Home How to Combine text and query result as value of a PHP variable
Reply: 1

How to Combine text and query result as value of a PHP variable

Tariqul Islam
1#
Tariqul Islam Published in 2018-01-11 09:11:07Z

I have a variable ($html) which has some value assigned to it (Later I need to save it as PDF with MPDF). A part of it's value is generated by making query to database. Right now the code looks like...

$html = '
<html>
    <head>...</head>

    <body>
        <table>
        <thead>
        <tr>
           <td>ITEM NAME</td>
           <td>QTY</td>
           <td>PRICE</td>
           <td>TOTAL</td>
        </tr>
        </thead>

        <tbody>'.

        $items_query = "SELECT * FROM cart WHERE u_id='$u_id'"
        or die('Error Querying Database...');

        $run_items_query = mysqli_query($con, $items_query);

        while($row_query = mysqli_fetch_array($run_items_query)){

            $item = $row_query['p_name'];
            $unit_price = $row_query['price'];
            $qty = $row_query['qty'];
            $price = $unit_price*$qty;

            echo'
                <tr>
                    <td>'.$item.'</td>
                    <td>'.$qty.'</td>
                    <td>'.$unit_price.'</td>
                    <td>'.$price.'</td>
                </tr>
            ';
        }

        '<tr>
           <td>TOTAL:</td>
           <td>0000</td>
        </tr>
        </tbody>
        </table>
    </body>
</html>';

What I am doing here is - Creating simple table and adding all the <td> via SQL Query. I can't get how to concatenate simple text part and query result part as value to the $html variable. Right now it shows only the first part of the value before query start and then shows this - 'SELECT * FROM cart WHERE u_id='ee0fivtt9tq39i5mpdhtf9v051' ... not the <td> that it gets. Please let me know if you can figure out what I am doing wrong...

Prateik Darji
2#
Prateik Darji Reply to 2018-01-12 04:43:32Z

Use $html parameter to concatenate a further string with . check the answer and the query you are using is voluntary to SQL injection instead I have updated query to parameterized which will secure you from SQL injection.

$html = '
<html>
<head>...</head>

<body>
    <table>
    <thead>
    <tr>
       <td>ITEM NAME</td>
       <td>QTY</td>
       <td>PRICE</td>
       <td>TOTAL</td>
    </tr>
    </thead>

    <tbody>';

    $items_query = "SELECT * FROM cart WHERE u_id=?";
    //or die('Error Querying Database...'); this don't needs to be here

    $query = $con->prepare($item_query);
    $query->bind_param('s', $u_id);
    //$run_items_query = mysqli_query($con, $items_query);
    $result = $query->execute();
    while($row_query = $result->fetch_assoc()){

        $item = $row_query['p_name'];
        $unit_price = $row_query['price'];
        $qty = $row_query['qty'];
        $price = $unit_price*$qty;

        $html .='
            <tr>
                <td>'.$item.'</td>
                <td>'.$qty.'</td>
                <td>'.$unit_price.'</td>
                <td>'.$price.'</td>
            </tr>
        ';
    }

    $html .= '<tr>
       <td>TOTAL:</td>
       <td>0000</td>
    </tr>
    </tbody>
    </table>
    </body>
</html>';

echo $html;

Enjoy :-)

You need to login account before you can post.

About| Privacy statement| Terms of Service| Advertising| Contact us| Help| Sitemap|
Processed in 0.345987 second(s) , Gzip On .

© 2016 Powered by mzan.com design MATCHINFO