[RESOLVED] Fetching titles etc from DB

chrisguk

Hi,

The following script essentially pulls the "title", "description" and "keywords" from the database if the page name in the database is matched with the currently loaded page. I have tested the database connection and that works 100%. Can anyone see what is wrong with the code for it not to display the correct results. Presently it is only displaying the output of the "else" syntax:

// Search database for pages matching the current 
// page and display the title, description and keywords

$page = isset($_GET['page']) ? $_GET['page'] : 'home';

$sql = $mysqli->query("SELECT * FROM URL WHERE page = '" . $page . "' LIMIT 1");
if ($mysqli->connect_errno) {
    printf("Connect failed: %s\n", $mysqli->connect_error);
    exit();
}

if ($sql->num_rows > 0) {
    while ($row = $sql->fetch_object())
    {
        $title = $row->title;
        $description = $row->descr;
        $keywords = $row->keywords;

}


} else {


$title = 'Set Default Title';
$description = 'Set Default Description';
$keywords = 'Set Default Keywords';

}

bradgrafelman

First thing I notice is that you're using unsanitized data in a SQL query, thus your code will be vulnerable to SQL injection attacks and/or just plain SQL errors.

Other than that, have you tried echo'ing out the SQL query and manually executing it yourself to see if you get any results? If not, you'll have to examine the data in your DB.

chrisguk

Hi Brad,

Thanks for the advice, I will have a go at echoing the SQL.

Are you able to give me some pointers or code examples on how to sanitize my SQL ?

Weedpacket

chrisguk wrote:
Are you able to give me some pointers or code examples on how to sanitize my SQL ?

Searching these forums is likely to turn up many many threads that address the subject. There is also a section in the manual on SQL injection (which includes the obligatory xkcd comic).

For example, MySQLi and PDO provide prepared statements (strictly speaking they're called "parameterised queries" but the implementation is the same) that do the necessary escaping to prevent unsanitised data being used in the query. You might also have noticed a function in the manual called [man]mysqli_real_escape_string[/man].

Bonesnap

Double check that your table and column names are correct, and that you actually have data in your database that will return a result.

chrisguk

Bonesnap;11020835 wrote:
Double check that your table and column names are correct, and that you actually have data in your database that will return a result.

Hey bone, you were on the button with your question. I made an error with the column name "URL" it should have been "url" , so thats all working now. Next task is to sanitise the query itself.