Parms not passing from array

ErocM

I am overlooking something... it's one of those duh moments where I have looked to long and cant find it. Can you guys/gals help me?

I have the following lines:

if ($cookie[1] != "") {
    $sql = "SELECT name, username, user_email FROM nuke_users WHERE user_id='$cookie[0]'";
    $result = $db->sql_query($sql);
    $row = $db->sql_fetchrow($result);
    if ($row[name] != "") {
	$sender_name = $row[name];
    } else {
	$sender_name = $row[username];
    }
    $sender_email = $row[user_email];
}

What my problem is, my $send_name will not populate from the $row[username] array. The $row[username] is being populate, I tested that by outputting it to screen.

My sql works since I ran it on the db itself via mysqladmin and it returned the info fine including email and user_id.

I cannot get $row[username] to go into $sender_name no matter what I do ! I put in a test to see with if/else statment its getting into and it's makeing it to the $row[username] but not putting it in the $sender_name.

Any ideas?

Thanks,
Eroc

jim_keller

Are you sure that $row['name'] is blank? I would put a debug statement in just to make sure (as I did below). Some general coding comments though:

use ' ' around your hash keys. For instance, use $row['username'] instead of $row[username]. If username happens to be declared as a constant somewhere, it could be causing the problem you're seeing below. Also, do you mean to be using $_COOKIE[1], or is $cookie your own local variable?
Unless you're checking that $cookie[0] has a valid value, you shouldn't be passing it to the SQL directly. Cookies can be edited by the user, and if you pass them directly to your query, you open yourself to SQL injection (when someone can maliciously edit the query). You should run it through a regular expression first. For instance, if $cookie[0] can only contain letters, numbers, underscores, dashes & spaces, do something like:

if ( preg_match('/[^A-Za-z0-9\-_\s]/', $cookie[0]) ) {
        die( "invalid cookie data"); //or a better error than this...
}

when you access an array in a string like you did in your query, surround it with { }. For instance, "Here's a variable: $arr[1]" should be "Here's a variable: {$arr[1]}";

So, your code should look more like:


if ( $cookie[1] != "" ) { 
    $sql = "SELECT name, username, user_email FROM nuke_users WHERE user_id='{$cookie[0]}'"; 
    $result = $db->sql_query($sql) OR die ("Couldn't execute query");
    $row = $db->sql_fetchrow($result); 
    if ($row['name'] != "") { 
    $sender_name = $row['name']; 
    } else {

echo "I found a username: {$row['username']}<BR />\n";     // just for debugging 
$sender_name = $row['username']; 
} 
$sender_email = $row['user_email']; 
}

-Jim Keller
http://jim.centerfuse.net/projects/

ErocM

I'm still testing as to which made the difference... I assume all since I cut and paste what you put as an example and it worked great btw !! Thanks !!

Anyways thanks for the info, I'll research it and learn from it.

Thanks again,
Eroc