mysql_num_rows issue

[teamhonda81]

Ok, I don't know why I'm getting this warning because I've ran the sql query in MySQL and it works fine. All I'm trying to do is get some information from my database and output as xml.

Here's the warning--

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in D:\inetpub\DM Center\Version 0_2\PHP Scripts\tracklisting.php on line 10

Here's my php code

<?
	include_once("config.php");
	$artistName = $_GET['artistName'];

//create sql statement to get artists
$sql = 'select a.ArtistName, b.TrackTitle, b.DateReleased, b.TrackLength from recording_artist a, tracks b where a.ArtistName ='.$artistName.' and b.ArtistID = a.ArtistID LIMIT 0, 30';	
$result = mysql_query($sql);
echo $result;
$num_results = mysql_num_rows($result);

echo '<?xml version="1.0" encoding="iso-8859-1"?>';
echo '<trackListing>';
	for($i=0; $i<$num_results; $i++)
	{
		$row = mysql_fetch_array($result);
		echo '<attributes>';	
		echo 	'<tracks>';
			echo stripslashes($row['a.ArtistName']);
			echo stripslashes($row['b.TrackTitle']);
			echo stripslashes($row['b.DateReleased']);
			echo stripslashes($row['b.TrackLength']);
		echo 	'</tracks>';
		echo  '</attributes>';	
	}
echo '</trackListing>';
?>

Does anyone know why I keep getting that warning?

[devinemke]

your query is failing. use [man]mysql_error[/man] to see why.

[cahva]

You have to put other than numeral values in quotes. Usually its best to put quotes to numeral values also.

$sql = "select a.ArtistName, b.TrackTitle, b.DateReleased, b.TrackLength from recording_artist a, tracks b where a.ArtistName ='".$artistName."' and b.ArtistID = a.ArtistID LIMIT 0, 30";

[teamhonda81]

thanks cahva, that seemed to have fixed the problem

[Matt_Kindig]

Your method of using the value of the $GET parameter directly in the query makes you vulnerable to SQL injection attacks. You should replace this:

$artistName = $_GET['artistName'];

with this:

$artistName = mysql_real_escape_string($_GET['artistName']);

Do a Google search for SQL Injection to get an idea of why this is dangerous, and other ways to prevent your database from being compromised.