Step 1: Create the HTML form for each of your fields
<form>
First Name: <input type="text" name="name"><br>
Surname: <input type="text" name="last"><br>
<input type="radio" name="feeling" value="Happy" checked> Happy<br>
<input type="radio" name="feeling" value="Sad" checked> Sad<br>
<input type="submit">
</form>
Step 2: Include an action for when the submit button is pressed
Add an action clause to run a separate script to process the data
Add a method - POST or GET
POST is one of the most common HTTP methods
POST requests are never cached
POST requests do not remain in the browser history
POST requests cannot be bookmarked
POST requests have no restrictions on data length
Best used for sending sensitive data
GET method sends the encoded user information appended to the page request.
The page and the encoded information are separated by the ? character.
Pass values to another script in the browser - handy for searching
Best used for non-sensitive data
See Updated Code Below using POST
<!DOCTYPE html>
<html>
<body>
<form action="process.php" method="post">
First Name: <input type="text" name="name"><br>
Surname: <input type="text" name="last"><br>
<input type="radio" name="feeling" value="Happy" checked> Happy<br>
<input type="radio" name="feeling" value="Sad" checked> Sad<br>
<input type="submit">
</form>
</body>
</html>
When the page submits it will run the process.php script
1. Create a new file called process.php
2. Create a variable to store each field result from the form. We receive the data from the global variable $_POST
In this example we also run the data through a custom function called validate().
When inserting data into a database we need to ensure the data entered will not cause harm to our database through data injection. We use the following code to access each piece of data from a field and remove any special characters.
$student = validate($_POST['student_name']);
$activity = validate($_POST['activity']);
function validate($data){
$data = htmlspecialchars($data);
return $data;
}
Other validation methods include using mysqli_real_escape_string($conn, $_POST['field']);
$first = mysqli_real_escape_string($conn, $_POST['name']);
$last = mysqli_real_escape_string($conn, $_POST['last']);
$feel = mysqli_real_escape_string($conn, $_POST['feeling']);
The following code writes the SQL statement using the variables, executes and checks for errors and reports if was successful or not
<?php
$sql = "INSERT INTO votes (Emotion, Last, Name) VALUES ('$feel', '$last', '$first')";
if(mysqli_query($conn, $sql)){
echo "Records added successfully.";
} else{
echo "ERROR: Could not able to execute $sql. " . mysqli_error($conn);
}
// Close connection
mysqli_close($conn);
?>
form.php
<!DOCTYPE html>
<html>
<body>
<form action="process.php" method="post">
First Name: <input type="text" name="name"><br>
Surname: <input type="text" name="last"><br>
<input type="radio" name="feeling" value="Happy" checked> Happy<br>
<input type="radio" name="feeling" value="Sad" checked> Sad<br>
<input type="submit">
</form>
</body>
</html>
process.php
<?php
include('connect.php');
// Escape user inputs for security
$first = mysqli_real_escape_string($conn, $_REQUEST['name']);
$last = mysqli_real_escape_string($conn, $_REQUEST['last']);
$feel = mysqli_real_escape_string($conn, $_REQUEST['feeling']);
// Attempt insert query execution
$sql = "INSERT INTO votes (Emotion, Last, Name) VALUES ('$feel', '$last', '$first')";
if(mysqli_query($conn, $sql)){
echo "Records added successfully.";
} else{
echo "ERROR: Could not able to execute $sql. " . mysqli_error($conn);
}
// Close connection
mysqli_close($conn);
?>
<?php
include('connect.php');
//this will check to see if form has already been submitted
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$student = validate($_POST['student_name']);
$activity = validate($_POST['activity']);
//import to database
global $conn; //access global variable
$sql = "INSERT INTO student_activities (student_id, activity_id) VALUES ('$student', '$activity')";
if(mysqli_query($conn, $sql)){
echo "Records added successfully.";
} else{
echo "ERROR: Could not able to execute $sql. " . mysqli_error($conn);
}
}
//validate the data first by stripping any special characters
function validate($data){
$data = htmlspecialchars($data);
return $data;
}
?>
<!--start of html form-->
<h1>Student Activities Entry Form</h2>
<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">
Student:<select name = "student_name" required>
<option disabled selected value> -- select an option -- </option>
<?php
$students = $conn->query("Select * from students order by last");
if($students->num_rows>0){
while($row=$students->fetch_assoc()){
echo("<option value=".$row["student_id"].">".$row["first"]." ".$row["last"]."</option>");
}
}
?>
</select>
</br>
Activity:<select name ="activity" required>
<option disabled selected value> -- select an option -- </option>
<?php
$activities = $conn->query("Select * from activities order by name");
if($activities->num_rows>0){
while($row=$activities->fetch_assoc()){
echo("<option value=".$row["activity_id"].">".$row["name"]."</option>");
}
}
?>
</select>
</br>
<button type ="submit">Submit</button>
</form>