Not able to parse data from HTML form to PDF using php and mysql

i m in a situation where i need to transfer a data when submitted on HTML form to update in MYSQL database and generate pdf for that data submitted. This must also contain the increment values like generating receipt number.

开发者_开发百科

My pdf code is here scripted in php.

<?php

require('fpdf.php');

    class PDF extends FPDF
{
//Page header
function Header()
{

    //Move to the right
    $this->Cell(130);
    //Title
    include('connection.php');
    mysql_select_db("inventory") or die("Couldn't find db");
    $data = mysql_query("SELECT * FROM sold WHERE imei = '6135352313'");//This is where i need help how to get data from the HTML form after updating in MYSQL
    while ($result1 = mysql_fetch_assoc($data))
{

    $this->Cell(50,10,'CP '.$result1["receiptnumber"],1,1,'C'); //receipt number to be pulled from Auto_increment field in database
    }
    //Move to the right
    $this->Cell(130);
    //Date
    $this->Cell(50,10,date("l F dS Y "),1,0,'C');
    //Line break
    $this->Ln(20);
}

//Instanciation of inherited class
$pdf=new PDF();
$pdf->AliasNbPages();
$pdf->AddPage();
$pdf->SetFont('Arial','B',10);
    include('connection.php');
    mysql_select_db("inventory") or die("Couldn't find db");
    $data = mysql_query("SELECT * FROM sold WHERE imei = '6135352313'"); //This is where i need help how to get data from the HTML form after updating in MYSQL

    while ($result = mysql_fetch_assoc($data))
{

    //Move to the right
    $pdf->Cell(50,5,'Invoice To ',0,0,'R');
    $pdf->SetFont('Arial','B',15);
    $pdf->Cell(140,8,$result["firstname"]." ".$result["lastname"],1,1,'C');
    $pdf->SetFont('Arial','B',10);

    }
$pdf->Output();
?>

---

You can get data into your SQL query like so:

$imei = mysql_real_escape_string($_POST['imei']);
$data = mysql_query("SELECT * FROM sold WHERE imei = '$imei'");

Don't forget to escape string you get from a user with mysql_real_escape_string().
Also don't forget to surround the $var in your query with single quotes ' as shown. (this is vital to make your code safe)

If you use mysql_query in any other way you will be vulnerable to SQL-injection attacks.