[RESOLVED] generating page from mySQL results + populating template

[kristen_m]

Sorry for the wordy title. I know what I want to do, but I don't know what it's called (so I haven't had much luck finding a how-to)

Have code set up to retrieve client data from mySQL and spit it out into a nice HTML table. The HTML table is just some high level info. (code below)

There is a template that contains the client's actual dossier. (code not shown)

I need to make it so that $person_name is a clickable link that will open up the dossier and populate it with $person_name's details.

I know this is possible because I see it ALL the time, but I can't actually find any how-tos. Except some really bad suggestions to use _GET. :queasy:

<?php

include 'actualbody.php';
include 'core/config.php';
include 'core/opendb.php';


$i = 1;

echo "<table cellpadding='2' style='width: 580px;'>

<tr>
<td style='border: 2px groove white;'><CENTER> Name </td>
<td style='border: 2px groove white;'><CENTER> Gender </td>
<td style='border: 2px groove white;'><CENTER> Breed </td>
</tr>"; 

WHILE ($i < $num) {
	echo "
<tr><TD style='border: 2px groove white;'>$person_name[$i] </td>
<TD style='border: 2px groove white;'>$person_age[$i]</td>
<td style='border: 2px groove white;'>$person_birthday[$i]</td>
</tr>";

$i++;

} 


echo "</table>";

[niroshan]

Hi kristen_m,

I know this is possible because I see it ALL the time, but I can't actually find any how-tos. Except some really bad suggestions to use _GET.

That is exactly what you need 🙂

while($i < $num) 
{
	echo "
	<tr>
		<TD style='border: 2px groove white;'><a href='fulldetails.php?ref=".$person_ids[$i]."' target='_blank'>$person_name[$i]</a></td>
		<TD style='border: 2px groove white;'>$person_age[$i]</td>
		<td style='border: 2px groove white;'>$person_birthday[$i]</td>
	</tr>";
	$i++;
}

Assume $person_ids will contain all the ID`s.

now in the fulldetails.php file you can access the user details by querying the user table using the $_GET['ref'].

Best regards,
Niroshan

[kristen_m]

Thank you, niroshan 😃

So GET is the only way to do this? I'm vaguely aware that GET is perilous, but if it's used so commonly, there are ways to make it reasonably secure?

[laserlight]

It might not be the only way, but it sounds reasonable. As for security: if you want to only allow certain users to read a particular dossier, then you might want to use sessions to implement some form of access control. Either way, the use of $_GET would not pose a problem since the retrieval of the dossier data has no side effects (it is idempotent). Of course, you still have to be concerned with things like SQL injection if you use the incoming variable in some SQL query, but it is the nature of incoming variables to be untrusted.

[kristen_m]

Laser- thanks for the feedback. I already have the session control working (just didn't show it here) in rudimentary fashion.

I was just about to post how I'm so lost and can't get it to work when went back and read Niro's post again and spotted I was calling ID instead of ref. Ah, success! 😃

Thank you so much. Can anyone point to some good, solid reading on security concerns with _GET and how to avoid common pitfalls? I know about mysql_real_escape_string(), but I'd like to read more.

[laserlight]

kristen_m wrote:

Can anyone point to some good, solid reading on security concerns with _GET and how to avoid common pitfalls? I know about mysql_real_escape_string(), but I'd like to read more.

NogDog likes to recommend Shiflett's book on Essential PHP Security; perhaps you would like to read it.

[kristen_m]

Sounds like a good place to start, thank you for the suggestion!