<select> problem

[error_22]

<form action="new_isy.php" method="POST">
First name:<br>
<input type="text" name="fname"><br>
Last name:<br>
<input type="text" name="lname"><br>
Email:<br>
<input type="text" name="email"><br>
Head<br>
<input type="text" name="head"><br>
Message<br>
<textarea name="message" cols="30" rows="8"></textarea><br>
<select name="category">
<option>option1</option>
<option>option2</option>
<option>option3</option>
<option>option4</option>
</select><br><br>
<input type="submit" value="Send"></form>

new_isy.php:

PHP Code:

$date = date("Y-m-d H:i:s");
    $sql = "INSERT INTO `ads` 
            (
            `fname`, 
            `lname`, 
            `email`, 
            `head`, 
            `message`, 
            `category`, 
            `date`
            )
    VALUES     (
            '{$_POST['fname']}', 
            '{$_POST['lname']}', 
            '{$_POST['email']}', 
            '{$_POST['head']}', 
            '{$_POST['message']}', 
            '{$_POST['category']}', 
            '$date'
            )";

mysql_query($sql) or die("SQL: $sql ".mysql_error());

// ##### Back to main page #####
header ("Location: index.php");
exit; 


Ok so i want option1/option2/option3/option4 to be saved in the field called "category". The point is that people can choose a category and that category should be saves in the db. What am i doing wrong?

Thanks in advance
Niklas

[filburt1]

Give each option a "value" attribute.

Also, perish the thought of using raw user data in queries. Escape it always.

[error_22]

<form action="new_isy.php" method="POST">
First name:<br>
<input type="text" name="fname"><br>
Last name:<br>
<input type="text" name="lname"><br>
Email:<br>
<input type="text" name="email"><br>
Head<br>
<input type="text" name="head"><br>
Message<br>
<textarea name="message" cols="30" rows="8"></textarea><br>
<select name="category">
<option value="option1">option1</option>
<option value="option2">option2</option>
<option value="option3">option3</option>
<option value="option4">option4</option>
</select><br><br>
<input type="submit" value="Send"></form>

Like that you mean? its still not working

And what do you mean by "raw user data in queries"?

Thanks

[error_22]

anyone?

[Princeton]

And what do you mean by "raw user data in queries"?

what he means is that you should make sure that all data is checked/cleaned before saving it into the database

(security risk)

[error_22]

Originally Posted by princeton

what he means is that you should make sure that all data is checked/cleaned before saving it into the database

(security risk)

and how do i do that?

[error_22]

bump

[Xenon]

take a look into a general vb-file, especially how they user $vbulletin->gpc and these parts of code

[error_22]

hmmm how would that string of code help me when I have no idea what any of you are talking about? I think you have forgotten what its like to not understand

[Xenon]

well, sorry but we can't teach you coding by posting on this forum.

we can just give you examples of how good code looks like, and i said, you should take any vb-file as an example, and will see that nowhere a $_POST is entered directly into the db, but all results are sanitized by the $vbulletin->gpc_cleaner