[RESOLVED] Creating an html link that will access a particular record

rlalande

Thanks to the helpful people on this board, I have my little sample script doing the proper queries, and I'm on my way to creating my database-driven pages.

How can I create an html link that will populate the "WHERE casebrand = 'actionhardcasepages' " part of my query. For example, something like mydomain.com/samplescript.php?casebrand=actionhard ??

Here's the sample script:

<?php
include('db_login.php');
mysql_connect($db_host, $db_username, $db_password) or exit(mysql_error());
mysql_select_db($db_database) or exit(mysql_error());
$result = mysql_query("SELECT * FROM newcases WHERE casebrand = 'actionhard' LIMIT 0, 30") or exit(mysql_error());
while ($row = mysql_fetch_assoc($result))
{
echo '

<tr height=30 class=accpart>
<td colspan=2 ALIGN=left>
Part #: ' . $row['partno'] . '
</td>
</tr>
<tr >
<td align=left class=small>
Suggested Price: <s>$' . $row['suggested'] . '</s>
</td>
</tr>
<tr >
<td align=left class=pricered>
Our Price: $' . $row['price'] . '
</td>
</tr>
<tr height=20>
<td colspan=4 valign=center align=center>
<hr>
</td>
</tr>


';

}
?>
</table>
</center>
</body>
</html>

Thanks again.

Rock

devinemke

use $_GET['casebrand'] in your query

rlalande

I was able to get it to work using this:

$temp = $_SERVER['QUERY_STRING'];

$result = mysql_query("SELECT * FROM newcases WHERE casebrand = '$temp' LIMIT 0, 30") or exit(mysql_error());

The URL is like: mydomain.com/testing-cases4.php?actionhardxcasexpages

It seems to work fine... any downside to using it this way?

My next question is... let's say I have 60 records that match. I want to split them up, showing only 20 per page. Could I have another variable that would set the LIMIT parameters? How can I get these other variables from the address bar?

Thanks again for your help.

bradgrafelman

I don't understand how that works - have you looked at the values $_SERVER['QUERY_STRING'] gives you?
Use the $_GET array to access variables in the URL, as devinemke suggests.
It appears as though you're vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query! Instead, sanitize it with a function such as [man]mysql_real_escape_string/man.
When posting PHP code, please use the board's [PHP][/PHP] bbcode tags - they make the code much, much easier to read (as well as aiding the diagnosis of syntax errors). You should edit your post now and add these bbcode tags to help others in reading/analyzing your code.

rlalande

How would you code that?

rlalande

I figured it out.