Question

I have a page with a dynamic table, filled with data from mysql database. The table isn’t just an ordinary table, one column contains a checkbox with a value of the id (primary key) of the database. But the data from mysql that i want to retrieve has spaces in between them.

Example:

id|name
1 |Chuck Norris
2 |Bruce Lee
3 |Jackie Chan

From the column name, I was able to get Chuck, Bruce and Jackie, but not Norris, Lee, and Chan.

i have to pages namely: delete.php and checkIt.php

a portion of delete.php contains
`

    $query = "SELECT * FROM account";
    $result = mysql_query($query) or die ("Query failed");
    $num = mysql_num_rows($result);

    echo "<form method='post' action='checkIt.php'><table>";
    if($num>0)
    {

        echo '<tr>
                <td></td>
                <td>ID</td>
                <td>NAME</td>';
        echo '</tr>';

        while($row = mysql_fetch_array($result))
        {   
            echo "<tr>
                    <td><input type='checkbox' name='names[]' value=".$row['name']."/></td>
                    <td>".$row['id']."</td>
                    <td>".$row['name']."</td>";
            echo "</tr>";
        }
    }
    echo "</table><br><input type='submit' value='Delete' /></form>";
?>`

and a portion of checkIt.php contains
`

for ($i=0; $i<count($_POST['names']); $i++)
{ 
    $name = $_POST['names'][$i]; 
    echo " ".$name;
    $sql="DELETE from account WHERE name='$name';";
    $result=mysql_query($sql);
}
?>`

$name from checkIt.php only gets one word. I would like to get the complete data from the mysql so that the DELETE will execute properly.
Any suggestions? Thanks in advance!

Answer 1

You need to enclose the value in your checkbox input in quotes.

Right now it comes out as:

<input type='checkbox' name='names[]' value=chuck norris/>

Changing your echo to:

echo "<tr>
          <td><input type='checkbox' name='names[]' value='".$row['name']."' /></td>
          <td>".$row['id']."</td>
          <td>".$row['name']."</td>";

should solve the problem.

Also, be sure to escape the $_POST parameters you are using in your query or else you are vulnerable to SQL Injection.