PHP dropdown populated from MySQL database won't POST selection to PHP query

Question

Scenario:

I am populating a dropdown menu with data from MySQL database. Upon clicking submit button, script should take the user to the results page and show data based on their selection.

Problem:

User selection is not able to POST to next page for the query. When I hard code an option in that matches one of the dropdown options, the query works fine.

-- This is the dropdown --

<div class = "servicelinesearchbox">
   <div class="servicelinesearchbar">
        <form class="form-inline" method="post" action="search_by_service_line.php">
              <select name="service_lines" id ="service_lines" form="service_line_form">
                  <option value = "">---SELECT A SERVICE LINE---</option>

               // THIS OPTION ADDED FOR TESTING, DOES WORK AND POPULATE DATA ON NEXT PAGE --
                  <option value = "Architectural">Architectural</option>
                  <?php
                  $sql = "SELECT service_lines FROM service_lines ORDER BY service_lines";
                  $db = mysqli_query($conn, $sql);
                  while ( $d=mysqli_fetch_assoc($db)) {
                  echo "<option value='{".$d['service_lines']."}'>".$d['service_lines']."</option>";
                  }
                  ?>
               </select>  
               <button type="submit" name="save" class="btn btn-primary">SEARCH</button>
       </form>
   </div>
</div>

-- This is the part of the results page that uses POST data to run the query --

<?php

include "config.php";

if (isset($_POST["save"])> 0) {
    $service_lines = htmlspecialchars($_POST['service_lines']);
    $sql = "SELECT * FROM subconsultants WHERE service_lines LIKE '$service_lines'";
    $result = mysqli_query($conn, $sql);
}
?>

Answer 1

Added more information as requested by @zth_codes

in line:

echo "<option value='{".$d['service_lines']."}'>".$d['service_lines']."</option>";

curly braces are no needed: remove them

in line:

$sql = "SELECT * FROM subconsultants WHERE service_lines LIKE '$service_lines'";

must be added % to let the LIKE operator work: LIKE '%$service_lines%'

and using paramters instead of string concatenation will prevent SQL injections

Example of using prepared statements and parameters in the query and further recommendations

A possible example for prepared statement with parameters can be this:

<?php

include 'config.php';

if (isset($_POST['save'])) {
    
    $sql = 'SELECT * FROM subconsultants WHERE service_lines = ?';
    
    $stmt = mysqli_stmt_init($conn);
    mysqli_stmt_prepare($stmt, $sql);
    mysqli_stmt_bind_param($stmt, 's', $_POST['service_lines']);
    mysqli_stmt_execute($stmt);
    
    $result = mysqli_stmt_get_result($stmt);
    $row = $result->fetch_array();
}

It's a bit more verbose but avoids SQL injection.

I also replaced the LIKE operator with the = operator in the query, since it doesn't seem to me that partial searches are needed: this way you will also benefit from any indexes on the search column

Another tip: don't use double quotes in strings unless necessary: ​​double quotes always make the string go through special character handling and variable expansion.

Finally, I advise against closing the PHP code with the ?> tag if there are no further lines of HTML in the PHP file: any empty and invisible lines in the code after the ?> tag are interpreted as (unwanted) HTML lines