[RESOLVED] variable not working

greatepier

I am trying to get a variable from one form.php to another php file, but then the record is not found.

In the first php file the link looks like

form.php
<td width=\"05%\"><a href=\"tcx_wijzig.php?zid=$Rij[id]\">$Rij[id]</a></td>

When I rightclick and open in a new screen, the browser shows:
http://www.tejoh.nl/TTC/tcx_wijzig.php?zid=2
So I assume this form is OK.

The I have opened the tcx_wijzig.php

tcx_wijzig.php
$Opdracht = "SELECT * FROM tcxbeurs WHERE id = $zid LIMIT 0 , 30";

But then I get the error..
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in ........../tcx_wijzig.php on line 23

If I put $=zid"2"; before the sql command to get the record, it works.
How can I make tcx_wijzig.php to read the number behind de ?zid= ?

Who can help me, what am I doing wrong?

wilku

You have reqister_globals turned off (and that's very well). So neither post nor get varibles are registered automatically. You have to have it like this:

$zip = $_GET['zip'];

before you can use it in your sql query.

greatepier

I added this in my tcx_wijzig.php in the beginning of the script

But still getting the same error

bradgrafelman

Echo out $Opdracht... what does it look like?

greatepier

An echo of the $Opdracht gives:
SELECT * FROM table WHERE id = LIMIT 0 , 30

So basicly it doesn't remember the input of $zid

bradgrafelman

Can you show us more of your code? Such as where you defined $zid?

Will_Poulson

The previous suggestion:

$zip = $_GET['zip'];

is the more proper direct way,

if you want to see every variable that is arriving, try something like this:

foreach($_GET as $key => $value){

echo"Key: $key<br />";
echo"Value: $value<br />";
};

foreach($_POST as $key => $value){

echo"Key: $key<br />";
echo"Value: $value<br />";
};

is a good way to look for typos

I have a function I use that always reports every post, get, cookie value in the system every page load, while I am in testing mode (which can be as simple as setting a cookie to say testing, then checking for it

If you don't see any values arriving, then it is your php config file, which sometimes (by server) can be over ridden in .htaccess

wilku

Oh, and I misspelled your variable so it's $zid not $zip 😉

$zid = $_GET['zid'];

Another suggestion is to use quotes even in numerical fields in SQL queries:

"SELECT * FROM `tcxbeurs` WHERE `id` = '$zid' LIMIT 0 , 30";

That way, even if someone is going to write in the browser your_document.php?zid=string it won't "crash" your query.

bradgrafelman

wilku wrote:
Another suggestion is to use quotes even in numerical fields in SQL queries ... That way, even if someone is going to write in the browser your_document.php?zid=string it won't "crash" your query.

You should never use quotes for numerical values.

Why? Because you never allow user-supplied data to appear in a query without first sanitizing it. If you're expecting a numerical value, use [man]intval/man on the variable first. Never EVER put a $POST/$GET/etc. value directly into a query - otherwise you're vulnerable to a SQL injection attack.

greatepier

The intval($zid) made it work!
Thank you all for helping a noob

bradgrafelman

Don't forget to mark the thread resolved.