Display Database info

Dillenger

Why doesn't this code work? what am I doing wrong?

$sql3 = "select * from pageinfo WHERE id=1";

				$result3 = mysql_query($sql3);
				while ($directory = mysql_fetch_array($result3)) {

				$bio1 = stripslashes($bio1);

				$id=$directory['id'];
				$bio1=$directory['bio1'];
    			$phone1=$directory['phone1'];
				$email1=$directory['email1'];
				}

tbach2

did you connect?

Dillenger

Yeah i did, here is my full code, its wierd, cause I have another page with basically the exact same code, and it works fine.

<?PHP
					//STEP 1 - CONNECT TO DATABASE
					require('config.php');
					$cid = mysql_connect($host,$usr,$passwd);
					if (!$cid) {
					echo("ERROR: " . mysql_error() . "\n");
					}

				//STEP 2 - UPDATE & ADD INFORMATION
				if ($REQUEST_METHOD=="POST") {

				$bio1 = addslashes($bio1);

				$SQL = " UPDATE pageinfo SET";
				$SQL = $SQL . " bio1 = '$bio1', ";
				$SQL = $SQL . " phone1 = '$phone1', ";
				$SQL = $SQL . " email1 = '$email1' ";
				$SQL = $SQL . " WHERE id = '1' ";

				$result = mysql_db_query($db,"$SQL",$cid);

				echo "INFORMATION UPDATED!!!";

				}

				//STEP 3 REMOVE SLASHES FROM TEXT BOXES

				$sql3 = "select * from pageinfo WHERE id='1'";

				$result3 = mysql_query($sql3);
				while ($directory = mysql_fetch_array($result3)) {

				$id=$directory['id'];
				$bio1=$directory['bio1'];
    			$phone1=$directory['phone1'];
				$email1=$directory['email1'];
				}
				?>

tbach2

what's the error?

tekky

in my experience, single ticks arond numerical values doesnt always bode well in SQL

try WHERE id=1 instead of '1' on your queries

tbach2

make sure they are single quotes, not a backtick!

I have never had any problems with single quotes. Note what the mysql documentation says about it as relates to security:

# Do not trust any data entered by your users. They can try to trick your code by entering special or escaped character sequences in web forms, URLs, or whatever application you have built. Be sure that your application remains secure if a user enters something like ``; DROP DATABASE mysql;''. This is an extreme example, but large security leaks and data loss may occur as a result of hackers using similar techniques, if you do not prepare for them. Also remember to check numeric data. A common mistake is to protect only strings. Sometimes people think that if a database contains only publicly available data that it need not be protected. This is incorrect. At least denial-of-service type attacks can be performed on such databases. The simplest way to protect from this type of attack is to use apostrophes around the numeric constants: SELECT FROM table WHERE ID='234' rather than SELECT FROM table WHERE ID=234. MySQL automatically converts this string to a number and strips all non-numeric symbols from it.