Re: Variable not showing up.
| From: | Jim Lucas | Date: | Wed, 02 Jul 2008 19:30:11 +0000 |
| Subject: | Re: Variable not showing up. | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-276227@lists.php.net to get a copy of this message | ||
Couple things, read in-line...
Steve Marquez wrote:
Greetings, The following code works in every way except one. The variable, $linkspage, in the link, will not replace with information from the database for some reason. No matter what else I put in $id_num, $filename or whatever it replaces, but not $linkspage. The variable does work above, in the query. Does this make sense? I hope so. Thanks for any help. <?I suggest using <?php instead of short tags... anyways...
include '../cms/cnx.php'; $linkspage = $_GET["linkspage"];Holly cow, clean this variable before you use it in an SQL statement!!! Use mysql_real_escape_string() if nothing else.
/* Performing SQL query */ $query = "SELECT * FROM cms_pages WHERE linkspage='$linkspage' ORDER BY id_num DESC";What are the name of all the columns in this table? Could one of them be called 'likespage' by change?
$result = mysql_query($query) or die("Query failed"); while ($line = mysql_fetch_array($result, MYSQL_ASSOC)) { extract ( $line );Never, Never, Never run extract like this. Refer to the
?>What is this for? Just use echo $filename;<a class="subnav" href="<?php print "$filename?linkspage=$linkspage"; ?>"><? if ($filename = str_replace('.php','',$filename)) {echo ''.$filename.'';
}
echo ' </a>';
}
Wait, just replace the entire previous code with this
Note: long tag instead of short :)
<?php
# ummm... your stuff here....
include '../cms/cnx.php';
# Note: your_cleaner_function() refers to a function that you built that cleans
# and validates the input. It is nothing that is built into PHP.
$linkspage = your_cleaner_function($_GET["linkspage"]);
/* Performing SQL query */ # nope, build query
# Please remember to escape your data!!!!!
$SQL = "SELECT *
FROM cms_pages
WHERE linkspage='".mysql_real_escape_string($linkspage)."'
ORDER BY id_num DESC";
# Perform query has been moved here.
# Check to see if the the query failed
if ( ( $result = mysql_query($SQL) ) !== false ) {
# Loop through result set, I used *_fetch_assoc() instead of *_fetch_array
# It is less typing! But then again, I guess my comments make up the
# difference in the savings. :)
while ( $line = mysql_fetch_assoc($result) ) {
# echo each link
echo "<a href='{$filename}?linkspage={$linkspage}' class='subnav' >" .
str_replace('.php', '', $filename) . "</a>";
}
} else {
# well duh...
echo 'No results!';
}
?>
their is no need for a condition, because the way that you have it, if it fails, then it doesn't print anything at all.
?>-- Jim Lucas "Some men are born to greatness, some achieve greatness, and some have greatness thrust upon them." Twelfth Night, Act II, Scene V by William Shakespeare