Easy - using url variable in sql select

RichieH

Hi guys,

I'm new to PHP...

I'm trying to use the url variable ?custid=3213 for example in my select staement and print the field on a page but it keeps giving me a blank page....

here's the code....

<?php

$connection = mysql_connect("localhost","xxx","xxx") or die(mysql_error());
$db = mysql_select_db("xxx",$connection) or die(mysql_error());

$cust = $_GET['custid'];

$data = mysql_query("SELECT DISTINCT customers_email_address FROM customers WHERE customers_id = '$cust'");
$result = mysql_query($data);
print($result);
?>

bogu

Why do you add DISTINCT to your select isn't the customers_id autoincrement primary key?

RichieH

yes it is actually.... but i thought that if the cust id was like 33 then if i didn't use DISTINCT it would try to return id's like 133, 1233 etc etc.

when i don't use DISTINCT it has the same result anyway.

RichieH

yes it is actually.... but i thought that if the cust id was like 33 then if i didn't use DISTINCT it would try to return id's like 133, 1233 etc etc.

when i don't use DISTINCT it has the same result anyway.

bogu

Change this line:

$result = mysql_query($data)

to this

$result = mysql_query($data) or die(mysql_error());

RichieH

thanks for your help.....

i fixed it using this suggestion.... found here http://us2.php.net/manual/en/function.mysql-query.php

here's my code now.....

<?php

$connection = mysql_connect("localhost","xxx","xxx") or die(mysql_error());
$db = mysql_select_db("xxx",$connection) or die(mysql_error());

$cust = $_GET['custid'];

$data = sprintf("SELECT DISTINCT customers_email_address FROM customers WHERE customers_id = '$cust'");
$result = mysql_query($data);

if (!$result) {
$message = 'Invalid query: ' . mysql_error() . "\n";
$message .= 'Whole query: ' . $data;
die($message);
}

while ($row = mysql_fetch_assoc($result)) {
echo $row['customers_email_address'];
}
mysql_free_result($result);
?>

i'm stoked - it took me hours!

bradgrafelman

You should still remove the 'DISTINCT' keyword from your query (as well as the quotes around the customers_id value) as there's no point in using it. MySQL won't return a row with id of 133 if you pass it 33... it is smart enough to realize that 133 != 33.

Also, your code is vulnerable to SQL injection attacks; user-supplied data should never be placed directly into a SQL query. Instead, you should first sanitize it with a function such as [man]mysql_real_escape_string/man. In this instance, since you're expecting the ID to be nothing more than an integer, you could instead cast the user-supplied data to an integer to sanitize it.

Finally, there's no reason to use a while() loop if customers_id has a primary key on that column - just call the fetch_assoc function a single time to retrieve the row (if one is found - you never check for this).