Building a mySQL query in FlashMX

Sleeve

Hello,

I have a flash form that builds a mySQL query dynamically then sends it as a variable to a PHP form. The php code:

$itemOne = $_GET['expresOne'];
@mysql_select_db('incoming') or die(mysql_error());
  $query="SELECT * FROM reg_account WHERE $itemOne";
  $result=mysql_query($query);
  if (mysql_num_rows($result) == 1) {
		echo "stat_txt=found";
	} else {
		echo "&stat_txt=not found&";
	}

expresOne is the variable sent from the flash form and it is supposed look like this:

expresOne='businessName'='myBusiness' AND 'city'='myCity' AND 'zip'='myZip';

I tried to simulate the PHP MyAdmin query window but for some reason I get this error:

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in c:\inetpub\wwwroot\php\get_client.php on line 14
&stat_txt=not found&
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in c:\inetpub\wwwroot\php\get_client.php on line 20

Is there anyone that has had this trouble before? Are there any suggestions you may have? Also, I have tried using both POST and GET.

Thanks in advance...

LordShryku

Most common reason for that error is because of an error in your SQL statement. Try this:

$query="SELECT * FROM reg_account WHERE ".$itemOne;
$result=mysql_query($query) or die(mysql_error()."<br><br>".$query);

This will show the error and the parsed SQL query.

Sleeve

That is a big help!

Here is what is happening now.

You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '\'myCompany\'' at line 1

SELECT * FROM reg_account WHERE companyName=\'myCompany\'

Is there an unescape sequence I need to use?

LordShryku

Are the php tags here cutting off something?

Looks like you have slashes there?

If so, try setting itemOne like this

$itemOne = stripslashes($_GET['expresOne']);

Sleeve

yeah baby yeah! That did it.

It would appear Flash uses an escape sequence when sending string literals so as to prevent itself from interpreting them as bitwise operators. All I needed to do was strip the backslashes like you showed me and it works!

Thanks LordShryku, I owe you.

LordShryku

No prob bob 😃