[Resolved] SQL variable exists or not

[klik]

I want to check that the variable sent in the URL String actually exists within the database before continuing with the script to avoid errors.

The URL will be in this format :

profile.php?user_id=1

I want to check whether or not the variable, in this case 1, exists in the database.

How would i check for this?

[marian]

the only where for you to check to see if this variable exists is for you to query the database like this:

select * from table1 where id=user_id

and if the result set returns back with 0 means it doesn't exists
and if it is 1 or more then it does exists

goodluck

[klik]

Hi and thanks for your reply.

I have now included the following code :

$user_id = $_GET['user_id'];

$result = mysql_query("SELECT * FROM cms_users WHERE user_id = '$user_id'");
$result = mysql_result($result, 0);

if ($result == 0) {
	echo "That user does not exist!";
	exit();
}

else{


//Collect data about the specified user
}

It does actually work, however I get an error message above the echo'd line

Warning: mysql_result(): Unable to jump to row 0 on MySQL result index 4

[tsinka]

Hi,

change your code a little bit:

$user_id = $_GET['user_id'];

$result = mysql_query("SELECT * FROM cms_users WHERE user_id = '$user_id'");

if (mysql_num_rows($result) == 0) {
    echo "That user does not exist!";
    exit();
} else{
  //Collect data about the specified user
  $row = mysql_fetch_assoc($result);
  //example: print user_id
  echo $row['user_id'];
}

Thomas

[klik]

Thanks Thomas..works just as I had wished. 🙂

[tsinka]

My code isn't very secure. You should check if $_GET['user_id'] is set at all (isset) and if it is a numeric value (is_numeric) greater than 0. Only execute the query if that is the case.

Thomas

[klik]

I added the following, and think all validation is now covered. Thanks for your responses Thomas.

if ((!isset($user_id)) || (!is_numeric($user_id)) || (!$user_id > 0)){
	echo "That user does not exist!";
	exit();
}