Trouble running a select query against a database, when I know the connection is working, and the da
Trouble running a select query against a database, when I know the connection is working, and the da
am 13.04.2010 10:36:46 von Jacob Kruger
I am trying to simply just loop through a set of records to spit out
tags for the data therein, and on the same page, it's successfully running
another query against the same connection - which I have also tried turning
off just in case it was a problem with running two queries against the same
connection (really don't think so), but it just tells me there are no
records being returned, although I have tried simplifying the sql statement,
pulling records from another table, etc. etc., and I really don't know what
am doing wrong with this really simple bit of scripting:
$qry = mysql_query("select CatName from tblCats where Id = " .
$_REQUEST['id']);
$arr = mysql_fetch_array($qry);
echo "" . $arr['CatName'] . "
";
//that part works fine
$sql = "select Id, CatID, LinkName, LinkDescription, LinkURL from tblLinks
where CatID = " . $_REQUEST['id'] . ";";
//the SQL statement seems to come out fine as well if I echo it out to the
browser
$qry = mysql_query($sql);
$arr = mysql_fetch_array($qry);
if ($arr.count > 0)
{
echo "";
while($row = mysql_fetch_array($arr))
{
echo "- " . $row['LinkName'] . " - " . $row['LinkDescription'] . " - ";
echo "" . $row['LinkURL']
.. " ";
}
echo "
";
}
else
{
echo "no links in category";
}
mysql_close($con);
It permanently just keeps on deciding there are no rows to output, so I'm a
bit confused at the moment.
Stay well
Jacob Kruger
Blind Biker
Skype: BlindZA
'...fate had broken his body, but not his spirit...'
__________ Information from ESET NOD32 Antivirus, version of virus signature database 5023 (20100412) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: Trouble running a select query against a database, when
am 13.04.2010 10:57:57 von Richard Quadling
On 13 April 2010 09:36, Jacob Kruger wrote:
> if ($arr.count > 0)
Try ...
if (mysql_num_rows($arr) > 0)
--
-----
Richard Quadling
"Standing on the shoulders of some very clever giants!"
EE : http://www.experts-exchange.com/M_248814.html
EE4Free : http://www.experts-exchange.com/becomeAnExpert.jsp
Zend Certified Engineer : http://zend.com/zce.php?c=ZEND002498&r=213474731
ZOPA : http://uk.zopa.com/member/RQuadling
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: Trouble running a select query against a database, when I know the connection is working, and th
am 13.04.2010 11:40:55 von Jacob Kruger
------=_NextPart_000_00BC_01CADAFE.2DCA9540
Content-Type: text/plain;
charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Thanks.
Will try it out - think the .count is just related to $arr being sort of =
an array of records - and think I got it out of the PHP tutorial from =
w3schools.com, and it's worked on other pages.
Anyway, the following does now seem to work fine:
$qry =3D mysql_query($sql);
if (mysql_num_rows($qry) > 0)
{
echo "
";
while($row =3D mysql_fetch_array($qry))
{
echo "- " . $row['LinkName'] . " - " . $row['LinkDescription'] . " - =
";
echo "" . =
$row['LinkURL'] . " ";
}
echo "
";
}
Thanks again
Stay well
Jacob Kruger
Blind Biker
Skype: BlindZA
'...fate had broken his body, but not his spirit...'
----- Original Message -----=20
From: Ferenc Kovacs=20
To: Jacob Kruger=20
Sent: Tuesday, April 13, 2010 10:46 AM
Subject: Re: [PHP-WIN] Trouble running a select query against a =
database, when I know the connection is working, and the data is there
On Tue, Apr 13, 2010 at 10:36 AM, Jacob Kruger =
wrote:
I am trying to simply just loop through a set of records to spit out =
tags for the data therein, and on the same page, it's =
successfully running another query against the same connection - which I =
have also tried turning off just in case it was a problem with running =
two queries against the same connection (really don't think so), but it =
just tells me there are no records being returned, although I have tried =
simplifying the sql statement, pulling records from another table, etc. =
etc., and I really don't know what am doing wrong with this really =
simple bit of scripting:
$qry =3D mysql_query("select CatName from tblCats where Id =3D " . =
$_REQUEST['id']);
$arr =3D mysql_fetch_array($qry);
echo "" . $arr['CatName'] . "
";
//that part works fine
$sql =3D "select Id, CatID, LinkName, LinkDescription, LinkURL from =
tblLinks where CatID =3D " . $_REQUEST['id'] . ";";
//the SQL statement seems to come out fine as well if I echo it out =
to the browser
$qry =3D mysql_query($sql);
$arr =3D mysql_fetch_array($qry);
if ($arr.count > 0)
where did you get that $arr.count thingie?
you can count the result rows with mysql_num_rows
http://www.php.net/manual/en/function.mysql-num-rows.php
Tyrael
__________ Information from ESET NOD32 Antivirus, version of virus =
signature database 5023 (20100412) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
__________ Information from ESET NOD32 Antivirus, version of virus signatur=
e database 5024 (20100413) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
------=_NextPart_000_00BC_01CADAFE.2DCA9540--
Re: Trouble running a select query against a database,when I know the connection is working, and the
am 13.04.2010 12:00:37 von Toby Hart Dyke
On 4/13/2010 9:36 AM, Jacob Kruger wrote:
> $qry = mysql_query($sql);
> $arr = mysql_fetch_array($qry);
> if ($arr.count > 0)
> {
> echo "
";
> while($row = mysql_fetch_array($arr))
You retrieve a row, check if it has any elements, then attempt to
retrieve the next row, using the array you just created as the argument.
You should be using $qry as the argument, but you're skipping over the
first row.
Toby
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: Trouble running a select query against a database, when
am 13.04.2010 12:01:02 von Richard Quadling
On 13 April 2010 10:40, Jacob Kruger wrote:
> Thanks.
>
> Will try it out - think the .count is just related to $arr being sort of =
an array of records - and think I got it out of the PHP tutorial from w3sch=
ools.com, and it's worked on other pages.
>
> Anyway, the following does now seem to work fine:
>
> $qry =3D mysql_query($sql);
> if (mysql_num_rows($qry) > 0)
> {
> echo "";
> while($row =3D mysql_fetch_array($qry))
> Â {
> echo "- " . $row['LinkName'] . " - " . $row['LinkDescription'] . " - ";
> echo "" . $row['Lin=
kURL'] . " ";
> Â }
> echo "
";
> }
>
> Thanks again
>
> Stay well
>
> Jacob Kruger
> Blind Biker
> Skype: BlindZA
> '...fate had broken his body, but not his spirit...'
>
> Â ----- Original Message -----
> Â From: Ferenc Kovacs
> Â To: Jacob Kruger
> Â Sent: Tuesday, April 13, 2010 10:46 AM
> Â Subject: Re: [PHP-WIN] Trouble running a select query against a dat=
abase, when I know the connection is working, and the data is there
>
>
>
>
>
> Â On Tue, Apr 13, 2010 at 10:36 AM, Jacob Kruger
za> wrote:
>
> Â Â I am trying to simply just loop through a set of records to =
spit out tags for the data therein, and on the same page, it's succe=
ssfully running another query against the same connection - which I have al=
so tried turning off just in case it was a problem with running two queries=
against the same connection (really don't think so), but it just tells me =
there are no records being returned, although I have tried simplifying the =
sql statement, pulling records from another table, etc. etc., and I really =
don't know what am doing wrong with this really simple bit of scripting:
>
> Â Â $qry =3D mysql_query("select CatName from tblCats where Id =
=3D " . $_REQUEST['id']);
> Â Â $arr =3D mysql_fetch_array($qry);
> Â Â echo "" . $arr['CatName'] . "
";
> Â Â //that part works fine
> Â Â $sql =3D "select Id, CatID, LinkName, LinkDescription, LinkU=
RL from tblLinks where CatID =3D " . $_REQUEST['id'] . ";";
> Â Â //the SQL statement seems to come out fine as well if I echo=
it out to the browser
> Â Â $qry =3D mysql_query($sql);
> Â Â $arr =3D mysql_fetch_array($qry);
> Â Â if ($arr.count > 0)
>
>
> Â where did you get that $arr.count thingie?
> Â you can count the result rows with mysql_num_rows
> Â http://www.php.net/manual/en/function.mysql-num-rows.p hp
>
> Â Tyrael
>
>
>
>
>
> __________ Information from ESET NOD32 Antivirus, version of virus signat=
ure database 5023 (20100412) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
> __________ Information from ESET NOD32 Antivirus, version of virus signat=
ure database 5024 (20100413) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
Nope.
Breakdown of $arr.count
1 - $arr
2 - .
3 - count
1 - $arr
This is a variable which, in this instance, is a mysql result
resource. Not usefully expressable as a string under normal
conditions.
2 - .
This is the append/concatentate operator.
3 - count
In this state, this will try and find the value of the constant called 'cou=
nt'.
If it doesn't find one, it will assume the text of 'count'.
So, this becomes something like ...
"Resource id #5count"
And when you test that "> 0", you get false.
e.g.
php -r "var_dump(fopen('./AUTOEXEC.BAT', 'rt').count);"
outputs ...
Notice: Use of undefined constant count - assumed 'count' in Command
line code on line 1
string(19) "Resource id #5count"
and ...
php -r "var_dump(fopen('./AUTOEXEC.BAT', 'rt').count > 0);"
outputs ...
Notice: Use of undefined constant count - assumed 'count' in Command
line code on line 1
bool(false)
My error_reporting level is set to -1.
If yours is set to E_ALL, then the E_NOTICES won't be seen on any
version less than PHP6/trunk.
So, first set the error reporting to -1 (to really show ALL messages)
and re-run your code.
You'll see the error.
Regards,
Richard.
--=20
-----
Richard Quadling
"Standing on the shoulders of some very clever giants!"
EE : http://www.experts-exchange.com/M_248814.html
EE4Free : http://www.experts-exchange.com/becomeAnExpert.jsp
Zend Certified Engineer : http://zend.com/zce.php?c=3DZEND002498&r=3D213474=
731
ZOPA : http://uk.zopa.com/member/RQuadling
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: Trouble running a select query against a database, when
am 13.04.2010 12:02:01 von Richard Quadling
On 13 April 2010 11:00, Toby Hart Dyke wrote:
> On 4/13/2010 9:36 AM, Jacob Kruger wrote:
>>
>> $qry =3D mysql_query($sql);
>> $arr =3D mysql_fetch_array($qry);
>> if ($arr.count > 0)
>> {
>> echo "";
>> while($row =3D mysql_fetch_array($arr))
>
> You retrieve a row, check if it has any elements, then attempt to retriev=
e
> the next row, using the array you just created as the argument. You shoul=
d
> be using $qry as the argument, but you're skipping over the first row.
>
> Â Toby
>
> --
> PHP Windows Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
Good catch Toby.
--=20
-----
Richard Quadling
"Standing on the shoulders of some very clever giants!"
EE : http://www.experts-exchange.com/M_248814.html
EE4Free : http://www.experts-exchange.com/becomeAnExpert.jsp
Zend Certified Engineer : http://zend.com/zce.php?c=3DZEND002498&r=3D213474=
731
ZOPA : http://uk.zopa.com/member/RQuadling
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: Trouble running a select query against a database, when I know the connection is working, and th
am 13.04.2010 12:52:09 von Jacob Kruger
Yup, figured that one out as well.
Thanks
Jacob Kruger
Blind Biker
Skype: BlindZA
'...fate had broken his body, but not his spirit...'
----- Original Message -----
From: "Toby Hart Dyke"
To: "Jacob Kruger"
Cc:
Sent: Tuesday, April 13, 2010 12:00 PM
Subject: Re: [PHP-WIN] Trouble running a select query against a database,
when I know the connection is working, and the data is there
> On 4/13/2010 9:36 AM, Jacob Kruger wrote:
>> $qry = mysql_query($sql);
>> $arr = mysql_fetch_array($qry);
>> if ($arr.count > 0)
>> {
>> echo "";
>> while($row = mysql_fetch_array($arr))
>
> You retrieve a row, check if it has any elements, then attempt to retrieve
> the next row, using the array you just created as the argument. You should
> be using $qry as the argument, but you're skipping over the first row.
>
> Toby
>
> --
> PHP Windows Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature database 5024 (20100413) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
__________ Information from ESET NOD32 Antivirus, version of virus signature database 5024 (20100413) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: Trouble running a select query against a database, when I know the connection is working, and th
am 13.04.2010 12:55:03 von Jacob Kruger
Thanks - will definitely be setting errors to show all as well - in old days
with classic ASP, it was around the first server settings change you
implemented to test/develop things.
Stay well
Jacob Kruger
Blind Biker
Skype: BlindZA
'...fate had broken his body, but not his spirit...'
----- Original Message -----
From: "Richard Quadling"
To: "Jacob Kruger"
Cc:
Sent: Tuesday, April 13, 2010 12:01 PM
Subject: Re: [PHP-WIN] Trouble running a select query against a database,
when I know the connection is working, and the data is there
On 13 April 2010 10:40, Jacob Kruger wrote:
> Thanks.
>
> Will try it out - think the .count is just related to $arr being sort of
> an array of records - and think I got it out of the PHP tutorial from
> w3schools.com, and it's worked on other pages.
>
> Anyway, the following does now seem to work fine:
>
> $qry = mysql_query($sql);
> if (mysql_num_rows($qry) > 0)
> {
> echo "";
> while($row = mysql_fetch_array($qry))
> {
> echo "- " . $row['LinkName'] . " - " . $row['LinkDescription'] . " - ";
> echo "" .
> $row['LinkURL'] . " ";
> }
> echo "
";
> }
>
> Thanks again
>
> Stay well
>
> Jacob Kruger
> Blind Biker
> Skype: BlindZA
> '...fate had broken his body, but not his spirit...'
>
> ----- Original Message -----
> From: Ferenc Kovacs
> To: Jacob Kruger
> Sent: Tuesday, April 13, 2010 10:46 AM
> Subject: Re: [PHP-WIN] Trouble running a select query against a database,
> when I know the connection is working, and the data is there
>
>
>
>
>
> On Tue, Apr 13, 2010 at 10:36 AM, Jacob Kruger
> wrote:
>
> I am trying to simply just loop through a set of records to spit out
> /> tags for the data therein, and on the same page, it's successfully
> running another query against the same connection - which I have also
> tried turning off just in case it was a problem with running two queries
> against the same connection (really don't think so), but it just tells me
> there are no records being returned, although I have tried simplifying the
> sql statement, pulling records from another table, etc. etc., and I really
> don't know what am doing wrong with this really simple bit of scripting:
>
> $qry = mysql_query("select CatName from tblCats where Id = " .
> $_REQUEST['id']);
> $arr = mysql_fetch_array($qry);
> echo "" . $arr['CatName'] . "
";
> //that part works fine
> $sql = "select Id, CatID, LinkName, LinkDescription, LinkURL from tblLinks
> where CatID = " . $_REQUEST['id'] . ";";
> //the SQL statement seems to come out fine as well if I echo it out to the
> browser
> $qry = mysql_query($sql);
> $arr = mysql_fetch_array($qry);
> if ($arr.count > 0)
>
>
> where did you get that $arr.count thingie?
> you can count the result rows with mysql_num_rows
> http://www.php.net/manual/en/function.mysql-num-rows.php
>
> Tyrael
>
>
>
>
>
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature database 5023 (20100412) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature database 5024 (20100413) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
Nope.
Breakdown of $arr.count
1 - $arr
2 - .
3 - count
1 - $arr
This is a variable which, in this instance, is a mysql result
resource. Not usefully expressable as a string under normal
conditions.
2 - .
This is the append/concatentate operator.
3 - count
In this state, this will try and find the value of the constant called
'count'.
If it doesn't find one, it will assume the text of 'count'.
So, this becomes something like ...
"Resource id #5count"
And when you test that "> 0", you get false.
e.g.
php -r "var_dump(fopen('./AUTOEXEC.BAT', 'rt').count);"
outputs ...
Notice: Use of undefined constant count - assumed 'count' in Command
line code on line 1
string(19) "Resource id #5count"
and ...
php -r "var_dump(fopen('./AUTOEXEC.BAT', 'rt').count > 0);"
outputs ...
Notice: Use of undefined constant count - assumed 'count' in Command
line code on line 1
bool(false)
My error_reporting level is set to -1.
If yours is set to E_ALL, then the E_NOTICES won't be seen on any
version less than PHP6/trunk.
So, first set the error reporting to -1 (to really show ALL messages)
and re-run your code.
You'll see the error.
Regards,
Richard.
--
-----
Richard Quadling
"Standing on the shoulders of some very clever giants!"
EE : http://www.experts-exchange.com/M_248814.html
EE4Free : http://www.experts-exchange.com/becomeAnExpert.jsp
Zend Certified Engineer : http://zend.com/zce.php?c=ZEND002498&r=213474731
ZOPA : http://uk.zopa.com/member/RQuadling
__________ Information from ESET NOD32 Antivirus, version of virus signature
database 5024 (20100413) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
__________ Information from ESET NOD32 Antivirus, version of virus signature database 5024 (20100413) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: Trouble running a select query against a database, when I know the connection is working, and th
am 14.04.2010 04:06:26 von Jacob Kruger
Thanks.
Figured it out, and also know shouldn't just copy and paste too much code as
such...
Stay well
Jacob Kruger
Blind Biker
Skype: BlindZA
'...fate had broken his body, but not his spirit...'
----- Original Message -----
From: "Toby Hart Dyke"
To: "Jacob Kruger"
Cc:
Sent: Tuesday, April 13, 2010 12:00 PM
Subject: Re: [PHP-WIN] Trouble running a select query against a database,
when I know the connection is working, and the data is there
> On 4/13/2010 9:36 AM, Jacob Kruger wrote:
>> $qry = mysql_query($sql);
>> $arr = mysql_fetch_array($qry);
>> if ($arr.count > 0)
>> {
>> echo "";
>> while($row = mysql_fetch_array($arr))
>
> You retrieve a row, check if it has any elements, then attempt to retrieve
> the next row, using the array you just created as the argument. You should
> be using $qry as the argument, but you're skipping over the first row.
>
> Toby
>
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature database 5026 (20100413) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
__________ Information from ESET NOD32 Antivirus, version of virus signature database 5026 (20100413) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: Trouble running a select query against a database, when I know the connection is working, and th
am 15.04.2010 02:48:48 von Jacob Kruger
Thanks.
Will be honest, and while have played around with PHP etc., have never
really done much with it in terms of going into production as such anyway,
so, yes, will need to learn/figure out how to do things the best way, etc.
Stay well
Jacob Kruger
Blind Biker
Skype: BlindZA
'...fate had broken his body, but not his spirit...'
----- Original Message -----
From: "Jean Delefrati"
To: "Jacob Kruger"
Sent: Wednesday, April 14, 2010 10:29 PM
Subject: Re: [PHP-WIN] Trouble running a select query against a database,
when I know the connection is working, and the data is there
You should try add some "or"(s) in your script - so, if an error
ocurred, you can kill your script.
Like this:
$qry = mysql_query($sql) or die("An error ocurred: " . mysql_error());
Of course you shouldn't put the mysql_error() in the final code, for
security issues, just replace by one better message to your users.
[ ]'s!
Jean Rafael
2010/4/13 Jacob Kruger :
> Thanks.
>
> Figured it out, and also know shouldn't just copy and paste too much code
> as
> such...
>
> Stay well
>
> Jacob Kruger
> Blind Biker
> Skype: BlindZA
> '...fate had broken his body, but not his spirit...'
>
> ----- Original Message ----- From: "Toby Hart Dyke"
> To: "Jacob Kruger"
> Cc:
> Sent: Tuesday, April 13, 2010 12:00 PM
> Subject: Re: [PHP-WIN] Trouble running a select query against a database,
> when I know the connection is working, and the data is there
>
>
>> On 4/13/2010 9:36 AM, Jacob Kruger wrote:
>>>
>>> $qry = mysql_query($sql);
>>> $arr = mysql_fetch_array($qry);
>>> if ($arr.count > 0)
>>> {
>>> echo "";
>>> while($row = mysql_fetch_array($arr))
>>
>> You retrieve a row, check if it has any elements, then attempt to
>> retrieve
>> the next row, using the array you just created as the argument. You
>> should
>> be using $qry as the argument, but you're skipping over the first row.
>>
>> Toby
>>
>> __________ Information from ESET NOD32 Antivirus, version of virus
>> signature database 5026 (20100413) __________
>>
>> The message was checked by ESET NOD32 Antivirus.
>>
>> http://www.eset.com
>>
>>
>>
>
>
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature
> database 5026 (20100413) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
>
> --
> PHP Windows Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
__________ Information from ESET NOD32 Antivirus, version of virus signature
database 5029 (20100414) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
__________ Information from ESET NOD32 Antivirus, version of virus signature database 5029 (20100414) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: Trouble running a select query against a database,when I know the connection is working, and the
am 22.04.2010 17:27:27 von James Crow
On 04/14/2010 08:48 PM, Jacob Kruger wrote:
> Thanks.
>
> Will be honest, and while have played around with PHP etc., have never
> really done much with it in terms of going into production as such
> anyway, so, yes, will need to learn/figure out how to do things the
> best way, etc.
>
> Stay well
>
> Jacob Kruger
> Blind Biker
> Skype: BlindZA
> '...fate had broken his body, but not his spirit...'
And while you are trying to learn good habits look at SQL Injection
attacks. Using something like $_REQUEST['id'] in a query is just asking
for it. Many of the PHP and MySQL tutorials I have seen barely mention
this problem, if at all.
Consider if someone had sent your script a URL like this:
scipt.php?id='';DELETE FROM table tblLinks;
If the user running the mysql_query() function had the rights to delete
rows on the tblLinks table, the tblLinks table would be empty.
Cheers,
James
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: Trouble running a select query against a database, when I know the connection is working, and th
am 22.04.2010 22:36:28 von Jacob Kruger
I know - used to deal with/handle SQL injection prevention quite a bit in
old days - and think have already got one or two code samples for
counteracting it in PHP/MySQL, and they would generally be kept in functions
in a general include file, to be included in all database accessing pages,
and I would also generally not make too much use of querystring/get data
passing in that sense either, but anyway...
One of the workarounds looked into in the past was where it would also just
look like a standard link on a page, but where it would actually do a
form of hidden form submission where hidden fields would be set with certain
values, either dynamically hard coded, or set using javascript etc., which
could also be worked around by submitting a form from another source, but it
really also depended on the target production environment since while I know
there are automated robotic SQLInjection implementations out there, they
would still also be more likely to target websites that generate more
traffic as such, etc. etc.
Stay well
Jacob Kruger
Blind Biker
Skype: BlindZA
'...fate had broken his body, but not his spirit...'
----- Original Message -----
From: "James Crow"
To:
Sent: Thursday, April 22, 2010 5:27 PM
Subject: Re: [PHP-WIN] Trouble running a select query against a database,
when I know the connection is working, and the data is there
> On 04/14/2010 08:48 PM, Jacob Kruger wrote:
>> Thanks.
>>
>> Will be honest, and while have played around with PHP etc., have never
>> really done much with it in terms of going into production as such
>> anyway, so, yes, will need to learn/figure out how to do things the best
>> way, etc.
>>
>> Stay well
>>
>> Jacob Kruger
>> Blind Biker
>> Skype: BlindZA
>> '...fate had broken his body, but not his spirit...'
> And while you are trying to learn good habits look at SQL Injection
> attacks. Using something like $_REQUEST['id'] in a query is just asking
> for it. Many of the PHP and MySQL tutorials I have seen barely mention
> this problem, if at all.
>
> Consider if someone had sent your script a URL like this:
> scipt.php?id='';DELETE FROM table tblLinks;
> If the user running the mysql_query() function had the rights to delete
> rows on the tblLinks table, the tblLinks table would be empty.
>
> Cheers,
> James
>
> --
> PHP Windows Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature database 5051 (20100422) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
__________ Information from ESET NOD32 Antivirus, version of virus signature database 5051 (20100422) __________
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php