Ok. So my logic is that i have a <select><?php that inserts the options [client names] ?></select> and then a text box that displays the client id depending on the client they choose from the select. here is my code:
<?php
session_start();
$con = mysql_connect($_SESSION['dbhost'],$_SESSION['dbuser'],$_SESSION['dbpass']);
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("c2_dj", $con);
$sql="SELECT * FROM clients WHERE id = '".$q."'";
$result = mysql_query($sql);
/// ;
while($row = mysql_fetch_array($result))
{
echo "Client ID: <input type=\\"text\\" readonly=\\"true\\" value=\\"" . $row['client_id'] . "\\"cliid\\" />";
}
mysql_close($con);
?>
Here Is My Problem. When I use it through my form, or enter …/cli-id.php?q=1, i get this error:
Notice: Undefined variable: q in /var/www/cge/ak/booking/new/cli-id.php on line 11 Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /var/www/cge/ak/booking/new/cli-id.php on line 17
What Amm I Doing Wrong? Any Help would be greatly appreciated.
Register Globals is off (as it should be) so the ?q=1 in the query string does NOT automatically become $q in the script. You need to access $_GET[‘q’]
That non-value is breaking your query, so mysql_query() will fail, and $result will be boolean false. That’s why your error message mentions that. Instead of $result being a resource, it’s bool false.
You need to use $_GET[‘q’]
You need to check that $_GET[‘q’] actually exists and very importantly you must ensure it’s an integer. You’re wide open to an SQL Injection attack right now.
if(isset($_GET['q'])) {
$q = (int) $_GET['q'];
$sql = "SELECT client_id FROM clients WHERE id = $q";
}
You need to check that $result actually worked (don’t just run mysql_fetch_array() assuming the query succeeded)
And you can tidy the echo statement a bit by using single quotes for your attributes that won’t need escaping
Ok so i tried to do what you said, but im getting a new error now. Perhaps i havent inserted your code correctly. I apologise as im pretty new to using php/sql for stuff like this in the past the most ive used it for was login systems so im pretty new to this.
Either way, here is my new code:
<?php
session_start();
$con = mysql_connect($_SESSION['dbhost'],$_SESSION['dbuser'],$_SESSION['dbpass']);
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("c2_dj", $con);
if(isset($_GET['q'])) {
$q = (int) $_GET['q'];
$sql = "SELECT client_id FROM clients WHERE id = $q";
$result = mysql_query($sql);
if(!isset($result))
{
echo "<B>ERROR! </B> $result did not succeed!";
}
while($row = mysql_fetch_array($result))
{
echo "Client ID: <input type='text' readonly='true' value='{$row['client_id']}' />";
}
mysql_close($con);
?>
And here is the error im getting:
Parse error: syntax error, unexpected $end in /var/www/cge/ak/booking/new/cli-id.php on line 23
Is the client_id field of your clients table an integer type (like TINYINT, SMALLINT, INT)?
If it’s a string (VARCHAR, TINYTEXT etc.) that query will fail.
Also, you can echo mysql_error($con) to help you debug. I left it out of my example because it’s better not to display those errors to your site users.
OK! i totally figured it out. it was really simple. lol. the php in the form was making the <option>s the valies in the field ‘client_name’ so when the script sent out the value of ‘q’ in tas sending ‘client_name’ and cli-id.php was trying to match up ‘client_name’ values in the ‘client_id’ fiel, which would account for the errors. ‘client_name’ is char(40) and client_id is int (i realized that because of what cranial-bore said about making sure the field was int.)
So here is what i changed:
$q = (int) $_GET['q'];
$sql = "SELECT client_id FROM clients WHERE id = $q";
changed to:
$q = (int) $_GET['q'];
$sql = "SELECT client_id FROM clients WHERE client_name = $q";
now the only problem is that when i select an option it gives me this as the output:
You need to check that $_GET[‘q’] actually exists and very importantly you must ensure it’s an integer. You’re wide open to an SQL Injection attack right now.
and added $q = (int) $_GET[‘q’] to your code?
Well that forces $q to be an integer. You’re now dealing with a name (string), so turning it into 0 won’t help anymore.
This is also why I mention echoing $sql to see what it looks like to try and debug your script.
$q is now a string (could be better named too).
So:
//Remove the (int) line
$q = mysql_real_escape_string($_GET['q']);
//Notice '$q' is now in quotes, because it's a string. Before it was not
$sql = "SELECT client_id FROM clients WHERE client_name = '$q' LIMIT 1";
//Debug. Looks right? Works in PhpMyAdmin?
echo $sql;
