[RESOLVED] Resource ID#4 nightmare

[gabe33]

Hey guys I am hoping for some assistance here. I am creating a 'wraptool' of sorts and am trying to do this: The previous page contains a form whose action is this page. The only problem is that when you click submit you get the infamous Resource ID#4 error. I've googled and searched forums here, but the applications of this have been slightly different and the answers haven't worked. At least I haven't gotten them to work.

<?php
$var1_getType = "0";
if (isset($_POST['escalation'])) {
  $var1_getType = $_POST['escalation'];
}
$var3_getType = "0";
if (isset($_POST['coaching'])) {
  $var3_getType = $_POST['coaching'];
}
$var4_getType = "0";
if (isset($_POST['commendation'])) {
  $var4_getType = $_POST['commendation'];
}
$var5_getType = "1";
if (isset($_POST['source'])) {
  $var5_getType = $_POST['source'];
}
$var2_getType = "0";
if (isset($_POST['consultation'])) {
  $var2_getType = $_POST['consultation'];
}
$getType = mysql_query("SELECT type_id
                    FROM call_type
                    WHERE source_id = '" . $var5_getType . "'
                    AND escalation = '" . $var1_getType . "'
                    AND consultation = '" . $var2_getType . "'
                    AND coaching = '" . $var3_getType . "'
                    AND commendation = '" . $var4_getType . "'");

if (!$getType)
{
    die('Invalid type: ' . mysql_error());
}


$result = mysql_query("Insert into calls (
							agent_id, 
							repair_order, 
							issue_id, 
							type_id, 
							assignedto, 
							description, 
							resolution) 
						values (
							'" . $_POST['agent_id'] . "',
							'" . $_POST['ro'] . "',
							'" . $_POST['issue'] . "',
							'" . $getType . "',
							'" . $_SESSION['MM_Username'] . "',
							'" . $_POST['description'] . "',
							'" . $_POST['resolution'] . "')"); 

if (!$result)
{
   die('Invalid formation of insert query: ' . mysql_error());
}

mysql_close();

header('Location: newcall.php');
?>

Updated: removed mysql_error() from query, you guys were right that was odd. I think I was rushing it.

[wilku]

You make the output of mysql_error() into your next query? What for?
The way it should be, is mysql_query(....) or die(mysql_error()); If it's gonna solve your problem completely, I don't know.

[bradgrafelman]

I also question why you have mysql_error() inside your SQL query - that won't do anything constructive and can only break your query.

Also, you haven't shown us any part of the script that echo's anything out to the user...

[gabe33]

The problem is with $getType. $getType should be pulling 1 (one) row from the table, which will then be referenced in the INSERT statement. The error I am getting is:
Invalid formation of insert query: Incorrect integer value: 'Resource id #4' for column 'type_id' at row 1

The INSERT statement is getting 'Resource id #4' as the value for $getType. The value for $getType should be an integer 1-14. When I tried mysql_fetch_array I got the value of '$6' the number was correct however the '$' should not be included in the INSERT to the table

As far as output to the user there won't really be any. This page is simply an operation called by the form on the previous page. The user will press submit, the data in the form will be sent to this page processed and then the user will be sent back to the prev_url to enter more information.

Thanks for pointing out the mysql_error() I'm not sure what I was thinking.

[gabe33]

$getType = mysql_query("SELECT type_id
                    FROM call_type
                    WHERE source_id = '" . $var5_getType . "'
                    AND escalation = '" . $var1_getType . "'
                    AND consultation = '" . $var2_getType . "'
                    AND coaching = '" . $var3_getType . "'
                    AND commendation = '" . $var4_getType . "'");
<- This fixed->$row = mysql_fetch_array ($getType);

if (!$getType)
{
    die('Invalid type: ' . mysql_error());
}


$result = mysql_query("Insert into calls (
							agent_id, 
							repair_order, 
							issue_id, 
							type_id, 
							assignedto, 
							description, 
							resolution) 
						values (
							'" . $_POST['agent_id'] . "',
							'" . $_POST['ro'] . "',
							'" . $_POST['issue'] . "',
			<-Changed->	      '" . $row[0] . "',
							'" . $_SESSION['MM_Username'] . "',
							'" . $_POST['description'] . "',
							'" . $_POST['resolution'] . "')");

If you have any other questions about this let me know. It appears to be working now. Thanks for taking the time to look at the code and thanks for the extra set of eyes on catching the mysql_error(). I'm sure I will be looking for more help soon. 🙂

[bradgrafelman]

Don't forget to check if the query succeeded before calling the fetch_array() command, and also note that you should never place user-supplied data directly into a SQL query. Instead, it should be sanitized with a function such as [man]mysql_real_escape_string/man.

[gabe33]

In this case the user supplied data is 1 or 0...They are Checkboxes and Radio buttons. It's not possible to input an invalid value. I appreciate the heads up.

Good catch on the fetch_array. I'll get that moved.

[bradgrafelman]

gabe33 wrote:

It's not possible to input an invalid value.

That's the kind of thinking that hackers exploit when doing SQL injection attacks.

Who says someone wanting to input invalid data is going to use your form in the first place? Your PHP script doesn't care where data came from; it's going to process everything thrown at it. That's why you must sanitize everything you use that the user-side of the connection could have tampered with.

[gabe33]

I understand making this safe and it would be beneficial if on a public network. I'm not trying to be difficult, but this is a private network. I guess I don't see the concern for hackers if the only people who can access the network in the first place are employees. Maybe I am trusting my IT guys too much.

Is this what you mean?

$var1_getType = "0";
if (isset($_POST['escalation'])) {
  $var1_getType = mysql_real_escape_string($_POST['escalation']);
}
$var3_getType = "0";
if (isset($_POST['coaching'])) {
  $var3_getType = mysql_real_escape_string($_POST['coaching']);
}
$var4_getType = "0";
if (isset($_POST['commendation'])) {
  $var4_getType = mysql_real_escape_string($_POST['commendation']);
}
$var5_getType = "1";
if (isset($_POST['source'])) {
  $var5_getType = mysql_real_escape_string($_POST['source']);
}
$getType = mysql_query("SELECT type_id
                    FROM call_type
                    WHERE source_id = '" . $var5_getType . "'
                    AND escalation = '" . $var1_getType . "'
                    AND coaching = '" . $var3_getType . "'
                    AND commendation = '" . $var4_getType . "'");

if (!$getType)
{
    die('Invalid type: ' . mysql_error());
}

$row = mysql_fetch_array ($getType);

Or should the escape_string surround the $var like this:

WHERE source_id = '" . mysql_real_escape_string($var5_getType) . "'

[laserlight]

I'm not trying to be difficult, but this is a private network. I guess I don't see the concern for hackers if the only people who can access the network in the first place are employees. Maybe I am trusting my IT guys too much.

True, but then by protecting even on a private network, it is both adding an extra layer of security, and future-proofing in the event the code gets ported to a public network.

You might want to use variable names that are more descriptive:

$escalation = isset($_POST['escalation'])
            ? mysql_real_escape_string($_POST['escalation']) : '0';
$coaching = isset($_POST['coaching'])
          ? mysql_real_escape_string($_POST['coaching']) : '0';
$commendation = isset($_POST['commendation'])
              ? mysql_real_escape_string($_POST['commendation']) : '0';
$source = isset($_POST['source'])
        ? mysql_real_escape_string($_POST['source']) : '0';

$result = mysql_query("SELECT type_id
                       FROM call_type
                       WHERE source_id = '" . $source . "'
                           AND escalation = '" . $escalation . "'
                           AND coaching = '" . $coaching . "'
                           AND commendation = '" . $source . "'");

if (!$result)
{
    die('Could not process query: ' . mysql_error());
}

$row = mysql_fetch_array($result);