PHP file breaks when using $_GET variable in URL

Question

I am using a select dropdown menu to filter clinical trials from a database. Below the select is code that calls clinical_trial() class. Problem is that no results are being displayed when $_GET variable ?cid= is appended to the url.

clinical_trials.php

<?php if($_GET['cid'])  $cid = $_GET['cid']; ?>

<?php 
  $query = "SELECT * FROM `category` ORDER BY category_name"; 
  $categories = $_db->get_results($query, ARRAY_A);  ?>

<select id="dynamic_select">
  <option value="clinical_trials.php" selected>All Categories</option>
  <?php 
    foreach($categories as $row):
      extract($row);
      echo '<option ' . ($cid == $category_id ? "selected" : "") . ' value="clinical_trials.php?cid='.$category_id.'">' . $category_name . '</option>';
    endforeach; ?>
</select>

<script>
  jQuery(document).ready(function($){
    $('#dynamic_select').on('change', function () {
      var url = $(this).val();
      if (url) window.location = url; // redirect
        return false;
    });
  });
</script>

<?php 
      $ct = new clinical_trial();  

      $params = array();

      if($cid != '')  $params['category_id'] = $cid;

      $results = $ct->search($params); 
      $file_path = CLINICAL_TRIALS_REL_PATH;
      $ts = strtotime($file_date); 

      if(count($results) > 0):
        $html  = '';
        $html .= '<table id="current-clinicals">'; 

        foreach($results as $row): 
          extract($row); 
          $html .= '<tr>';
          $html .= '<td valign="top">'.$trial_name.'</td>';
          $html .= '<td valign="top">'.$category_name.'</td>';
          $html .= '<td valign="top">'.date("m/d/Y").'</td>';
          $html .= '<td width="80" valign="top" align="center"><a href="'.$file_path . $file_name.'" target="_blank"><strong>View Here</strong></a></td>';
          $html .= '</tr>';
        endforeach; 
      else:
        $html .= '<p>No clinical trials in this category.</p>';
      endif;

      $html .= '</table>';

      echo $html; ?>

Below code is stored in clinical_trial.php

<?php

class clinical_trial{

public function validate($post, $file, &$errors, $action='create'){

    global $_db;

    cleanup_arr($post);
    extract($post);

    $errors = array();

    $rules[] = array( 'rule'=>'', 'val'=>$lst_category_id, 'minlen'=>0, 'maxlen'=>0, 'required'=>true,  'friendly_name'=>'Category', 'var'=>'lst_category_id');
    $rules[] = array( 'rule'=>'', 'val'=>$txt_trial_name, 'minlen'=>0, 'maxlen'=>0, 'required'=>true,  'friendly_name'=>'Trial name', 'var'=>'txt_trial_name');
    $rules[] = array( 'rule'=>'', 'val'=>$txt_file_date, 'minlen'=>0, 'maxlen'=>0, 'required'=>true,  'friendly_name'=>'File date', 'var'=>'txt_file_date');


    $flag_validated = true;
    foreach($rules as $r){
        $ret = validate($r);
        $varname = $r['var'];
        if($ret != VALIDATE_SUCCESS){
            $flag_validated = false;
            $errors[$varname] = $ret;
        }
    }

    if ($action == 'create'){
        if(!is_uploaded_file($file['file_filename']['tmp_name'])){
            $flag_validated = false;
            $errors['file_filename'] = 'Please upload a file.';
        }
    }

    return $flag_validated;
}

function create($post, $file){
    global $_db;
    cleanup_arr($post);
    extract($post);

    $ts = strtotime($txt_file_date);
    $file_date = date("Y-m-d", $ts);
    $query = "INSERT INTO `clinical_trial` (trial_name, file_date, file_name, category_id) VALUES ('$txt_trial_name', '$file_date', '', $lst_category_id)";
    $_db->query($query);
    $clinical_trial_id = $_db->insert_id;

    //$filename = md5(time());
    $filename = $file_date . '-' . make_file_name($txt_trial_name);
    $filename = handle_file_upload($file['file_filename'], $filename, CLINICAL_TRIALS_ABS_PATH);
    $_db->query("UPDATE `clinical_trial` SET file_name='$filename' WHERE clinical_trial_id=$clinical_trial_id");
}

function update($post, $file){
    global $_db;
    cleanup_arr($post);
    extract($post);

    $ts = strtotime($txt_file_date);
    $file_date = date("Y-m-d", $ts);
    $query = "UPDATE `clinical_trial` SET trial_name='$txt_trial_name', category_id=$lst_category_id, file_date='$file_date' WHERE clinical_trial_id=$hdn_clinical_trial_id";
    $_db->query($query);
    if(is_uploaded_file($file['file_filename']['tmp_name'])){
        @unlink(CLINICAL_TRIALS_ABS_PATH . $_db->get_var("SELECT file_name FROM clinical_trial WHERE clinical_trial_id=$hdn_clinical_trial_id"));
        $filename = $file_date . '-' . make_file_name($txt_trial_name);
        $filename = handle_file_upload($file['file_filename'], $filename, CLINICAL_TRIALS_ABS_PATH);
        $_db->query("UPDATE `clinical_trial` SET file_name='$filename' WHERE clinical_trial_id=$hdn_clinical_trial_id");
    }
}

function delete($clinical_trial_id){
    global $_db;
    cleanup_var($clinical_trial_id);
    @unlink(CLINICAL_TRIALS_ABS_PATH . $_db->get_var("SELECT file_name FROM clinical_trial WHERE clinical_trial_id=$clinical_trial_id"));
    $_db->query("DELETE FROM `clinical_trial` WHERE clinical_trial_id=$clinical_trial_id");
}

function search($params, $order_by=''){
    global $_db;
    if($params){
      cleanup_arr($params);
      extract($params);
    }

    if($category_id != '')  $where = " AND ct.category_id=$category_id ";
    $order_by = $order_by == "" ? "file_date DESC" : $order_by;

    $query = "SELECT * FROM `clinical_trial` ct, `category` c 
                WHERE ct.category_id=c.category_id
                $where 
                ORDER BY $order_by"; 
    return $_db->get_results($query, ARRAY_A);      
}

public function get($id)
{
    global $_db;
    cleanup_var($id);

    $query = "SELECT * FROM `clinical_trial` ct WHERE ct.clinical_trial_id=$id";
    $r = $_db->get_row($query, ARRAY_A);

    if(count($r) == 0)
        return false;

    foreach ( $r as $key => $val ){
        $this->$key = stripslashes($val);
    }

    return true;
}
} // class

Answer 1

You are not retrieving the $_GET variable?

Assuming this line is where you think you are retrieving it:

if($cid != '')  $params['category_id'] = $cid;

From you code that condition will always be false. Correct use would be:

if($_GET['cid'] != '')  $params['category_id'] = $_GET['cid'];