PHP Query + IF ELSE

Question

I Have a PHP file doing a query

function getFiles()
{
    $solnid = $_GET[id];
    $query = mysql_query("SELECT * FROM library WHERE libr_solutionId = '$solnid' AND libr_deleted IS NULL") or die(mysql_error());
    $result = mysql_query($query);
    if (mysql_num_rows($result)==0) {
        echo "<br>No Related Links";
    } else {
        while($library = mysql_fetch_assoc($query)) {
            echo "<span style=\"margin-bottom: 5px;\"><a href=\"Solutions/image/".$library[libr_solutionref]."/".$library[libr_filename]."\" target=\"_blank\"><img src=\"images/icon-download-02.png\" align=\"absmiddle\" style=\"margin-right: 5px;\"><span>".$library[libr_c_title]."</span></a></span><br>";
            echo "<br>";
        }
    }       
}

I have tested the query in PHPMyAdmin and I get a result however when running the function in my page it only displays the 'No Related Links' statement any ideas anyone?

I know but it's a closed system so that's not to much of an issue — Justin Erswell
– Justin Erswell, Commented Dec 23, 2011 at 9:44
closed system: 80% of attacks comes from collaborators plus it's a bad habit — RageZ
– RageZ, Commented Dec 23, 2011 at 9:52

NoLifeKing · Accepted Answer · 2011-12-23 09:45:32Z

4

Here's the fixed code. :) The problem was that you used mysql_query on a Resource (the first mysql_query), and that will give 0 rows, or an exception..

function getFiles()
{
    $solnid = $_GET['id'];
    $result = mysql_query("SELECT * FROM library WHERE libr_solutionId = '$solnid' AND libr_deleted IS NULL") or die(mysql_error());
    if (mysql_num_rows($result)==0) {
        echo "<br>No Related Links";
    } else {
        while($library = mysql_fetch_assoc($result)) {
            echo "<span style=\"margin-bottom: 5px;\"><a href=\"Solutions/image/".$library['libr_solutionref']."/".$library['libr_filename']."\" target=\"_blank\"><img src=\"images/icon-download-02.png\" align=\"absmiddle\" style=\"margin-right: 5px;\"><span>".$library['libr_c_title']."</span></a></span><br>";
            echo "<br>";
        }
    }       
}

answered Dec 23, 2011 at 9:45

NoLifeKing

1,94913 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

NoLifeKing Over a year ago

You should also sanitize the parameter for $solnid, it is possible to exploit that SQL as it is right now and do some injects. :)

Patches Over a year ago

Nice catch! I totally missed the double mysql_query when I read through it.

Dau · Accepted Answer · 2011-12-23 09:45:50Z

change your function to (change to lines)

function getFiles()
{
    $solnid = $_GET[id];
    $result = mysql_query("SELECT * FROM library WHERE libr_solutionId = '$solnid' AND libr_deleted IS NULL") or die(mysql_error());
    if (mysql_num_rows($result)==0) {
        echo "<br>No Related Links";
    } else {
        while($library = mysql_fetch_assoc($query)) {
            echo "<span style=\"margin-bottom: 5px;\"><a href=\"Solutions/image/".$library[libr_solutionref]."/".$library[libr_filename]."\" target=\"_blank\"><img src=\"images/icon-download-02.png\" align=\"absmiddle\" style=\"margin-right: 5px;\"><span>".$library[libr_c_title]."</span></a></span><br>";
            echo "<br>";
        }
    }       
}

Collectives™ on Stack Overflow

PHP Query + IF ELSE

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related