[RESOLVED] please help with code

quintin

Please could you help me with my code.
I just need to pass the varibles to moredetails.php after "Click here for more details"

Code:
<?php
mysql_connect("localhost","root","pass");
mysql_select_db("db");

?>
<style type="text/css">

</style>

<?
$type = $POST["type"];
$price = $POST["price"];
$minprice = $POST["minprice"];
$maxprice = $POST["maxprice"];
$query = "SELECT * FROM propertys WHERE type LIKE '%".$POST['type']."%' AND price BETWEEN '".$POST['minprice']."' AND '".$_POST['maxprice']."'";
$result = mysql_query($query);

if (mysql_num_rows($result)) {
while ($row = mysql_fetch_array($result)) {
$picture = $row["picture"];
$price = $row["price"];
$ref = $row["ref"];
$type = $row["type"];
$erf = $row["erf"];
$size = $row["size"];
$bed = $row["bed"];
$bath = $row["bath"];
$gar = $row["gar"];
?>
<tr>
<td width="150"><span class="style1"><?php echo "<image src=\"$picture ","\" style=\"border: 2px solid black;\">

"; ?><?php echo $price = $row["price"]; ?></span></td>
<td width="150"><span class="style1"><a href="moredetails.php" title="More Details">Click here for more details</a></span></td>
</tr>

}
}
?>

Thank you in advance.

NogDog

You'll need to grab whatever the primary key is from each query item, then add it as a URL query string to your link. For instance, if the key field in the table is the "ref" field:

<a href="moredetails.php?ref=<?php echo urlencode($ref); ?>" title="More Details">

Then in moredetails.php you'd get the key value in this example from $_GET['ref'] and use it to query the DB for the details.

quintin

thank you very much got it working is there any secruity issue i should worry about using this method???

ClarkF1

On the More Details page you can use is_int() to check whether $_GET['ref'] is an integer or not if you're using an auto-increment id in the database.

If you're not using an int and want to check you can always query the database to find out whether the ref exists:

$ref = mysql_real_escape_string($_GET['ref']);
$query = "SELECT COUNT(ref) FROM propertys WHERE ref = '$ref'";
$result = mysql_query($query) or die ('Error:'.mysql_error());
$count = mysql_result($result,0);
if ($count != 1)
{
//Error
}
else
{
//Proceed as normal

}