0

i wanna ask you guys if there is anyway i can get the value of a dropdown and pass it to another php file without using the way? The way is i have the options in my menu coming from the database This is my code on the dropdown menu

mysql_connect("localhost", "root" , "");
mysql_select_db("hotelgal");
$query3 = "SELECT suite_code from tblsuite WHERE suite_name = '".$suitename."'";
$result3 = mysql_query($query3);
$row3 = mysql_fetch_assoc($result3);
$suite = $row3['suite_code'];
mysql_connect("localhost", "root" , "");
mysql_select_db("hotelgal");
$queryroom = "SELECT * from tblroom WHERE room_accommodation = '" . $suite . "' AND status = 'AVAILABLE'";
    $resultroom = mysql_query($queryroom);
if ($resultroom && mysql_num_rows($resultroom) > 0)
{
echo '<form name = "room" method = "get" action = "reserveupdate.php">';
echo '<select name = "room" id = "rooms">';
while($rows = mysql_fetch_assoc($resultroom))
{
echo '<option>' . $rows['room_no'] . '</option>';
}
echo '</select></form>';
}

i have no problem on this one, the problem is i am trying to select the text of the dropdown and pass it to another php file which have this code

if (isset($_GET['room'])){
$query = "UPDATE tblreserve SET room_no = '" .$_GET['room']. "', status = 'APPROVED' WHERE reservation_code = '" . $reser . "'";
$res = mysql_query($query);
$query2 = "UPDATE tblroom SET status = 'OCCUPIED' WHERE room_no = '" . $_GET['room'] . "'";
$res2 = mysql_query($query2);
echo "<script>alert('Reservee Approved!'); window.location = './adminreserve.php';</script>";
}
Ankit
  • 6,403
  • 6
  • 46
  • 70
John Vince Azares
  • 1
  • 1
  • [Please, don't use `mysql_*` functions](http://stackoverflow.com/q/12859942/1190388) in new code. They are no longer maintained and are [officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). See the red box? Learn about prepared statements instead, and use [tag:PDO] or [tag:MySQLi]. – hjpotter92 Mar 28 '13 at 06:24
  • Your SQLs are all totally vulnerable. You can't get the drop-down text passed with submit because you're not suppose to. If you want the text try to put it in the value of drop-down option something like `your value;your text` and then you're able to `explode` the string and get two of them. – MahanGM Mar 28 '13 at 09:13

0 Answers0