A user checks off a series of checkboxes and the form results are sent to the next page in an array. Then on the second page, it uses the form results to filter the recordset and only display the profiles of users with the UID sent from the checkboxes. The UID is an integer that is unique to each profile. Although, the profile is made up from data from many tables that all share the same UID. There might be multiple records in a table for that UID. I think the sql statement I have used here is causing an issue. Thanks in advance for your help.
Code:
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
if (PHP_VERSION < 6) {
$theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
}
$theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);
switch ($theType) {
case "text":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "long":
case "int":
$theValue = ($theValue != "") ? intval($theValue) : "NULL";
break;
case "double":
$theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
break;
case "date":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "defined":
$theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
break;
}
return $theValue;
}
}
mysql_select_db($database_connect, $connect);
$idList = implode(',', $_POST['UID']);
$sql = 'SELECT *, scholarships.NAME as scholarshipname FROM scholarships, gc_codes, users INNER JOIN stu_app2008 ON users.UID = stu_app2008.UID INNER JOIN activities ON users.UID = activities.UID INNER JOIN coll_exp ON users.UID = coll_exp.UID INNER JOIN employ ON users.UID = employ.UID INNER JOIN fin_app ON users.UID = fin_app.UID INNER JOIN finaid ON users.UID = finaid.UID INNER JOIN stu_special ON users.UID = stu_special.UID WHERE gc_codes.GCID = users.GC and scholarships.ID = stu_special.ID and UID in (' . $idList . ')';
$res = mysql_query($sql);
$varlist = array();
while ($row = mysql_fetch_assoc($res)) {
$varlist[$row['UID']] = $row;
}
?>
The issue is that the SQL is broken and being a newbie, I am not sure how to fix it. I use the variables from the select statement in the body of the page like this
This is the error message that I get which seems to mean there is an error in my sql statement. It does nothing except display this. It works when I selecting data from only one table but, once I add additional table names, I get this error. So, it appears that it doesn't know how to handle data coming from multiple tables. Maybe I need an additional foreach somewhere?
You could start by posting the error here and the SQL it's complaining about.
You can use the php echo statement to output string data. Or you could use file_put_contents to write string data to a file so that sensitive information is not visible to your visitors.
Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\Scholarship\admin\printable_version2_test3.php on line 87
Second, you didn't even bother checking the results of your mysql function calls. They might return an error because your SQL is broken.
I have already mentioned that problem. Don't you ever run query statements without checking for error conditions. Sounds like one of your functions is returning FALSE when you assume it will be a valid data resource in your code.
But, this brings me to the fact you are using mysql -- that was my first point:
Originally Posted by sneakyimp
First, stop using mysql (see the link in my signature).
mysqli has a procedural interface that closely mirrors the old mysql functions.
While the object-oriented API is much more natural and fluid, the procedural functions have a more gradual learning curve - choose for yourself.
An example:
PHP Code:
<?php
## procedural example ##
// create a database connection using mysqli $DB = mysqli_connect( 'databaseHost','username','password','databaseName' );
// sanitize the user-supplied data $sanitized_POST_param = mysqli_real_escape_string( $DB,$_POST['param'] );
// query $SQL = "SELECT `column` FROM `table` WHERE `column`='$sanitized_POST_param'";
Reply With Quote
Originally Posted by sneakyimp
Bookmarks