$_GET Variable

[NickToye]

Hi,

If I have a link that opens up a page and passes the URL like so:

<a href="handmade_range.php?handmade_id=<?php echo $row_handmade['handmade_id']; ?>"><?php echo $row_handmade['handmade_name']; ?></a>

And on that page it displays the right information.

At the moment it just displays all the information that is associated with the first record in the database. So i'm assuming that I need to work on the query:

$handmade_sql = mysql_query("select * from handmade WHERE handmade_id = handmade_id") or die(mysql_error());
$row_handmade = mysql_fetch_assoc($handmade_sql);

This actually doesn't work, but I can't see why.

Like I said earlier PHP isn't my best, but you should have seen me last year.

Any help would be great.

[clamcrusher]

try

WHERE handmade_id = $_GET[handmade_id]

[NickToye]

Hi,

I've tried this:

$id = $_GET['handmade_id'];

# run the query to get the info from the database
$handmade_sql = mysql_query("select * from handmade where handmade_id = $id") or die(mysql_error());
$row_handmade = mysql_fetch_assoc($handmade_sql);

[clamcrusher]

if $id is not a number, you should quote it

$handmade_sql = mysql_query("select * from handmade where handmade_id = '$id'") or die(mysql_error());

[NickToye]

Ok cheers,

But its good practice to create variables at the start right? Rather than hardcoding.

[clamcrusher]

-yes it generally is.

i dont always use best practices when trying to show people what they need to do, im more concerned with getting the point across.

but speaking of best practices, you _really_ should use mysql_real_escape_string() on any variable before you put it into an sql query.

take a look here for how to use it
http://us2.php.net/manual/en/functio...ape-string.php
(theres a best practice example)