[RESOLVED] The old, long filename issue

Tim_Silva

After some weeks of a break I decided to tackle once again my old problem of getting my URLs to load as 'this-is-the-long-name-of-my-file.htm". I already have the column "urlTitle" in mySQL. But for some reason, when I try to load it it will give syntax error.

If I use the same code but for the ID column it works just fine.

THIS WILL WORK

<?php
$hostname="xxx";
$username="xxx";
$password="xxx";
$dbname="xxx";
$usertable="xxx";
$id=$_GET['id'];

mysql_connect($hostname,$username,$password) or die(mysql_error());
mysql_select_db("$dbname") or die(mysql_error());

$data = mysql_query("SELECT * FROM $usertable WHERE id=$id") 
or die(mysql_error()); 
$info = mysql_fetch_array( $data );

echo "<span class='style2'>" .$info['title']. "</span><br><br>";
echo "<span class='style2'>" .$info['content']. "</span><br><br>";
?>

THIS WILL NOT

<?php
$hostname="xxx";
$username="xxx";
$password="xxx";
$dbname="xxx";
$usertable="xxx";
$urlTitle=$_GET['urlTitle'];

mysql_connect($hostname,$username,$password) or die(mysql_error());
mysql_select_db("$dbname") or die(mysql_error());

$data = mysql_query("SELECT * FROM $usertable WHERE urlTitle=$urlTitle") 
or die(mysql_error()); 
$info = mysql_fetch_array( $data );

echo "<span class='style2'>" .$info['title']. "</span><br><br>";
echo "<span class='style2'>" .$info['content']. "</span><br><br>";
?>

So that, in the browser, domain.com/article.php?id=1234 works fine but not domain.com/article.php?urlTitle=this-is-the-long-name-of-my-file

I can’t think of any reason for the difference. Could it be related to ID being the primary key?

As aways,

Thanks

Weedpacket

It's more likely related to the fact that string values in SQL queries need to be quoted.

And look up the phrase "SQL injection" on the net as well.

Piranha

You forgot the ' signs:

$sql = "SELECT * FROM $usertable WHERE urlTitle='$urlTitle'";
echo "<br/>" . $sql . "<br/>";
$data = mysql_query($sql)

If you build it like above you can easily get the query and run it somewhere else, for example phpmyadmin or sqlyog. There you will see more clearly what the error is.

By the way, your code is vunrable to sql injection. Read up on it and solve the problem before your site goes live to avoid problems.

Tim_Silva

What do you know. That stupid single quote!

Thanks🙂

Tim