Really simple query

lulubel

I'm a new user here, new to php and figuring it out as I go along! I've written a query that is supposed return data from column "aid" in database table "downline_builder", based on the contents of columns "mid" and "pid". The url I am loading ends with ?rid=(a number), which is where the data for "rid" comes from.

This is what I have, and it isn't returning anything! (I know the query and result lines could be combined into one, but I'm finding it easier at the moment to break it down into small chunks.)

<?
$memberid = $_GET['rid'];
$hbpro = mysql_query("SELECT aid FROM downline_builder WHERE pid= 51 AND mid= '$memberid'");
$hbproid = mysql_result($hbpro, 0);
?>

Can someone tell me what I'm doing wrong because I'm really stuck with this?

bradgrafelman

Welcome to PHPBuilder!

Here are a list of issues I see with the code snippet you posted (in no particular order):

Stop Using the MySQL Extension!
```
$memberid = $_GET['rid'];
```
What if $_GET['rid'] doesn't exist? The answer is your code will generate an E_NOTICE level error message and then continue on as if it really did receive the information it expected.

Instead, consider using [man]isset/man to first check if this data exists and, if not, handling the problem gracefully.
User-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data such as by using a function like [man]mysqli_real_escape_string/man for string data (or casting for numeric data) or by using prepared statements.
You never check to see if the SQL query was successfully executed and, if not, outputting and/or logging the MySQL error message to aid in debugging. You should always verify this before you attempt to access the result set.
Your code snippet seems incomplete; what do you try to do with $hbproid after it ends? Note that you never verify that the result set contained at least one row, so $hbproid could be boolean FALSE (indicating there are no rows left in the result set to fetch).

EDIT: Also, when posting PHP code in the future, please use the board's [noparse]

..

[/noparse] bbcode tags as they make your code much easier to read and analyze.