Comparing value from a GET

[john87423]

When I run this PHP file with no if statement the SQL query will run and return the the correct values.

When I compare the value of the GET (that does come through as the correct value), it does not execute the SQL.

It is probably something annoyingly obvious but I just cannot spot it.

Heres the code, cheers anyone:

<?php

header('Content-Type: text/xml');
header("Cache-Control: no-cache, must-revalidate");
//A date in the past
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");

print "<?xml version='1.0' encoding='ISO-8859-1'?>";

include ('DBConnect.php');

$value = $_GET['table']; 			
$id = $_GET['id'];					
$complete = $_GET['completed'];	

// Is magic quotes on? 
if (get_magic_quotes_gpc()) 
{ 
	// Yes? Strip the added slashes 
	$_REQUEST = array_map('stripslashes', $_REQUEST);
	$_GET = array_map('stripslashes', $_GET);
	$_POST = array_map('stripslashes', $_POST);
	$_COOKIE = array_map('stripslashes', $_COOKIE);
}

print "<doc>";

//To debug - see if variables are being set correctly
print $value; 
print $id;
print $completed;

//This works when there is no if statement
if($complete == 'YES')
	$result = mysql_query("SELECT * FROM BUG where COMPLETED = 'YES'")  or die (mysql_error());


while($row = mysql_fetch_array($result, MYSQL_ASSOC))
{
	print "<line ";

foreach ($row as $rowkey => $rowvalue) {
	print $rowkey . "='" . $rowvalue . "' ";
}

print "/>";
}

print "</doc>";
?>

[laserlight]

I do not see the incoming variables being used in the SQL statement.

[Kudose]

You should either use $complete or $completed ... not both.

[john87423]

Yes true. To start with I am just hard coding it to work. And the print $completed was a typo.

Cheers for replies.

[john87423]

Maybe it is not so obvious and it applies to other code i.e. the AJAX that calls this php file.

Seems the code posted should work, no?

[laserlight]

What is your current code?

[john87423]

Here goes the AJAX - this is all hard coded again - in the end it will recieve parameters:

function fixedBugsOnly()
{
	var objHTTP, strResult;
	//Need to pass values from form?
	//alert(form.value + "   " + table.value);
	var form = "BUG"; 

objHTTP=new XMLHttpRequest();
objHTTP.open("GET","IBGetData.php?table=BUG&id=20&completed=YES",false);
objHTTP.send(null);

xmlDoc=objHTTP.responseXML;

var line = xmlDoc.getElementsByTagName("line")[0];

for( var x = 0; x < line.attributes.length; x++ ) 
{
	try
	{
		document.forms[form].elements[line.attributes[x].nodeName].value = line.attributes[x].nodeValue;
	}
	catch(err)
	{

	}
}		
}

:

And here is the PHP:

<?php

header('Content-Type: text/xml');
header("Cache-Control: no-cache, must-revalidate");
//A date in the past
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");

print "<?xml version='1.0' encoding='ISO-8859-1'?>";

include ('DBConnect.php');

$value = $_GET['table']; 			
$id = $_GET['id'];					
$complete = $_GET['completed'];	

// Is magic quotes on? 
if (get_magic_quotes_gpc()) 
{ 
	// Yes? Strip the added slashes 
	$_REQUEST = array_map('stripslashes', $_REQUEST);
	$_GET = array_map('stripslashes', $_GET);
	$_POST = array_map('stripslashes', $_POST);
	$_COOKIE = array_map('stripslashes', $_COOKIE);
}

print "<doc>";

//To debug - see if variables are being set correctly
print $value; 
print $id;
print $complete;

//This works when there is no if statement
if($complete == 'YES')
	$result = mysql_query("SELECT * FROM BUG where COMPLETED = 'YES'")  or die (mysql_error());
elseif($id == '')
	$result = mysql_query("SELECT * FROM " . $value)  or die (mysql_error());		
else 
	$result = mysql_query("SELECT * FROM " . $value . " where ID=" . $id)  or die (mysql_error());


while($row = mysql_fetch_array($result, MYSQL_ASSOC))
{
	print "<line ";

foreach ($row as $rowkey => $rowvalue) {
	print $rowkey . "='" . $rowvalue . "' ";
}

print "/>";
}

print "</doc>";
?>

There is also an XML file that is the table - just say if that is needed?

Cheers
John

[john87423]

Maybe to get round this I could have a separate PHP file to do the work. Or should this be working?