var_dump is a function that you use just for debugging, along with error_reporting - yes it can throw your displays out, but the idea is that you only debug on your development server (localhost, sat in front of you now).
You turn that off, or comment it out before you FTP your files over otherwise it can give out important information to a would-be hacker.
Use this at the very top of your scripts for a while:
PHP Code:
<?php
$debug = true ; //turn off on live server with false
if ( $debug ){
ini_set( 'display_errors',1 );
error_reporting(E_ALL);
echo '<pre>';
var_dump( $_POST );
var_dump( $_GET );
echo '</pre>';
}
// rest of your script down here:
// then - something is not quite right?
// take a close look at the variable
if( $debug ) var_dump( $variable_name );
?>
And it will splurge out errors with some good detail when you make the most common errors.
I wouldnt say youd use this everywhere, but when starting out, it should help you post succinct and more informed questions here that are more likely to get you a fast answer.
Your original code had these lines at the top;
PHP Code:
if(isset($_GET['shoe'])){
$sel_shoe = $_GET['shoe'];
}else { $sel_shoe = "";
While valid, they don't do very much - you could both check shoe was set and typecast it to an integer and then check it was not 0.
I started writing that, but scrubbed it because it did not answer your question.
Imagine your script goes on over a few hundred lines, and you then find this line:
PHP Code:
<?php $qry = "SELECT shoename
, price
, moreinfo
FROM shoes
WHERE
kind_id = " . $shoe_id ;
?>
You may well scratch your head and think, "where the hell did that variable come from?"
You may also say to yourself, did I check it yet? Has it been cleansed?
PHP Code:
<?php $qry = "SELECT shoename
, price
, moreinfo
FROM shoes
WHERE
kind_id = " . (int) $_GET['shoe'] ;
?>
Whereas what that is, where it came from is pretty obvious.
Or, I have seen things like this done, at the top of your page.
PHP Code:
if( isset( $_GET['shoe']) && (int)$_GET['shoe'] > 0 ){
$cleansed_shoe_id = (int)$_GET['shoe'];
}else {
// send the user away, invalid request or shoe not selected
}
This is all a matter of personal preference, and you are free to do what you want, whichever way suits you ( or whichever is easiest to remember 
) as long as you are consistent - easier said than done!
What would have helped you sort this out yourself would have been this line:
PHP Code:
if( $debug ) echo $query ;
and to have pasted that query into PhpMyAdmin and you would have seen this was an sql error and nothing to do with PHP.
Bookmarks