[RESOLVED] $id = $_GET['id']; - URGENT PLEASE HELP

DCorker

Hello,

I am in desperate help. I am absoloutly going crazy trying to sort out this problem inwhich i have.

Basically, i have a website which includes a support page. User enters support and it goes in the database, then administrator (userlevel4) can view all tickets and edit them.

I have the view tickets working and the links working so when i click on it it goes to edit.php?id=whatever.

edit.php?id=17 (which is the one im tryign to edit) opens blank.
Heres the code.

<?
require_once "inc/acct_handler.php";
require_once "inc/logfunc.php";

logincheck();

$user=$_SESSION['username'];

if($info->userlevel=='0'){
die("This page does not exist!");
}

$id = $_GET['id'];

$all=mysql_query("SELECT * FROM support WHERE id='$id'");
while ($array=mysql_fetch_assoc($all))
{
echo "".$array['problem']."";
}
?>

PLEASE HELP IM GOING CRAZY WITH THHIS LOL.

bradgrafelman

When you say "blank", do you simply mean you see nothing on the screen in your browser? Try viewing the source of the page (e.g. right-click and select "View Page Source" in Firefox). Do you see your PHP code?

If so, then the problem is that your script uses short tags (<? and possibly <?=$var?>) which have been deprecated for quite some time (even removed from PHP6). Change all instances of '<?' to the full '<?php' tag, and '<?=$var?>' to '<?php echo $var ?>' (if you find any).

EDIT: Also note that your script is vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query string. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man. Note that for data types such as integers, you could simply cast the data to an (int) to ensure that it doesn't actually contain any malicious data.

DCorker

The page is completely blank.
I know where the problem is, its here SELECT FROM support WHERE id='$id' because if i change that to SELECT FROM support WHERE id='17' then the ticket appears on the page like ti should do

bradgrafelman

Is display_errors set to On and error_reporting set to E_ALL (check phpinfo() if you're not sure)?

Try building the SQL query string in a variable and echo out that variable so you can see the actual query being sent to the SQL server.

DCorker

Look, let's just leave it, no disrepespect but yuo are telling me to do stuff which won't make any difference. All i want you to do is look at the code tell me where my mistaje si that sit

bradgrafelman

DCorker wrote:
yuo are telling me to do stuff which won't make any difference.

Uh, yeah, it makes a difference. If there's an error somewhere, and display_errors isn't set to On or error_reporting to E_ALL, then you won't see the error message. And if you're not going to bother looking for an error message, then why are you asking me to waste my time hunting for an error when PHP is perfectly able to tell you where one is if it finds one?

Dcorker wrote:
All i want you to do is look at the code tell me where my mistaje si that sit

Sounds like the first mistake is in your attitude about how to find a mistake.

You're asking me to skip all the interim troubleshooting steps to find an error in your code and instead skip straight to the solution part. That's like walking into a doctor's office and getting impatient when he starts asking you what your symptoms are when you simply want him to skip straight to a cure.