[RESOLVED] $id variable not passing correctly in query

sunshine66

The $id variable is passed in the URL from a previous page and shows up in the URL of the next page in the process (show info to verify edit or delete)
but the result of a query using the $id variable results in null value ????? This code was working before!
Here's the result of the php code below - the SQL result printed to the browser:

For example, the URL will pass the $id variable like it does here

http_url_goes_here/equipment_edit.php?id=30

but on the page it doesn't pass the ID value of 30 in the query:

SELECT * FROM EquipmentList WHERE EquipmentID=''
Resource id #7

    $query = "SELECT * FROM EquipmentList WHERE EquipmentID='$id' " or die("Error in query" . mysql_error() );
    $result = mysql_query($query) or die("Error in query result. Error: " . mysql_error() );
    $row = mysql_fetch_array($result);

print "$query<br>";
print "$result";

I was demonstrating this application with the client and don't know why it stopped working!!! I've spent hours trying to figure out what's wrong.
PLEASE HELP!

Sxooter

You had global_vars turned on (and things worked) then it got turned off (and things don't work).

look for $GET['id'] or $POST['id'] and learn to cleanse your input with mysql_escape type functions.

sunshine66

Where would the global_vars setting be to be turned on or off? on the server / php application configuation?

I do not have any references to $GET['id'] or $POST['id']

i'm confused

Sxooter

sunshine66 wrote:
Where would the global_vars setting be to be turned on or off? on the server / php application configuation?

I do not have any references to $GET['id'] or $POST['id']

i'm confused

global_vars is turned on / off in php.ini. IT SHOULD NOT BE TURNED ON for security reasons.

What do you mean by not having any references to $_GET['id'] ?

after you submit the form, what does

print_r($GET);
or
print_r($POST);

show?

sunshine66

On a page called equipment.php, I have a query that displays a list of equipment. It works fine. The query is

SELECT * FROM EquipmentList ORDER by Type, Make, Model.

Along with the list, I have 2 links - one to edit the equipment info, and one to delete the entry. The Links look like this :

<A HREF=\"equipment_edit.php?id=$id\">EDIT</A> 
<A HREF=\"equipment_delete.php?id=$id\">DELETE</A>

When I click on the link for the piece of equipment with id=30, I go to the URLs equipment_edit.php?id=30 or equipment_delete.php?id=30.

The problem is that on those pages, the query is NOT picking up the value for $id, even though it is passed in the URL.
$query = "SELECT * FROM EquipmentList WHERE EquipmentID='$id'";

The query reads "SELECT FROM EquipmentList WHERE EquipmentID=''";
instead of "SELECT FROM EquipmentList WHERE EquipmentID='30'";

Like I said, this was working up until a couple of days ago and I don't know what caused it to stop working. Hosting company said they haven't made any changes to the server and "the php value register_globals is turned off on our server."

Sxooter

I'll repeat this request:

What does
print_r($_GET);
get you on the
equipment_edit.php?id=30
page?

sunshine66

sorry i didn't answer your question!

Array ( [id] => 30 )

so then, how should i change my query to get the value of 30?

ionathas

$query = "SELECT * FROM EquipmentList WHERE EquipmentID='" . $_GET['id'] . "'";

sunshine66

PERFECT!

THANK YOU!!!!!!!

sunshine66

Now i'm having problems when trying to execute the UPDATE or DELETE query
REF new thread:
http://www.phpbuilder.com/board/showthread.php?p=10849818#post10849818

Sxooter

Note, you should always scrub input data from users to prevent sql injection.

$id = mysql_real_escape_string($_GET['id']);
$query = "delete from table where id=$id";

sunshine66

sorry, but i have no idea what that means [newbie ignorance]

the only time i want to delete the record is when the user is on filename_delete.php?id='$id' which displays info with a confirm delete button that triggers the delete function