Function will not SUM weights correctly

mnewbegin

I have a inventory system that I made.

I have an external page called functions.php

in that page I have these functions to tell me weights of an order and weight of pending orders.

The weight of pending orders function works perfect getSumOfPending is the function name there.

When calling the getSumOfOrder function, it gives me the weights of the items where the variable orderNum is equal to zero?

//***************** get sum of order  *************************************************//
function getSumOfOrder(){
$query = mysql_query("SELECT orderNum, SUM(weight) AS weightsumorder FROM _products WHERE orderNum='$orderNum'"); 
$result=mysql_fetch_array($query) or die(mysql_error()); 

echo "Order weight". $result['weightsumorder'];  

}
//***************** get sum of order  *************************************************//




//////////////////////////////////////// START GET SUM OF PENDING WEIGHT  /////////////////////////////////////////
function getSumOfPending(){
$query = mysql_query("SELECT SUM(weight) AS pendingweightsum FROM _products WHERE pending='1' AND deleted='0' AND orderNum='0'"); 
$result=mysql_fetch_array($query) or die(mysql_error()); 

echo "<br><br>Pending Weight ". $result['pendingweightsum'];  

}
//////////////////////////////////////// END GET SUM OF PENDING WEIGHT //////////////////////////////////////////

here is the database structure.

CREATE TABLE `_products` (
  `productID` int(25) NOT NULL auto_increment,
  `batch` varchar(10) collate latin1_german2_ci NOT NULL,
  `productNum` varchar(100) collate latin1_german2_ci NOT NULL default '',
  `productDesc` varchar(150) collate latin1_german2_ci NOT NULL default 'N-A',
  `productCount` varchar(65) collate latin1_german2_ci NOT NULL default '',
  `customer` varchar(65) collate latin1_german2_ci NOT NULL default 'N-A',
  `weight` int(6) NOT NULL,
  `core` varchar(4) collate latin1_german2_ci NOT NULL,
  `pending` int(1) NOT NULL default '0',
  `orderNum` int(12) NOT NULL default '0',
  `dateRcvd` varchar(10) collate latin1_german2_ci NOT NULL,
  `timeRcvd` varchar(8) collate latin1_german2_ci NOT NULL,
  `scannedBy` varchar(20) collate latin1_german2_ci NOT NULL,
  `itemIn` date NOT NULL,
  `itemOut` date NOT NULL,
  `custOrder` varchar(20) collate latin1_german2_ci NOT NULL,
  `custBol` varchar(20) collate latin1_german2_ci NOT NULL,
  `custShipped` date NOT NULL,
  `onOrder` int(1) NOT NULL default '0',
  `location` varchar(4) collate latin1_german2_ci NOT NULL,
  `deleted` int(1) NOT NULL default '0',
  PRIMARY KEY  (`productID`)
) ENGINE=InnoDB AUTO_INCREMENT=1585 DEFAULT CHARSET=latin1 COLLATE=latin1_german2_ci AUTO_INCREMENT=1585 ;

And here is the page where I'm calling the function, its passed to the page with the variable id which is where my problem might exist. because its looking at orderNum variable. But I think I have got the get command right here.????? maybe not.

<?php
session_start();
include 'dbc.php';
include 'functions.php';
if (!isset($_SESSION['user']))
{
 die ("Access Denied");
}
?>


<?php

// grab variable from bar.
$orderNum=$_GET['id'];

//get the current orders weight
getSumOfOrder();

?>

On the page that loads it goes to ordertest.php?id=1000000

and spits out

Order weight 4500 which is the weight of everything in the table that has a orderNum of 0

bradgrafelman

In this function:

function getSumOfOrder(){ 
$query = mysql_query("SELECT orderNum, SUM(weight) AS weightsumorder FROM _products WHERE orderNum='$orderNum'");
$result=mysql_fetch_array($query) or die(mysql_error()); 

echo "Order weight". $result['weightsumorder'];   

}

$orderNum is an undefined variable, this your SQL query will look like: WHERE orderNum='' .

Functions have their own local variable scope - variables defined outside that function are not available inside the function. Instead, you should pass that variable into the function as a function parameter.

mnewbegin

I guess thats where im lost.

//***************** get sum of order  *************************************************//
function getSumOfOrder(){
$query = mysql_query("SELECT orderNum, SUM(weight) AS weightsumorder FROM _products WHERE orderNum='$orderNum'"); 
$result=mysql_fetch_array($query) or die(mysql_error()); 

echo "Order weight ". $result['weightsumorder'];  

}
//***************** get sum of order  *************************************************//

would it then be,

function getSumOfOrder($orderNum){

function getSumOfOrder($id){

and then I still need to grab that off the url bar? correct? and is it easy as that what about the

WHERE orderNum='$orderNum'");

section? will that change.

sorry about the newb question, I have just used alot of code from a single site and built most of this but the code was pretty simple.

bradgrafelman

See the manual page [man]functions.user-defined[/man] for examples of user-defined functions that accept parameters/arguments.

Basically, it'd be:

function getSumOfOrder($whateverYouWantToCallThisParameter){

and you'd then refer to the same variable inside the function. When you call the function, you'd pass it the order number as the first (and only) parameter.

Also, note that user-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize it with a function such as [man]mysql_real_escape_string[/man] (for string data). In your case, since I'm guessing orderNum is an integer, you'd want to cast the data to an (int) or use a function such as [man]intval/man.