why it shows information? Problem with easy php code

JOrGeX_

hi, i have this form on page1:

<html>
<head>
<title>Problema</title>
</head>
<body>
<form action="pagina2.php" method="post">
Ingrese el mail del alumno a consultar:
<input type="text" name="mail">
<br>
<input type="submit" value="buscar">
</form>
</body>
</html>

<html>
<head>
<title>Problema</title>
</head>
<body>
<?php
$conexion=mysql_connect("localhost","user","pass") or
  die("Problemas en la conexion");
mysql_select_db("phpfacil",$conexion) or
  die("Problemas en la selección de la base de datos");
$registros=mysql_query("select codigo,nombre, codigocurso
                        from alumnos where mail='$_REQUEST[mail]'",$conexion) or
  die("Problemas en el select:".mysql_error());
if ($reg=mysql_fetch_array($registros))
{
  echo "Nombre:".$reg['nombre']."<br>";
  echo "Curso:";
  switch ($reg['codigocurso']) {
    case 1:echo "PHP";
           break;
    case 2:echo "ASP";
           break;
    case 3:echo "JSP";
           break;
  }
}
else
{
  echo "No existe un alumno con ese mail.";
}
mysql_close($conexion);
?>
</body>
</html>

but when i go directly to page2.php, it shows this:

Nombre:
Curso😛HP

How can i do for none text dispaying there or "You can't access this page directly"?

Thanks a lot

cahva

In the beginning put:

if (!isset($_POST))
    die('You can't access this page directly');

bradgrafelman

cahva wrote:
In the beginning put:

Not only does that code have a typo, but it won't work in principle either - the $_POST superglobal is always set (unless you tamper with it).

You might get away with:

if(empty($_POST))

But then again, why not just check for the value(s) you need?

if(empty($_POST['mail']))

Also, you should never place user-supplied data directly into a SQL query - always escape it first with a function such as [man]mysql_real_escape_string/man !

Finally, you could probably add a 'LIMIT 1' onto the end of your query (since you're only retrieving one row) for optimization purposes.

chasiv

Shouldn't this :

("select codigo,nombre, codigocurso 
                        from alumnos where mail='$_REQUEST[mail]'",$conexion)

("select codigo,nombre, codigocurso 
                        from alumnos where mail= ' " . $_POST['mail'] . " ',$conexion)

NOTE: I added spaces between the apostrophe & double quotes just so you could see the way it was laid out. You should not put them in your actual code or it will not find the appropriate result.

bradgrafelman

chasiv: That's one way to write it (w/o the extra spaces), yes, but technically the first method is correct as well.

I, like you, don't like it and cringe when I see it, but alas... it is documented in the manual (see: [man]string[/man]).