Why isn't this PHP mysql_query getting the correct info from my database?

Question

I'm relatively new to this, so sorry if I'm posting in the wrong place. I've got a table in my database which holds 4 things - id, time put in and user and message (for a basic chat-room style thing). I'm trying to call these using a PHP page. But my page just gets returned blank when I put an argument in the address bar. I'm trying to call it so that only lines with a certain user in the user column get shown. My code is below - can anybody see what I am doing wrong? The URL of the file is http://freedom-apps.co.uk/chat/messages.php. You see a load of entries - at the start, there is u m u m u m. U represents the user entered, m is the message. So I tried: http://freedom-apps.co.uk/chat/messages.php?user=u which returns an error. Any ideas? My code is:

<?php
header( 'Content-type: text/xml' );
mysql_connect('localhost:/var/lib/mysql/mysql.sock', 
              'freedom_ASAPPS', '********');
mysql_select_db( 'freedom_chat_alpha' );
if ( $_REQUEST['user'] ) {
    $user = mysql_escape_string($_REQUEST['user']);
    $result = mysql_query('SELECT * FROM chatitems WHERE user = '$user' 
              ORDER BY added LIMIT 50');
} else {
    $result = mysql_query('SELECT * FROM chatitems ORDER BY added LIMIT 50');    
}
?>
<chat>
<?php
while ($row = mysql_fetch_assoc($result)) {
?>
<message added="<?php echo( $row['added'] ) ?>" 
    id="<?php echo( $row['id'] ) ?>">
    <user><?php echo( htmlentities( $row['user'] ) ) ?></user>
    <text><?php echo( htmlentities( $row['message'] ) ) ?></text>
</message>
<?php
}
var_dump($result);
mysql_free_result($result);
?>
</chat>

I believe it is something wrong with line 6 and 7, or in the way I call the php page with the argument (see above). I've being referring to the book I have used to learn this stuff, and still can't figure it out (Learning PHP, MySQL, and JavaScript: A Step-by-Step Guide to Creating Dynamic Websites).

Thanks, Sam

Please read http://stackoverflow.com/questions/3665572/mysql-escape-string-vs-mysql-real-escape-string about using `mysql_escape_string()` — lc., Jul 14 '12 at 17:15

score 6 · Accepted Answer · answered Jul 14 '12 at 17:13

$result = mysql_query('SELECT * FROM chatitems WHERE user = '$user' ORDER BY added LIMIT 50');

This is a syntax error - you're missing the string concatenation operators:

$result = mysql_query('SELECT * FROM chatitems WHERE user = ' . $user . ' ORDER BY added LIMIT 50');
                                                            ^^^------^^^^--- here

Alternatively, use double-quoted strings:

$result = mysql_query("SELECT * FROM chatitems WHERE user = '$user' ORDER BY added LIMIT 50");

Getting a blank page suggests you've got display_errors turned off in php.ini. You should turn that on while debugging/developing. You're just shooting yourself in the foot hiding the very messages that would have told you what the problem was.

Thanks - line 3 worked. I found the relevant section in my book now, which explains the actual logic for it. — Sam Heather, Jul 14 '12 at 17:21

Why isn't this PHP mysql_query getting the correct info from my database?

1 Answers1