why will this not work?

benracer

$item = $_GET['item'];
$id = $_GET['id'];

if(empty($item)){
$query = "SELECT * FROM items WHERE name='$id' LIMIT 1"; 
}else{
$item = str_replace("-"," ","$item"); 
$query = "SELECT * FROM items WHERE name='$item' LIMIT 1"; 
}
$result = mysql_query($query) or die(mysql_error()); 
$row=mysql_fetch_array($result);

i have changed how the items in my site are found, it used to be done by ?id=x but i wanted it to be made more user friendly so the url can be more readable to the customer. So instead of having just the items id being displayed i now use the title ?item=x . This works fine but many of my links off search engines are on the old id format so i need to detect if the item doesnt contain a string/value then look for an id. Thank You😉

laserlight

I suggest something along these lines:

$name = null;
if (isset($_GET['item'])) {
    $name = mysql_real_escape_string($_GET['id']); // or maybe (int)$_GET['id'];
} elseif (isset($_GET['id'])) {
    $name = str_replace('-', ' ', $_GET['item']);
    $name = mysql_real_escape_string($name);
}

if (!is_null($name)) {
    $query = "SELECT * FROM items WHERE name='$name' LIMIT 1";
    $result = mysql_query($query) or die(mysql_error());
    $row = mysql_fetch_array($result);
    // ...
}

Piranha

A few pointers before I try to answer your question:

Your code are vunrable for SQL injection. Make sure to sanitize your data to avoid problems.
Are the name in the database unique? If not you will get into trouble when two items have the same name, you will get one of them without knowing which one.

And now to answer your original question.

I can only guess since I don't know how the database looks. But my guess would be that you don't have the item and id in the same field. Something like this would work.

if (empty($item)) {
$sql = "select * from items where id = $id";
} else {
$sql = "select * from items where name = '$item'";
}

benracer

thanks, i forgot that the data was in two columns =[