[rosepetalpowder]

I have a sql table which has two colums - page name and page link.

On the homepage.php I have a dropdown which pulls all page names with submit button.

when submit button is pressed, I want the page link corresponding to the selected page name from sql to pop up as a link . This is the code I came up with, BUT nothing is happening. where am i wrong?

  <?php

$conn = mysqli_connect('localhost', 'dc', 'bn',  'dbh');
 
if (!$conn) {
    die('Could not connect: ' . mysqli_error());
}


 $page = $_POST['page_name'];
 // inserts value into the sql table 
 
$sql = "SELECT page_link FROM pages WHERE page_name = '$page'";
 
$result = mysqli_query($conn, $sql);


if ($row = mysqli_fetch_array($result)) {
    
    //drop down options from sql table
    
    echo '<a href = "'. $row['page_link'] . '" > </a> ';

  } 




 mysqli_close($conn);
  

?>
 

This post has been edited by rosepetalpowder: 03 April 2012 - 04:09 PM

[Slice]

You have no text in your link.

echo '<a href = "'. $row['page_link'] . '" > </a> ';

should be something like:

echo '<a href = "'. $row['page_link'] . '" >'. $row['page_link'] .'</a> ';

[CTphpnwb]

I'd change line 11 so that you had this:

 $page = $_POST['page_name'];
 // inserts value into the sql table by inserting user supplied data directly into the query below, thus begging to be hacked. 
 
$sql = "SELECT page_link FROM pages WHERE page_name = '$page'";

Or, you could use prepared statements. Here's a link to a good PDO tutorial in case you'd like to keep your site from being defaced.

[rosepetalpowder]

Slice, on 03 April 2012 - 07:09 PM, said:

You have no text in your link.

echo '<a href = "'. $row['page_link'] . '" > </a> ';

should be something like:

echo '<a href = "'. $row['page_link'] . '" >'. $row['page_link'] .'</a> ';

I tried your advice. it still doesnt display anything. any other suggestions i could try?

[no2pencil]

Can we try the following?

$sql = "SELECT page_link FROM pages WHERE page_name = '$page'";
 
$result = mysqli_query($conn, $sql);
if(!$result) {
  echo "<p>There was a an error with the following sql</p><p>$sql</p>";
  die();
}