Multi entry form not passing info to mysql database

[skybluediver]

I am trying create a form for my club which takes info from a database to enable a sub selection of trainees from the database. Then additionally select a from a list of events and INSERT both back into a database. It writes to the database OK and loops through the correct number of times but doesnt pass $trainee value to the database
What is failing is the passing of the info from
print ' <input type="hidden" name="Trainee" value= ' . $trainee . ' />
to the $query in the if(isset($_POST['formSubmit'])) loop.

Anyone tell me where I am going wrong

[dlite922]

you're using an @ sign in front of your mysql_query() function. You may have a bad query.

do a die(var_dump($q uery)); before you run the query and manually run that query yourself in the DB to see if there's a problem with it if the issue is not obvious.

Also SANITIZE your variables. Look into a little thing called SQL Injection. If this site is internet facing, I could totally sabotage your inputs by putting in malicious values. Start with mysql_real_esca pe_string() function. See the manual.


Dan

[skybluediver]

Thanks for the response. Your comments noted about security, I stripped all extra code for fault finding, but will investigate your suggestions. FYI, the form is accessed by a restricted encrypted login to the website.
Removed the @ didnt make any difference. The query does work and posts all the info except the $trainee value which currently appears as / in the database field, which I believe to be the closing / of the /> in the <input type "hidden" name="Trainee" value= ' . $trainee . ' /> line.
Any other thoughts or observations

[dlite922]

You just need to trace your code. Put in die(var_dump($v ariable_name_yo u_want)) at every step and you can see where it's failing or where there should be data in the variable but isn't.

Do this for $_POST variable, $aTrainee, and $query. You don't have an else in the if(mysql_query( )) so you wouldn't know if the query failed at all and why. add an else and mysql_error().

Dan