Problem passing the variable

msebar

Below is the code for two files. The upload file doesn't populate the form for editing a mysql data file. Hope someone can see where I am messing up.
Thanks

File 1
The output works and there is a link at the end of every row called Update. When clicked you go to a new page (File 2)

<?php

include 'config.php';
include 'dbconopen.php';
$query = "SELECT * FROM contacts Where category='".mysql_real_escape_string($_POST['drop1'])."'";
$result = mysql_query($query) or die("there are no entries");

if (!$result) { 
    die('invalid query'); 
}

?>
<h4><strong>List data from mysql </strong></h4>
<table width="100%" border="1" cellspacing="0" cellpadding="0">
<tr>

<td>
<table width="100%" border="1" cellspacing="0" cellpadding="3">
<tr>

</tr>

<tr>
<td align="center"><strong>First Name</strong></td>
<td align="center"><strong>Last name</strong></td>
<td align="center"><strong>Address</strong></td>
<td align="center"><strong>City</strong></td>
<td align="center"><strong>State</strong></td>
<td align="center"><strong>Zip</strong></td>
<td align="center"><strong>Zip4</strong></td>
<td align="center"><strong>Phone</strong></td>
<td align="center"><strong>Gender</strong></td>
<td align="center"><strong>DOB</strong></td>
<td align="center"><strong>Email</strong></td>
<td align="center"><strong>Source</strong></td>
<td align="center"><strong>Privacy-URL</strong></td>
<td align="center"><strong>IP</strong></td>
<td align="center"><strong>Date-Time-Stamp</strong></td>
<td align="center"><strong>Category</strong></td>
<td align="center"><strong>Verified</strong></td>
<td align="center"><strong>Link to Update</strong></td>
</tr>


<?php
while($rows=mysql_fetch_array($result)){
?>
<tr>
<td><? echo $rows['fname']; ?></td>
<td><? echo $rows['lname']; ?></td>
<td><? echo $rows['address']; ?></td>
<td><? echo $rows['city']; ?></td>
<td><? echo $rows['state']; ?></td>
<td><? echo $rows['zip']; ?></td>
<td><? echo $rows['zip4']; ?></td>
<td><? echo $rows['phone']; ?></td>
<td><? echo $rows['gender']; ?></td>
<td><? echo $rows['dob']; ?></td>
<td><? echo $rows['email']; ?></td>
<td><? echo $rows['source']; ?></td>
<td><? echo $rows['privacy_url']; ?></td>
<td><? echo $rows['ip']; ?></td>
<td><? echo $rows['date_time_stamp']; ?></td>
<td><? echo $rows['category']; ?></td>
<td><? echo $rows['verified']; ?></td>	

<!-- link to update.php and send value of id -->
<td align="center"><a href="update.php?id=<? echo $rows['ID']; ?>">update</a></td>
</tr>

<?php
}

include 'dbconclosed.php';
?>


</table>
</td>
</tr>
</table>


</body>
</html>

Now this is File 2 which the above file goes to. The form shows up empty states there are no entries

File 2


<?php
include 'config.php';
include 'dbconopen.php';




// get value of id that sent from address bar
$id=$_GET['id'];


// Retrieve data from database 
$query="SELECT * FROM $contacts WHERE id='$id'";
$result = mysql_query($query) or die("there are no entries");

if (!$result) { 
    die('invalid query'); 
}


$rows=mysql_fetch_array($result);


?>
<table width="400" border="0" cellspacing="1" cellpadding="0">
<tr>
<form name="form1" method="post" action="update_ac.php">
<td>
<table width="100%" border="0" cellspacing="1" cellpadding="0">

<tr>
<td>&nbsp;</td>
<td colspan="3"><strong>Update data in mysql</strong> </td>
</tr>



  <tr>
    <td colspan="2"><strong>First Name</strong></td>
    <td colspan="5"><strong>Last name</strong></td>
  </tr>
  <tr>
    <td colspan="2"><input name="fname" type="text" id="fname" value="<? echo $rows['fname']; ?>" size="15"></td>
    <td colspan="5"><input name="lname" type="text" id="lname" value="<? echo $rows['lname']; ?>" size="15" /></td>
  </tr>
  <tr>
    <td width="20%"><strong>Address</strong></td>
    <td width="2%"><strong>City</strong></td>
    <td width="6%"><strong>State</strong></td>
    <td width="1%"><strong>Zip</strong></td>
    <td width="2%" colspan="3"><strong>Zip4</strong></td>
  </tr>
  <tr>
    <td><input name="address" type="text" id="address" value="<? echo $rows['address']; ?>" size="30"></td>
    <td><input name="city" type="text" id="city" value="<? echo $rows['city']; ?>" size="20" /></td>
    <td><input name="state" type="text" id="state" value="<? echo $rows['state']; ?>" size="20" /></td>
    <td><input name="zip" type="text" id="zip" value="<? echo $rows['zip']; ?>" size="12" /></td>
    <td colspan="3"><input name="zip4" type="text" id="zip4" value="<? echo $rows['zip4']; ?>" size="4" /></td>
  </tr>
  <tr>
    <td colspan="7"><strong>Phone</strong></td>
  </tr>
   <tr>
    <td colspan="7"><input name="phone" type="text" id="phone" value="<? echo $rows['phone']; ?>" size="13"></td>
  </tr>
   <tr>
     <td colspan="7"><strong>Gender</strong></td>
   </tr>
   <tr>
     <td colspan="7"><input name="gender" type="text" id="gender" value="<? echo $rows['gender']; ?>" size="1" /></td>
   </tr>
   <tr>
     <td colspan="7"><strong>DOB</strong></td>
   </tr>
   <tr>
     <td colspan="7"><input name="dob" type="text" id="dob" value="<? echo $rows['dob']; ?>" size="20" /></td>
   </tr>
   <tr>
    <td colspan="7"><strong>Email</strong></td>
  </tr>
   <tr>
     <td colspan="7"><input name="email" type="text" id="email" value="<? echo $rows['email']; ?>" size="100" /></td>
   </tr>
   <tr>
     <td colspan="7"><strong>Source</strong></td>
   </tr>
   <tr>
     <td colspan="7"><input name="source" type="text" id="source" value="<? echo $rows['source']; ?>" size="100" /></td>
   </tr>
   <tr>
     <td colspan="7"><strong>Privacy-URL</strong></td>
   </tr>
   <tr>
     <td colspan="7"><input name="privacy_url" type="text" id="privacy_url" value="<? echo $rows['privacy_url']; ?>" size="100" /></td>
   </tr>
   <tr>
    <td colspan="5"><strong>IP</strong></td>
    <td colspan="2"><strong>Verified</strong></td>
  </tr>
   <tr>
     <td colspan="5"><input name="ip" type="text" id="ip" value="<? echo $rows['ip']; ?>" size="16" /></td>
     <td colspan="2"><input name="verified" type="text" id="verified" value="<? echo $rows['verified']; ?>" size="3" /></td>
   </tr>
   <tr>
     <td colspan="7"><strong>Date-Time-Stamp</strong></td>
   </tr>
   <tr>
     <td colspan="7"><input name="date_time_stamp" type="text" id="date_time_stamp" value="<? echo $rows['date_time_stamp']; ?>" size="30" /></td>
   </tr>
   <tr>
    <td colspan="7"><strong>Category</strong></td>
  </tr>
  <tr>
    <td colspan="7"><input name="category" type="text" id="category" value="<? echo $rows['category']; ?>" size="100"></td>
  </tr>


<tr>
<td>&nbsp;</td>
<td><input name="id" type="hidden" id="id" value="<? echo $rows['id']; ?>"></td>
<td align="center"><input type="submit" name="Submit" value="Submit"></td>
<td>&nbsp;</td>
</tr>
</table>
</td>
</form>
</tr>
</table>

<?php
include 'dbconclosed.php';

?>

bradgrafelman

You have an erroneous dollar sign in front of the MySQL table name "contacts" for one thing.

For another, you should never place user-supplied data directly into a SQL query string. Instead, you must first sanitize it with a function such as [man]mysql_real_escape_string/man (or use a more updated library of functions such as MySQLi and PDO which offered prepared statements).

EDIT: Also, out of curiosity, what does the dbconclosed.php file do?

msebar

Well first I like to thank you for your reply,

I will work backwards on your response,

The dbconclosed.php is my close database statement, I forget to close my database offen so I created a template with that at the end.

This database is for internal use only no outsiders will be allowed. The only data inserted will be data from a collection information obtained from partner websites.

Last is the $ fixed the problem with the "there are no entries" and the form now shows up. Only problem left is the form is empty still no data passing from first form.

// Retrieve data from database
$query="SELECT * FROM contacts WHERE id='$id'";
$result = mysql_query($query) or die("there are no entries");

if (!$result) {
die('invalid query');
}

laserlight

msebar wrote:
This database is for internal use only no outsiders will be allowed. The only data inserted will be data from a collection information obtained from partner websites.

That is no excuse for failing to properly sanitise your data.

msebar wrote:
Only problem left is the form is empty still no data passing from first form.

I might be misreading, but you do not appear to actually have a form on the first page.

Weedpacket

msebar wrote:
The dbconclosed.php is my close database statement, I forget to close my database offen so I created a template with that at the end.

If you forget, PHP closes the connection automatically on script end (actually ... I'm not entirely sure, but I think it might be when the last reference to the connection goes out of scope).

msebar

laserlight

laserlight;10938278 wrote:
That is no excuse for failing to properly sanitise your data.

I might be misreading, but you do not appear to actually have a form on the first page.

No form on the first page only a drop down list.

I thought I was sanitising on the first page with this on the pull of the data, file 2 only lets me modify it.

$query = "SELECT * FROM contacts Where category='".mysql_real_escape_string($_POST['drop1'])."'";

Does the data have to be sanitised more then once, if so how would you do it on the script.

PS I had caps on the ID on the first file when is should have been lower case. Data now passes.

Thanks

johanafm

msebar;10938317 wrote:
Does the data have to be sanitised more then once, if so how would you do it on the script.

Once is enough, when you first get the data from whatever external source it comes. If you get data from user, sanitize it and insert it into a db, there is no reason to sanitize it once more when you retrieve it.
However, should you return the sanitized data to a webpage, which resubmits it (instead of storing it in a db or $_SESSION), then it comes from an external source once again and therefor you'd have to sanitize it. Since you can't know that you get the exact same data back, even if that's your intent, you don't sanitize the same data once more. You sanitize data which may look the same as it did initially.

Weedpacket

msebar wrote:
No form on the first page only a drop down list.

Which would need to be in a form in order to function.

Not so incidentally, is the field called "id" or "ID"? What does the link to the second page (actually the third if you count the page with the drop down as the first) actually say?