$_GET not recognised in SQL statements

[Oracle]

Hi All,

I have a couple of SQL statements which I'm struggling with. I'm passing a variable called 'lea' in the url, but when I try and 'get' it using SQL it seems to ignore it.

I know the variable is set as if I print it to the screen it displays correctly.

The first statement is

select * from table where column = '".$_GET['lea']."'

I haven't had this problem with other similar statements.

The other statement is an insert

insert into table (site_id, site_name) values ('".$_GET['lea']."','".$_POST['sitename']."')

Again no problems with other similar statements. The insert seems to simply ignore this and insert the default value of 0, but the select returns an error stating an error in in SQL syntax:

select * from table where column =

so it effectively can't see the $_GET variable?

Any ideas?

[drzoid]

Can you post the actual code?

[Oracle]

The code is just an SQL statement so I'm not sure it will help, but here you go:

$result=mysql_query("insert into ora_details (site_id, site_name, dba_subscriber, os_used, os_version, ora_version,
                    conn_type, server_ip, server_subnet, server_gateway, ora_port_no, db_name1, db_name2, server_use,
                    ras_user, ras_pass, ras_sp_det, ras_dial, direct_dial, pc_any_user, pc_any_pass, os_user, os_pass,
                    vpn_name, vpn_user, vpn_pass, vpn_det, web_url, add_det, timestamp)
                    values
                    ('".$_GET['lea']."','".$_POST['sitename']."','".$_POST['dbasub']."','".$_POST['osused']."','".$_POST['osversion']."',
                    '".$_POST['oraver']."','".$_POST['conntype']."','".$_POST['serverip']."','".$_POST['serversub']."',
                    '".$_POST['servergate']."','".$_POST['oraportno']."','".$_POST['dbname1']."','".$_POST['dbname2']."',
                    '".$_POST['serveruse']."','".$_POST['rasuser']."','".$_POST['raspass']."','".$_POST['rasspdet']."','".$_POST['rasdial']."',
                    '".$_POST['directdial']."','".$_POST['pcanyuser']."','".$_POST['pcanypass']."','".$_POST['osuser']."',
                    '".$_POST['ospass']."','".$_POST['vpnname']."','".$_POST['vpnuser']."','".$_POST['vpnpass']."',
                    '".$_POST['vpndet']."','".$_POST['weburl']."','".$_POST['adddet']."', now())") or die(mysql_error()); 

This is run is there are no errors found. As I said before, the rest of the data is being inserted, but just not the first column.

[rokc]

try echoing $_GET['lea']

[Oracle]

Already have (see my first post). It works fine.

Thx anyway.

[spikeZ]

Try putting the get variable into an ordinary variable then use that in your query.

[awulf]

does the variable contain a string value with the character ' in it? you might need to addslashes($_GET['lea']) to prep the value for the query

[Oracle]

it is just a number. In the first instance it was lea=1 in the url. This didn't insert, so I tried changing the statement to add a 1 instead of the variable and this did work.

The column is tinyint(3) so its not expecting a string.

[Oracle]

Hi Spikez,

Thanks, I did try that, but it also didn't work.

[awulf]

what happens if you store that sql string as a var, $sql, and echo $sql ? maybe that'll give us more info than the mysql_error and let us see exactly what you're sending in...

[guido2004]

If the first column is defined tinyint, maybe you should eliminate the ' around the value:

$result=mysql_query("insert into ora_details (site_id, site_name,  dba_subscriber, os_used, os_version, ora_version, 
                    conn_type, server_ip, server_subnet, server_gateway, ora_port_no, db_name1, db_name2, server_use, 
                    ras_user, ras_pass, ras_sp_det, ras_dial, direct_dial, pc_any_user, pc_any_pass, os_user, os_pass, 
                    vpn_name, vpn_user, vpn_pass, vpn_det, web_url, add_det, timestamp) 
                    values 
                    (".$_GET['lea'].",'".$_POST['sitename']."','".$_POST['dbasub']."','".$_POST['osused']."','".$_POST['osversion']."', 
                    '".$_POST['oraver']."','".$_POST['conntype']."','".$_POST['serverip']."','".$_POST['serversub']."', 
                    '".$_POST['servergate']."','".$_POST['oraportno']."','".$_POST['dbname1']."','".$_POST['dbname2']."', 
                    '".$_POST['serveruse']."','".$_POST['rasuser']."','".$_POST['raspass']."','".$_POST['rasspdet']."','".$_POST['rasdial']."', 
                    '".$_POST['directdial']."','".$_POST['pcanyuser']."','".$_POST['pcanypass']."','".$_POST['osuser']."', 
                    '".$_POST['ospass']."','".$_POST['vpnname']."','".$_POST['vpnuser']."','".$_POST['vpnpass']."', 
                    '".$_POST['vpndet']."','".$_POST['weburl']."','".$_POST['adddet']."', now())") or die(mysql_error()); 

[HardCoded]

Set error level to E_ALL

[Rebort]

I suspect it's a problem with your form; I assume the _GET value shows up in the query string in the URL, yes?

How are you passing both _GET and _POST values at the same time? (It makes a difference).

And did you try seeing if any _GET and _POST values are set with:

print '<pre>'; print_r($_GET); print '</pre>';
print '<pre>'; print_r($_POST); print '</pre>';

[awulf]

also, as long as you aren't using the same variable name in both _GET and _POST, you could just use $_REQUEST instead (which is simply the combination of _GET and _POST)

[Oracle]

Thanks for all your suggestions guys.

Fortunately I figured it out after setting error reporting to E_ALL. The $_GET['lea'] was not defined after submiting the form. This is because is only had the form action set to PHP_SELF so it was not parsing the lea variable before processing the code. I changed this to:

<?php echo $_SERVER['PHP_SELF']."?lea=".$_GET['lea']; ?>

and it works fine.

Thanks again

[spikeZ]

oooh don't you hate those little problems!

SpikeZ