Passing selected value from PHP menu to MySQL query.

[atl_andy]

I need to pass the value selected from this dropdown....

 

<select name="partnumber" onchange="ajaxFunction('LBox2', this.value);">
<?php
     $dbPN = mysql_connect('localhost','user','pass');
     mysql_select_db('system',$dbPN);

     $resultPN = mysql_query("SELECT record_id, partnumber FROM partnumber");

     while($rowPN = mysql_fetch_array($resultPN, MYSQL_ASSOC))
     {
          echo '<option>'.$rowPN['partnumber'].'</option>';
     }

     mysql_close($dbPN);
?>
</select>

 

To the select statement that populates this dropdown....

 

<?php
     $dbMFR = mysql_connect('localhost','user','pass');
     mysql_select_db('system',$dbMFR);

     $resultMFR = mysql_query("SELECT record_id, manufacturer FROM partnumber WHERE partnumber = 'this.value' ");  // Return the value of the first dropdown here.  The page reloads when the first value is selected.

     while($rowMFR = mysql_fetch_array($resultPN, MYSQL_ASSOC))
     {
          $NewData .= '<option>'.$rowMFR['manufacturer'].'</option>';
     }

     mysql_close($dbMFR);
?>

 

How is this best accomplished?  Is there a way to put the selected value of the first dropdown into a variable after the page reloads?

[timmy0320]

You could have the page refresh and grab the selected option from the first drop-down or you could always do it in AJAX too. I'm not too familiar with AJAX though.

[atl_andy]

I was thinking it should be like:

 

$selected = 'this.value';

 

since that is what is passed to the second dropdown function, but can't get this.value.  Is there a way to set it to a variable?

 

[atl_andy]

Figured it out...

 

$selected = $_GET['Param'];

 

then passed that to the second dropdown query:

 

$resultMFR = mysql_query("SELECT record_id, manufacturer FROM partnumber WHERE partnumber = '".$selected."; "); 

 

 

solution found as a result of reading another post, which led to this link:

 

http://www.w3schools.com/php/php_ajax_database.asp

[discomatt]

PLEASE PLEASE PLEASE sanitize all user-inputted data before entering it into a query.

 

http://www.tizag.com/mysqlTutorial/mysql-php-sql-injection.php

[atl_andy]

Thanks for the heads up.  However, this app is not visible to the web and is only used by a few company employees, on a local server.  SQL injections aren't going to be an issue.

[discomatt]

If the server is in any way connected to the web, even through a VPN, it's worth the few extra characters to sanitize.

 

If not, ignore this post

[atl_andy]

At this point it's only on a stand alone linux box.  There may be a point that it's visible and this will need to be addressed.  Thanks for mentioning it.

[BlueSkyIS]

it's just good form. do it always, then you never have to worry about 'when do i do it?'