[Resolved] passing variable in url intermittent problem

simcoles

Hi,

I am new to php and am trying to write an image gallery script. It is database driven through MySQL. I have a page which generates thumbnails from info held on the database. The thumbnails are links which pass the image id to a script which displays the full size image with info. My problem is that it seems to be very hit and miss whether the image displays or I get a blank screen.

Here is the script:

<?php
mysql_select_db($database_Images, $Images);
$query_Recordset1 = "SELECT * FROM image_list where image_type='CA'";
$Recordset1 = mysql_query($query_Recordset1, $Images) or die(mysql_error());
$result = mysql_query ($query_Recordset1, $Images);
$rowcount = mysql_num_rows($result);
$count =0;

echo "<div id=\"box1\"><table cellpadding=0 cellspacing = 10 border=0 align=\"center\">";
echo "<tr>\n";

while ($newArray = mysql_fetch_array($Recordset1)) {
$id = $newArray ['id'];
$name = $newArray ['item_name'];
$desc = $newArray ['item_desc'];
$price = $newArray ['item_price'];
$url = $newArray ['url'];
$count ++;

echo "<td width = \"100\" align = \"center\" valign=\"bottom\">";
echo "<a href = \"http://cgi.coles3.plus.com/showimage.php?id=$id\" target=\"_self\"><img src=thumb//$name border=3></a><br>";
echo "<div align=\"left\">";
echo "CA"; printf ("%04d", $id);
echo "</td>\n";

And here is the showimage.php script

<?php
// Do your code to connect to mySQL db etc.
require_once('Connections/coles3_pn.php');
// Then do this
if (isset($_GET['id'])) {

$id = ($_GET['id']);

$sql = "SELECT * FROM image_list WHERE id=$id";

if ($result = mysql_query ($sql)) {
$row = mysql_fetch_array ($result);
$fullpath = $row['item_name'];
$price = $row['item_price'];
$desc = $row['item_desc'];
$size = $row['size'];
$type = $row['Image_type'];
$url="Ceramics.php";

if ($type == "DI") {
($url = "Digital.php");
}
else {
($url = "Ceramics.php");
}

//echo $fullpath;
echo "<div id=\"box1\" align=\"center\">";

echo "<table width=\"600\" cellpadding=\"20\" border=\"0\" bgcolor=\"#bad3f3\" align=\"center\">
<tr><td rowspan=\"2\" width=\"400\">\n<a href = \"$url\">
<img src=\"Thumb1/$fullpath\" alt=\"click on image to return to Gallery\" border=2></a><br>\n";
echo "<td valign=\"bottom\">($desc)</td></tr>
<tr><td valign=\"bottom\">£$price.00<br>($size)</td></tr>
</table>\n</div>";
}

}

bradgrafelman

Use

 tags when posting PHP.

Also, the while() statement in the first script appears to be missing an ending curly bracket ( '}' ). Maybe you just didn't post the entire script, I don't know.

simcoles

Sorry about that, that was my first post and I wasn't sure of forum protocols.

here is my code within the tags and you were right I didn't post the whole script last time.

Hope this is ok

<?php require_once('Connections/coles3_pn.php');?>

(HTML bits go here)

<?php
mysql_select_db($database_Images, $Images);
$query_Recordset1 = "SELECT * FROM image_list where image_type='CA'";
$Recordset1 = mysql_query($query_Recordset1, $Images) or die(mysql_error());
$result = mysql_query ($query_Recordset1, $Images);
$rowcount = mysql_num_rows($result);
$count =0;

echo "<div id=\"box1\"><table cellpadding=0 cellspacing = 10 border=0 align=\"center\">";
echo "<tr>\n";	

while ($newArray = mysql_fetch_array($Recordset1)) {
	$id = $newArray ['id'];
	$name = $newArray ['item_name'];
	$desc = $newArray ['item_desc'];
	$price = $newArray ['item_price'];
	$count ++;

echo "<td width = \"100\" align = \"center\" valign=\"bottom\">";
echo "<a href = \"http://cgi.coles3.plus.com/showimage.php?id=$id\" target=\"_self\"><img src=thumb//$name border=3></a><br>";
echo "<div align=\"left\">";
echo "CA"; printf ("%04d", $id);
echo "</td>\n";

if (($count)%6 ==0) {
echo "</tr>\n<tr>\n";

}



}
echo "</table>";
echo "</td>";
echo "</table>";
?>

</body>
</html>

<?php
//mysql_free_result($Recordset1);
?>

and her is showimage.php

<?php
// Do your code to connect to mySQL db etc.
require_once('Connections/coles3_pn.php');
// Then do this
if (isset($_GET[id])) {

$id = $_GET[id];

$sql = "SELECT * FROM image_list WHERE id=$id";

if ($result = mysql_query ($sql)) {
$row = mysql_fetch_array ($result);
$fullpath = $row['item_name'];
$price = $row['item_price'];
$desc = $row['item_desc'];
$size = $row['size'];
$type = $row['Image_type'];

if ($type == "DI")	{
($url = "http://cgi.coles3.plus.com/Digital.php");
}
else {
($url = "http://cgi.coles3.plus.com/Ceramics.php");
}

//echo $fullpath;
echo "<div id=\"box1\" align=\"center\">";

echo "<table width=\"600\" cellpadding=\"20\" border=\"0\" bgcolor=\"#bad3f3\" align=\"center\">
<tr><td rowspan=\"2\" width=\"400\">\n<a href = \"$url\">
<img src=\"Thumb1/$fullpath\" alt=\"click on image to return to Gallery\" border=\"2\"></a><br>\n";
echo "<td valign=\"bottom\">($desc)</td></tr>
<tr><td valign=\"bottom\">£$price.00<br>($size)</td></tr>
</table>\n</div>";
}

} 

?>

</body>
</html>

I hope this is clearer,

thanking you in advance

bradgrafelman

Hmm. Is there any chance you can post a link to this script?

EDIT: The only 'error' I see is not really a true error; just an improper coding style. This:

$id = $_GET[id];

is telling PHP that 'id' is a constant, when it's not; it's an index. It should be:

$id = $_GET['id'];

(as should all other indeces, like you have $row array). That isn't a real problem, unless you actually have a constant named 'id', as PHP will throw out a warning if it can't find the constant and assume it to be a string.

Again, a link would be very helpful here.

EDIT2: Also, once we resolve this, we might want to talk about SQL injections, as it looks like you are vulnerable (unless you have the magic_quotes_gpc set to On).

simcoles

Thankyou for taking the time to look at my script.

The

$id = $_GET[id];

was a product of trial and error as it wasn't working with
the code

$id =$_GET['id'];

so thankyou for the explanation of exactly what they signify.

The link to my test site is

[url]http://www.coles3.plus.com[/url]



The individual links to the pages I have listed are:

[url]http://cgi.coles3.plus.com/Ceramics.php[/url]

and 

[url]http://cgi.coles3.plus.com/showimage.php[/url]

I hope these help.

Also I am very new to MySQL as well so would be grateful if you could give me more info on the SQL injections issue.  I am not sure whether the magic_quotes_gpc are on or off (how do i find out?)

Thanks again

rikmoncur

Plusnet's got magic_quotes_gpc set to On

bradgrafelman

Search the board for more info; SQL Injections have been brought up countless times before. Here's a simple script (independent of server settings) to help block it:

if (get_magic_quotes_gpc()) { 
  $field1 = mysql_real_escape_string(stripslashes($_POST['field1']), $mysql_link);
} else { 
  $field1 = mysql_real_escape_string($_POST['field1'], $mysql_link);
}

(and so on for the rest of your form fields).

EDIT: Also, I couldn't find a problem on your website...

simcoles

Thankyou both yor your comments,

I will look closely at the security issues.

I am pleased that you can't find any fault with my script.
However, the fact still remains that it doesn't work!!!!

I have had at least five independent people attempting to access the pages I have linked and each time there has been a problem.
As I have said it doesn't happen all the time, once the script works it seems to happen all (or most of the time), but equally if it doesn't work it won't work at all .

It seems that if it doesn't work the first time if you manually refresh the page it will work. But what is the reason for this?

If there is nothing wrong with the script what other errors could occur?

This is driving me crazy.

Could it be a server setting problem?

simcoles

Dear all,

thanks for all the help.
I have discovered the problem, which is that I had forgotten to include

Mysql_select_db

etc.......