[RESOLVED] Using href for functions

shifty18

i am trying to active a function if a hyperlink is pressed. I thought of using the hyperlink to set a varible to say 1 (default being 0). Now i need my page to do this

if $process = '1'
{
processorder()
}

and if its set to 0 do nothing basically, its just if that var changs to 1 that i want something to happen and the only time the var changes is if that 1 link is pressed and that can be at any time (obvislly being a web page). I thought the hyperlink could just be <a href=\"ViewOrders2.php?content=1\">Order Processed</a>

Anyone know how i can do this, or a better way if they know

thanks
Chris

thorpe

place a value in the querystring of your link.

then, in php;

if (isset($_GET['action'])) {
  if ($_GET['action'] == 'foo') {
    foo(); //
  }
}

shifty18

ahh yeah good idea, thanks for that it works, except i cant get my sql script running, anyone know why this doesnt work, i think it could be that $_Get['id'] is a var from outside the function but i dont know much about functions to comment


function ProcessOrder()
{
	echo 'The Function Works';
	mysql_query("SELECT processed FROM orders WHERE id=".$_GET['id']);
	mysql_query("UPDATE orders SET processed = '1' WHERE id=".$_GET['id']);
	return;
}

Thanks
Chris

jara06

eeer... wheres the security in that ?
at least wrap it once like

function fictive()
{
$nr = (int)  $_GET['id'];
mysql_query("SELECT * FROM some WHERE id='". $nr ."' LIMIT 1";
return;
}

you could use sprintf instead of casting the var or is_numeric or something ... at least do something. The other way around, you would be vary vulnerable to sql injections...

shifty18

i know it wasnt secure but i was trying to make it work first, but i still cant get the id in to the varible and i tired

$id = $_GET['id'];

function ProcessOrder($id)

but that still didnt work. What is the $nr = (int) $_GET['id']; bit?

thorpe

$_GET[] is available globally so it should be fine. do a die calling mysql_error() after each query to see what the error is. eg;

mysql_query() or die(mysql_error());

jara06

the "$nr = (int) $GET['id'];" is casting. It roughly converts the $GET['id'] to an integer, so and int is stored in $nr. PHP4 is more or less typeless, so here it would be used to avoid strings like "asdadd124,-.jfdd" to get into $nr.
Not pretty, but a quick workaround. Sprintf is better! www.php.net/sprintf

thorpe

to test for $GET just echo it.

function ProcessOrder() {
  echo $_GET['id'];
}

anyway... what do you meen by doesnt work? do you expect this function to return something? or are the queries not excecuting?

a query returning results (as in a SELECT) will need to be assigned to a var if you want these results. eg;

$result = mysql_query("SELECT processed FROM orders WHERE id=".$_GET['id']);

shifty18

Yeah i have heard of sprintf which is whyi was confused a little. No the SQL doesnt return results if you look at the send sql statement it simply runs the update query which adds a 1 in to the field 'Processed' in my database which shows that is has been processed. My page shows all orders which have not been processed by only showing the orders of 'processed = 0'

shifty18

ok i now have

function ProcessOrder() 
{ 
echo $_GET['id']; 
echo 'The Function Works'; 
mysql_query("SELECT processed FROM orders WHERE id=".$_GET['id']);
mysql_query("UPDATE orders SET processed = 1 WHERE id=".$_GET['id']);
return; 
}

and it doesnt return the var id but it does echo the The Functions Works statement

but if i include the die (mysql_error()) commands i get

You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

but line 1 is simply my connections command but that works since my orders are echo'ed from the DB

shifty18

Here is my total code from top down to the function, can anyone see a problem on why i would get the error

"You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1" for the function, i know its the function thats erroring and i know its not the MySQL connection because it works later on in the page


<?php require_once('../MyConnecitonsFileHere.PHP'); ?>
<?php
//The Database record set

mysql_select_db($database_AmmoBox, $AmmoBox);
$query_ViewOrders = "SELECT * FROM orders WHERE Processed = '0'";
$ViewOrders = mysql_query($query_ViewOrders, $AmmoBox) or die(mysql_error());
$row_ViewOrders = mysql_fetch_assoc($ViewOrders);
$totalRows_ViewOrders = mysql_num_rows($ViewOrders);

//Create the Process function 
if (isset($_GET['action'])) //If the varible action is set 
{ 
	if ($_GET['action'] == 'ProcessOrder') //And the varible is ProcessOrder 
	{	 
	ProcessOrder(); // Run the ProcessOrder function 
	} 
} 

function ProcessOrder() 
{ 
echo $_GET['id']; 
echo 'The Function Works'; 
mysql_query("SELECT processed FROM orders WHERE id=".$_GET['id']);
mysql_query("UPDATE orders SET processed = '1' WHERE id=".$_GET['id']) or die(mysql_error());
return; 
}

Many Thanks
Chris

RossC0

Hi,

Theres a problem with one of the queries - hence the mysql error.

Can you confirm this is a valid query:

mysql_query("UPDATE orders SET processed = '1' WHERE id=".$_GET['id']) or die(mysql_error());

shifty18

the idear behind the function is to change a field called 'processed' in my DB to 1, this means it has been processed and so wont be displayed in the 'new order list'. I have never used the update query befor I am just using a book that said "UPDATE table SET col=value"

RossC0

Is id valid ? Is it stored as a numeric or as a char or varchar?

IF so try:

mysql_query("UPDATE orders SET processed = '1' WHERE id='".$_GET['id']."'") or die(mysql_error());

shifty18

well that doesnt error but it still doesnt set the processed field to 1 ill check my spellings once more but i did that ealier

RossC0

OK - thats tells you where the error was and that it was a mysql error.

Now you need to ensure that the query is doing what you expect it is!

What are you trying to do? What is this query there for??
mysql_query("SELECT processed FROM orders WHERE id=".$_GET['id']);

Is the id passed via the url correct? what do you get if you select all the items from orders with that id ?

shifty18

actally that first query is not needed i just need the second query that updates the field in the DB. One thing to note is that the first line in the fucntion is echo $_Get['id'] and it doesnt echo this although it does echo "The Function Works" so im guessing its not getting the var even though its global, and the DB gets it because it uses it to display the orders later on in the code

shifty18

i have done this nw

cho $_GET['id'];
	echo $_GET['Date'];

and it doesnt return either so the global vars are not going into the function

RossC0

OK that explains the sql error - parse it a valid id then run the function.

Its good practise to convert incoming variables to local variables and then validate them. This will help clean the logic - stop injection attacks and clarify the code.

shifty18

i thought about that ealier but someone said the global var would work, i tried thewse but i get the same error

$id == $_GET['id'];

function ProcessOrder($id) 
{

Warning: Missing argument 1 for processorder() in d:\program files\apache group\apache\htdocs\ammobox\admin\vieworders2.php on line 22

even though i am copying exactly what i read in my PHP book

UPDATE

even with $id == '2'; i still get the missing argument error