I have problem to pass value via url parameter to other page. I want to reject a booking based on selected bookingID by clicking REJECT button. But the bookingID value do not pass to other page, the url appear like this http://localhost/tablesortapprovebook/approve_booking.php?bookingID=
Here is my coding segment:
index.php
<head>
<script src="jquery-latest.js" type="text/javascript"></script>
<script src="jquery.tablesorter.js" type="text/javascript"></script>
<script>
$(document).ready(function() {
$("#myTable").tablesorter({widgets: ['zebra']});
});
$(document).ready(function()
{
$("#myTable").tablesorter();
}
);
$(document).ready(function()
{
$("#myTable").tablesorter( {sortList: [[0,0], [1,0]]} );
}
);
</script>
<link href="style.css" rel="stylesheet" type="text/css">
<link href="stylelogin.css" rel="stylesheet" type="text/css">
</head>
<body>
<?php
include("dbconfig.php");
$query = "SELECT customer.companyName, customer.contactName, eventinfo.eventTitle,boothAlias,date, testbook.bstatus, testbook.username, bookingID from eventinfo, testbook, customer where testbook.username=customer.username AND testbook.eventID=eventinfo.eventID";
$o = '<table id="myTable" class="tablesorter" width="930px"><thead><tr><th>Company Name</th><th>Contact Name</th><th>Event</th><th>Booth</th><th>Date</th><th>Status</th></tr></thead><tbody>';
$result = mysql_query($query);
while($row=mysql_fetch_array($result))
{
$boothAlias=stripslashes($row["boothAlias"]);
$eventTitle=stripslashes($row["eventTitle"]);
$date=stripslashes($row["date"]);
$bstatus=stripslashes($row["bstatus"]);
$companyName=stripslashes($row["companyName"]);
$contactName=stripslashes($row["contactName"]);
$bookingID=stripslashes($row["bookingID"]);
if($bstatus==0){
$status="Pending";
}else if($bstatus==1){
$status="Successful";
}else{
$status="Reject";
}
$o .= '<tr><td width="120px">'.$companyName.'</td><td width="120px">'.$contactName.'</td><td width="180px">'.$eventTitle.
'</td><td width="70px">'.$boothAlias.'</td><td width="170px">'.$date.'</td><td width="70">'.$status.'</td><td>'.$bookingID.'
</td><td width="100"><input type="hidden" name="bookingID" value="<?php echo $bookingID; ?>" ><a href="approve_booking.php?bookingID=".$bookingID.
" name="REJECT" id="REJECT"><input width="100px" name="REJECT" type="submit" id="REJECT" value="Reject"></a></td></tr>';
}
$o .= '</tbody></table>';
echo $o;
?>
</body>
approve_booking.php
<?php
mysql_connect("localhost", "root", "") or die (mysql_error());
mysql_select_db("eventdb") or die (mysql_error());
$booking=$_GET['bookingID'];
echo $booking;
if(isset($_POST['APPROVED']))
{
$query2 = "UPDATE testbook SET bstatus ='0' WHERE bookingID='$booking'";
$result2 = @mysql_query($query2);
}
if (isset($_POST['REJECT']))
{
$query3 = "UPDATE testbook SET bstatus ='2' WHERE bookingID='$booking'";
$result3 = @mysql_query($query3);
}
?>
I don’t really know what your problem is but try $_REQUEST[‘….’] instead of $_GET[‘…’].
By the way, you have a SQL injection vulnerability:
Replace that with: