Question

I need a combine some php and html tricks to make a typical select option segment of a form hold multiple values for each form. An id for the product, the id for the markup, and the “name” of the markup. This allows administrative users to select prices for products based on profit margins. Submitting the form yields blank values for the three values inside the select.

<?php

    $factor_grab = "
    SELECT * FROM product_latest_price_factor AS t1
    WHERE product_id = '".$product_id."'";
    //echo $factor_grab.'<br>';
    $factor_result = mysql_query($factor_grab) or die (mysql_error());
    while($frow=mysql_fetch_array($factor_result))
    {
        $level = $frow['level'];
        $percentage = $frow['percentage'];
        $value = $frow['value'];
        $price_level_id = $frow['price_level_id'];

//This piece does not work
        echo '<option value="{level:\''.$level.'\', price_level_id:\''.$price_level_id.'\', percentage:\''.$percentage.'\'}">'.$level.' - %'.number_format($percentage,2).' - $'.$value.'</option>';

    }
      ?>

I thought I nailed it this time, as I can see the values in the form, and by inspecting the options with Google Chrome, but I think it’s because my quotes are getting out of hand. You can see each option value is supposed to store three variables. Level, Price_level and Price_level_id. (Value is just for users to explicitly see what the resulting price would be.) How do I echo out an option that can work for all three? That would be a very powerful solution for me.

Answer 1

Properly escape things, and avoid issues:

echo '<option value="', 
    htmlspecialchars(
        json_encode(
            array(
                'level'=>$level,
                'price_level_id'=>$price_level_id,
                'percentage'=>$percentage
            )
        )
    ),
    '">',
    htmlspecialchars($level . ' - %' . number_format($percentage,2)),
    htmlspecialchars(' - $' . $value),
    '</option>';

This is messy… only trying to show you the idea here. You should clean this stuff up a bit. It would be best if you only kept an ID in that option value, and pulled these other things out of a JavaScript array or object or wherever you keep them later.

Also, be very sure that you are escaping data in your query. As it stands now, you are probably subject to SQL injection. Learn to use PDO with prepared queries to avoid this problem.