site and the date dynamically. See uk.php.net
echo date ('l d F Y H:i:s');
echo "<p></p>";
//display name of the page
echo "<h2>".$pagename."</h2>";

if(!isset($_SESSION['uType']))
    die("Please login to continue");


echo "Please choose the selected party:<br></br>";
//Drop down menu

$Party="SELECT * from Party";
$exeParty=mysql_query($Party);
 
echo  "<select>";
while($arrayParty = mysql_fetch_array($exeParty))
{
echo"<option value='partyname'>".$arrayParty['PartyName']."</option>";
}
//Link to next page where a form is to continue 
echo"Please Continue";
echo "<a href=ticket.php>Purchase Ticket</a>";


//include foot layout
include("footlayout.html");
?>

Edited April 16, 2014 by monstaface

[monstaface]

Anyone? 

[mac_gyver]

your html is invalid, there's no closing </select> tag, so everything being output is not rendered and can be seen in the 'view source' of the page in your browser.

 

you need to always make sure your web pages are valid html at http://validator.w3.org

Edited April 17, 2014 by mac_gyver

[monstaface]

Thanks for the feedback and the link, I will definitely check it out! 

[monstaface]

Im attempting to create a form so that when the event is selected from the dropdown, when the form on the next page is filled in they both save to the table in the database.

 

The form:

$party=$_GET['partyName'];


echo "<form method=post action=BookEvent.php>" ;
echo "<table border=0 cellpadding=5>";
echo "<tr><td>First Name </td>";
echo "<td><input type=text name=r_fn size=35></td></tr>";
echo "<tr><td>Last Name </td>";
echo "<td><input type=text name=r_ln size=35></td></tr>";
echo "<tr><td>Tel No </td>";
echo "<td><input type=text name=r_tn size=35></td></tr>";
echo "<tr><td>Email Address </td>";
echo "<td><input type=text name=r_e size=35></td></tr>";
echo "<tr><td>Ticket Quantity</td>";
echo "<td><input type=text name=r_q size=35></td></tr>";
echo "<tr><td><input type=submit value='Request Ticket'></td></tr>";

echo "</table>";
echo "</form>" ;

The 'bookevent page in correlation with the form:

$quantity=$_POST['r_q'];
$name=$_POST['r_fn'];
$sname=$_POST['r_ln'];
$tel=$_POST['r_tn'];
$email=$_POST['r_e'];
$party=$_GET['partyName'];





 if (!$name or !$sname or !$tel or !$email or !$quantity)
    {
        echo "<p>Your form is incomplete ";
        echo "<br>Please fill in details ";
        include("footlayout.html");

    }
    else

    {
    $SQL="insert into Bookings(customerFName, customerSName, customerTelNo, customerEmail, tickets) values ('".$name."','".$sname."','".$tel."','".$email."','".$quantity."')";
    $exeSQL=mysql_query($SQL);

    echo"Thank you for booking ";
    }


    $ASQL="select Quantity from PARTY where Name='$party'";
    $exeASQL=mysql_query($SQL) or die (mysql_error());
    $array=mysql_fetch_array($exeASQL);
    $quantity=$array['r_q'];

    if ($ticket>$quantity)
    {
    echo"Sorry There are only:" .$quantity;
    include("footlayout.html");
    exit;
    }

    echo"Thank you for booking tickets to";
    echo $party;

My issue is that I am trying to separate the statements after the first 'if' because if all the records are entered correctly, The page echoes both messages the 'Thank you for booking tickets to' and the 'Sorry there are only'  also both variables $quantity and $party don't show their values.

 

Please help me out, I'm new to coding and attempting to teach myself. I would be extremely grateful!

[Jacques1]

Remember when you promised to escape all user input? Now you're again happily stuffing raw input into query strings. 

 

Do you not understand how dangerous this is? It allows anybody to manipulate the queries in any way they want. This can be used to steal all data or even compromise the entire server. Yes, people do that, and it's not even difficult.

 

You need to start thinking about security. The Internet is a hostile environment with a lot of criminals and script kiddies who would love to take over your server.

 

While you're at it, get rid of this stupid mysql_* stuff. It's obsolete since more than 10 years and will be removed in the near future. We use PDO and MySQLi now.

[monstaface]

This website will never be functional. This is purely a prototype for a project that I am working on, hence the reason I haven't gotten around to escaping my user input.

 

If you have a solution to my problem I would be extremely grateful.

[adam_bray]

Here's a very basic example of how to improve it. Read through the comments to understand the changes.

 

There's still much more that can be done to improve this, but there's no point doing it all for you.

<?php

	// Process the form
	if( isset( $_POST['r_p'] ) )
	{
		// Let's add *some* protection to our strings
		$quantity 	= mysql_real_escape_string($_POST['r_q']);
		$name 		= mysql_real_escape_string($_POST['r_fn']);
		$sname 		= mysql_real_escape_string($_POST['r_ln']);
		$tel 		= mysql_real_escape_string($_POST['r_tn']);
		$email 		= mysql_real_escape_string($_POST['r_e']);
		$party 		= mysql_real_escape_string($_POST['r_p']);

		// Do some very basic checks against the posted variables
 		if( strlen($name) < 3 || strlen($sname) < 3 || strlen($tel) < 1 || strlen($email) < 3 || (strlen($quantity) < 1 || !is_numeric( $quantity )) ) 
		{
			echo '<p>Your form is incomplete</p>
			<p>Please fill in details</p>';
			
			include_once('footlayout.html');
			exit;
		}
    	else
   		{
    		$quantity_query = mysql_query('SELECT Quantity FROM PARTY WHERE Name=\''.$party.'\' LIMIT 1;') or die( 'MySQL Error: ' . mysql_error() ); // Get the party info
			if( mysql_num_rows( $quantity_query ) > 0 ) // Check the party exists
			{
				$available = mysql_fetch_array( $quantity_query ); // Fetch the array
				$available = $available['r_q']; // Make the number of tickets available the variable
				
				if( $quantity <= $available ) // Check the user hasn't ordered too many tickets
				{
					$sql = mysql_query('
					INSERT INTO Bookings
					(customerFName, customerSName, customerTelNo, customerEmail, tickets) 
					VALUES(\''.$name.'\',\''.$sname.'\',\''.$tel.'\',\''.$email.'\',\''.$quantity.'\');') or die( 'MySQL Error: ' . mysql_error() ); // Insert the booking
		
					if( $sql ) // If the booking worked
					{
						echo 'Thank you '.$name.' for booking '.$quantity.' tickets to '.$party.'.'; // Tell them it worked!
						include_once('footlayout.html');
						exit;
					}
					else // If the booking query didn't work
					{
						echo 'There\'s been a problem inserting into the DB!';
						include_once('footlayout.html');
						exit;
					}
				}
				else // If the user has ordered too many tickets
				{
					echo 'You\'ve selected more tickets than we can provide.';
					include_once('footlayout.html');
					exit;
				}
			}
			else // If the party doesn't exist
			{
				echo 'Cannot find '.$party.' in the database!';
				include_once('footlayout.html');
				exit;
			}
		}
    }
	
	// Display the form
	$party = $_GET['partyName'];
?>
	<form method="post" action="<?=$_SERVER['PHP_SELF'];?>">
		<table border="0" cellspacing="0" cellpadding="5">
			<tr>
				<td><label for="r_fn">First Name:</label></td>
				<td><input type="text" id="r_fn" name="r_fn" size="35" required="true" /></td>
			</tr>
			<tr>
				<td><label for="r_ln">Surname Name:</label></td>
				<td><input type="text" id="r_ln" name="r_ln" size="35" required="true" /></td>
			</td>
			<tr>
				<td><label for="r_tn">Telephone:</label></td>
				<td><input type="tel" id="r_tn" name="r_tn" size="35" required="true" /></td>
			</tr>
			<tr>
				<td><label for="r_e">Email Address:</label></td>
				<td><input type="email" id="r_e" name="r_e" size="35" required="true" /></td>
			</tr>
			<tr>
				<td><label for="r_e">Ticket Quantity:</label></td>
				<td><input type="number" id="r_q" name="r_q" required="true" /></td>
			</tr>
			<tr>
				<td colspan="2" align="center">
					<input type="hidden" value="<?=$party;?>" name="r_p" />
					<input type="submit" value="Request Ticket" />
				</td>
			</tr>
		</table>
	</form>

[Jacques1]

If you have a solution to my problem I would be extremely grateful.

 

I gave you two links with two short explanations of all relevant basics.

 

Now it's up to you: You can waste the next days, months, years copypasting crap code from dubious websites and asking other people to fix it for you. Or you can start to read the explanations and actually learn PHP.

 

Writing proper code is no rocket science. I think everybody with basic intelligence can do it. However, if you want to learn a language, you do need to read. You can't just copypaste other people's stuff. This may get you quick results, but you're not gonna learn anything from it.