help selecting records from post values

[rbvinc]

Please help me with following code syntax, for some reason I could not get records basing memberid.
php mysql windows 7

Thank you.

++++++++++++++++++++
memberid coming from here from different page,
<a href='deletemembernew.php?member=detele&memberid=" . $row['memberid'] . "' target='_self'>". $row['memberid'] . "</a>

---

memberid grabbing here from anothe file.

<?php
echo $_GET['memberid'];
?>

<?php
$servername = "localhost";
$username = "root";
$password = "password";
$dbname = "dbname";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}

$query = "SELECT * FROM tablename WHERE memberid = '$memberid'";

//$sql = ("SELECT * FROM tblnatamember where memberid = '$memberid')";
$result = $conn->query($query);

if ($result->num_rows > 0) {
echo "<table><tr><th>ID</th><th>Name</th></tr>";
// output data of each row
while($row = $result->fetch_assoc()) {
echo "<tr><td>".$row["memberid"]."</td><td>".$row["firstname"]." ".$row["lastname"]."</td></tr>";
}
echo "</table>";
} else {
echo "0 results";
}
$conn->close();
?>

[NogDog]

First, please use this forum's [noparse]

...

[/noparse] tags around your PHP code, and other applicable bbcode tags as needed, so that we can more easily read your code in order to help you.

Okay, so is the echo statement outputting the expected member ID? If not, do you see it in the URL when you get to that page? If not, have you debugged the page where the link is built to find out why?

If it is there, then what exactly is the error/problem? Have you checked the result of the query() call to see if it's false (and if so check for the DB error info)? Is the memberid an integer field? If so, you should not be quoting the value in the query (but should be making sure it is an integer before trying, or casting it to integer to force it to be one).

[DaemonProjects]

looking at the code really quick I noticed $memberid had no value to it. I added it to your code, see if this works, also you can use $REQUEST["memberid"] instead of $GET

<?php
echo $_GET['memberid']; 
?>


<?php
$servername = "localhost";
$username = "root";
$password = "password";
$dbname = "dbname";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
	die("Connection failed: " . $conn->connect_error);
} 

// set variable for $memberid
$memberid = $_GET['memberid']; 

$query = "SELECT * FROM `tablename` WHERE `memberid` =" . $memberid;
$result = $conn->query($query);

if ($result->num_rows > 0) {
	echo "<table><tr><th>ID</th><th>Name</th></tr>";
/	/ output data of each row
	while($row = $result->fetch_assoc()) {
		echo "<tr><td>".$row["memberid"]."</td><td>".$row["firstname"]." ".$row["lastname"]."</td></tr>";
	}
	echo "</table>";
} else {
	echo "0 results";
}
// Close connection
$conn->close();
?>

[sneakyimp]

DaemonProjects;11045871 wrote:

looking at the code really quick I noticed $memberid had no value to it. I added it to your code, see if this works, also you can use $REQUEST["memberid"] instead of $GET

You should know that by doing this you are making your script vulnerable to SQL injection:

$memberid = $_GET['memberid'];

You should probably validate $memberid to be safe. For example, if memberid is supposed to be a number, either check it using [man]is_numeric[/man] or an appropriate pattern matching expression or cast it as a number using [man]intval[/man] or something like that.