Checking for a value in a database

marcebra

Hello,
I am having troubles with people trying to "play around" with my database. What I have right now is a php page like this: www.mydomain.com/members.php?name=John. That page looks into my database and gets John's information and prints it out. BUt the problem starts if someone types: members.php?name= and they leave the name variable blank. php just prints out a bunch of random text.
I would appreciate any assitance

sarahk

before you run your query you should

if (!empty($name)) $name = addslashes($name);
else showLogin();
//where showLogin() redisplays the login page or whatever.

marcebra

Thanks for the response, but I must have not articulated myself correctly: I have a php page that says:

<?
$database = mysql_query("SELECT * FROM online WHERE person=$name",$db);

I need a code that tells the the php functions not to work (or something like that) so i don't receive an error on the page. I tried writing "or die" after the mysql_query -- it worked but didn't load the rest of my page ( i have a whole footer that is many lines long).

marcebra

Got it!
I added this:

$error = implode("\n",file("error.php"));
and
after the mysql_query added:
or die ($error);

The only thing is that I cannot do it without taking away the "\n". Is there a way to write this script without it?

rklapwijk

page: members.php?name=whatever
<?php
$database = mysql_query("SELECT * FROM online WHERE person=$name",$db); 
$resultcount = mysql_numrows($database);
if ($resultcount >= "1") echo "WHEEEHEEE, $name exists!";
else echo "This member does not exists, can't you spell?";
?>