populate_select()

[megha_3000]

in php what is the function of populate_select()?

[bernie1227]

Sorry, but we're going to need more information than that to help you, there is no inbuilt function in php called populate_select(), so are you referring to a user defined function?

[megha_3000]

That expression is like that

<?php populate_select("countries","countryid","country",$education->countryid); ?>

[bernie1227]

I double checked the list of inbuilt functions, there is no function called populate_select, the function must be user defined, so we'll only be able to help you if we have the code for the function.

[megha_3000]

yes i found that user defined function which is like

<?php
function populate_select($table,$fields_id,$fields_value,$selected){
	$conn=db_connect(HOST,USER,PASS,DB,PORT);
	$sql="Select $fields_id,$fields_value From $table Order By $fields_value";
	$results=query($sql,$conn);
	while ($row = fetch_object($results)){
		$SelectedField=($row->$fields_id==$selected) ? " selected" : "";		
		echo "<option value='" . $row->$fields_id ."'". $SelectedField . ">" . $row->$fields_value . "</option>";
	}
	free_result($results);
}
?>

[traq]

It selects some info from a DB and displays it. It's not very well-written, however. If you need to do this, I'd recommend a different method.

[bernie1227]

^ more specifically than that, It populates a <select> tag (drop down options)

[traq]

it's intended to, yes.

some specific downfalls this function has:
1. creates a new DB connection for *every* use
2. does not validate or sanitize data used in the query
......(I don't know how data is passed to the function, but if it comes from the user, this is a serious problem)
3. doesn't check if there was an error, or if any results were actually returned
4. outputs a load of un-escaped HTML (of unknown size) right in the middle of the function
......what happens if there's a < or " (or worse yet, a whole <tag>) in the results?
......what happens if there's a script error later on?
......what happens if there's no opening/closing <select> tag outside this function?