Help getting a price from my database

**dthomas31uk** · Oct 14, 2008 00:54

Hi. I have created a database called europe and a table called eu_place with the following fields and data

----------------------------------------------------------------------
id | country | city | full_price | half_price

1 | France | Paris | 50 | 50

2 | Spain | Barcelona | 70 | 85

Now what I am trying to do is to show a user a price based on the country selected from a drop down list, a city selected from a drop down list and then the user chooses full load price or half load price for that city and it displays the price.

I have managed to get the user to choose the country and city and I get the user to chooses the full load price or half load price but I think something is not right with my SQL.

This is the code that calculates the results, not sure if it is to do with the sql statement

PHP Code:


if ($load =='full_load'){

$result=mysql_query("SELECT full_price from eu_place where city = '$subcat' "); }

else {$result=mysql_query("SELECT half_price from eu_place where city = '$subcat' "); }

here is all the code

$cat is the country
$subcat is the city
$load is the radio button full load or half load

Hope someone can help cheers guys, its been tearing my hair out

PHP Code:


<?php

include 'dd.php';

?>







<!doctype html public "-//w3c//dtd html 3.2//en">



<html>



<head>

<title>Demo Multiple drop down list box from plus2net</title>

</head>



<body>

<?php

$cat=$_POST['cat'];

$subcat=$_POST['subcat'];

$load=$_POST['load'];

echo "Value of \$cat = $cat <br>Value of \$subcat = $subcat"."<BR>";

echo "Value of \$load = $load";





if ($load =='full_load'){ 

$result=mysql_query("SELECT full_price from eu_place where city = '$subcat' "); }

else {$result=mysql_query("SELECT half_price from eu_place where city = '$subcat' "); }





echo mysql_error();

while ($row = mysql_fetch($result)) {

echo $row;

}



?>



</body>



</html>

**Dan Grossman** · Oct 14, 2008 01:10

The query is OK (but vulnerable to SQL injection attacks), but there is no function called mysql_fetch.

Try this:

PHP Code:


$result = mysql_query("SELECT full_price, half_price FROM eu_place WHERE city = '" . mysql_real_escape_string($subcat) . "'") or die(mysql_error());
$row = mysql_fetch_array($result);

if ($load == 'full_load') {
  echo $row['full_price'];
} else {
  echo $row['half_price'];
}

**dthomas31uk** · Oct 14, 2008 07:44

Dan you are a star that works a treat thank for your time much appreciated. What do you mean vulnerable to attacks?

**tmapm** · Oct 14, 2008 11:02

The variables inside your query were not escaped. As a result, someone can manipulate your query by writing SQL into your variable.. Search the forums and internet for SQL Injections and read...

http://phpsec.org/projects/guide/3.html#3.2

User Tag List

Thread: Help getting a price from my database

Thread Tools

Display

Help getting a price from my database

Bookmarks

Bookmarks

Posting Permissions