Forum Moderators: open

Message Too Old, No Replies

Unable to Retrieve Info From MySQL Using $ GET

$_GET information not being found in MySQL

         

jimh009

5:15 pm on Oct 6, 2009 (gmt 0)

10+ Year Member



Hi,

I'm running a simple test script on the theory that if I get this to work, everything will be all set up properly for what I need to do.

I have simple dynamic pages on my site. The url structure for these pages are structured as follows:
<code>

mysite.com/myfolder/my-product-index-page.php?name=Individual Product Name

</code>

(notice the white space between the words)

Like other sales pages, there is both an index page of products and a detailed individual product page. As for the products, there are only a few of them but they come in a multitude of colors. As such, I only show one color on the product index page to avoid cluttering everything up.

However, on the detailed product pages I want to show the multitude of colors available for that particular product.

To accomplish this, I had planned on using $_GET. I use $_GET to pull the Product Name from the url with the following code:

$id = $_GET['name'];
echo $id;

This code is working properly as I see the output of the product name properly printed out on the page. What's printed out is matching what is in the database too, whitespace between the words and all. There is also no extra whitespace at the end of the output, either - again matching what is in the database.

However, when I use $id variable to locate other products in the database that have identical names (the 'NAME' field), I'm getting zero results (even though I should be getting 2-20). The code I use is as follows for the MySQL query.

$result = mysql_query('select * FROM Table WHERE NAME = "$id"');
$num_rows = mysql_num_rows($result);
echo $num_rows;

Any ideas on why I'm getting 0 results despite having between 2-20 results in the database that match the $id variable? Is the whitespace somehow messing something up?

Thanks

Jim

rocknbil

7:36 pm on Oct 6, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Any ideas on why I'm getting 0 results.....?

Yes. :-)

'select * FROM Table WHERE NAME = "$id"'

Single quotes will not interpolate variables, so you are in essence you are searching for a literal value $id.

It's always better to store your selects in variables anyway. Try something like this.

$select = 'select * FROM Table WHERE NAME = "' . $id . '"'; // last is single quote, double quote, single quote
$result = mysql_query($select);

Before going live though, do a little cleansing on your input variables, make sure the input variable (name) is not the same as your table field name, this is open to mySQL injection.

You'll also have to consider what to do in cases like this

mysite.com/myfolder/my-product-index-page.php?name=Large "Supersize" Widget

As the input quotes will likely create problems with the select statements, you will need to escape them, etc.

Last, spaces in a URL is a Very Bad Idea. If it manages to get into serps, what you get is

mysite.com/myfolder/my-product-index-page.php?name=Individual%20Product%20Name

A better approach might be

mysite.com/myfolder/my-product-index-page.php?name=Individual-Product-Name

and sub out the dashes prior to building the select.