Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #9251

Re: take two - fetch items from a row.

Show all headers | View raw

On 05/03/2013 07:02 PM, richard wrote:
> This code may reside on a page in a line.
> < a href="http:www.code.com/gettable.php?number=1">
>
>
> Where I show id=$number, is that the way I want to show it or is there a
> beter way?
> I want to retrieve the row corresponding to the id number given in the
> link.
>
> <?php
>
>
> $number=$_GET["number"];
> if (empty($number)) {$number=1;}
> $number=(int)$number;
>
> // connections code left out intentionally //
>
>
> $result = mysql_query("SELECT id,email FROM people WHERE id = $number");
> if (!$result) {
>      echo 'Could not run query: ' . mysql_error();
>      exit;
> }
> $row = mysql_fetch_row($result);
>
> echo $row[0]; // 42
> echo $row[1]; // the email value
> ?>
>

<?php
   $number = isset($_GET["number"]) ? $_GET["number"] : 0;
   $number = (is_numeric($number) && ctype_digit($number)) ? $number : 0;

   if ($number == 0) {
     /* bad input - do something here
     since 1 is more than likely a valid record you may not want to give
     out that data based on bad input.
     */

     exit;
   }

   // ... connection code ...

   $result = mysql_query("SELECT id.email FROM people WHERE id = $number");
   if (!$result) {
     echo 'Could not run query: ' . mysql_error();
     exit;
   }
   $row = mysql_fetch_row($result);

   echo $row[0]; // 42
   echo $row[1]; // the email value
?>

   There are many different ways to go about sanitising your input, some 
of which you can download.

...and here's a good source (found on bobby-tables.com):

http://download.oracle.com/oll/tutorials/SQLInjection/index.htm

-- 
Norman
Registered Linux user #461062
-Have you been to www.php.net yet?-

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

take two - fetch items from a row. richard <noreply@example.com> - 2013-05-03 19:02 -0400
  Re: take two - fetch items from a row. richard <noreply@example.com> - 2013-05-03 19:13 -0400
    Re: take two - fetch items from a row. Denis McMahon <denismfmcmahon@gmail.com> - 2013-05-04 00:59 +0000
  Re: take two - fetch items from a row. Richard Yates <richard@yatesguitar.com> - 2013-05-03 16:32 -0700
    Re: take two - fetch items from a row. richard <noreply@example.com> - 2013-05-03 19:54 -0400
      Re: take two - fetch items from a row. Richard Yates <richard@yatesguitar.com> - 2013-05-03 19:20 -0700
        Re: take two - fetch items from a row. "Beauregard T. Shagnasty" <a.nony.mous@example.invalid> - 2013-05-04 03:37 +0000
  Re: take two - fetch items from a row. SwissCheese <swisscheese@cfl.rr.com> - 2013-05-04 07:00 -0400

csiph-web