If statements with php & Mysql

Question

I need a little bit of your help with if statements in PHP , as I am new to it

First of all I have this query:

$sqlCmd = "SELECT user.name,user.level 
    FROM user.user 
    WHERE user.id = '".$_GET['char']."' 
    LIMIT 1";

and now I have this second query

visible $sqlUpdate = "UPDATE user.user 
    SET level='1' 
    WHERE id='".$_GET['char']."' 
    LIMIT 1";

What I want to do is something like this : if level>1 run the $sqlUpdate, else print an error .

Protect your code against [SQL attacks](http://stackoverflow.com/q/60174/1037210). — Lion, Mar 21 '13 at 04:20
he does not know the where clause and you are telling for sql attack he just noob — Trikaldarshiii, Mar 21 '13 at 09:31

GautamD31 · Answer 1 · 2013-03-21T04:30:53.333

1

Try like this

visible $sqlUpdate = "UPDATE user.user 
                      SET level='1' 
                      WHERE id='".mysql_real_escape_string($_GET['char'])."' 
                      AND level >1 
                      LIMIT 1";

refer this links they may help you to learning http://sqlzoo.net/ ,http://beginner-sql-tutorial.com/sql.htm

edited Mar 21 '13 at 04:30

answered Mar 21 '13 at 04:18

GautamD31

28,552
10
64
85

I haven't downvote this. But I think you have given `w3schools` link for reference and because of that someone has downvote you. – Yogesh Suthar Mar 21 '13 at 04:26
I dont know why but in my case I have started with w3schools...at begining I thought its better lateron you can go through http://sqlzoo.net/ – GautamD31 Mar 21 '13 at 04:27
Nowadays `w3schools` example and code are not proper,they contains lots of mistakes in it and because of that community don't want to give its link for reference. Anyways just remove its link. – Yogesh Suthar Mar 21 '13 at 04:29
Ok now I think there is no reason to downvote for my CORRECT answer – GautamD31 Mar 21 '13 at 04:31

score 1 · Answer 2 · edited May 23 '17 at 12:11

visible $sqlUpdate = "UPDATE user.user SET level='1' WHERE id='".mysql_real_escape_string($_GET['char'])."' AND level >1 LIMIT 1";

your code is vulnerable to sql injection you need to escape all request properly

Warning

your code is vulnerable to sql injection you need to escape all get, post and request and the better approach will be using Prepared statement

Good Read

Note

The entire ext/mysql PHP extension, which provides all functions named with the prefix mysql_, is officially deprecated as of PHP v5.5.0 and will be removed in the future. So use either PDO or MySQLi

Good read

@user1638487 Try to learn prepared statment using `Mysqli` OR `PDO` — Yogesh Suthar, Mar 21 '13 at 04:21

score 0 · Answer 3 · answered Mar 21 '13 at 04:21

0

$sqlCmd = "SELECT user.name,user.level FROM user.user WHERE user.id = '".$_GET['char']."' AND level>1 LIMIT 1";
if(mysql_num_rows($mysql_con)===1){
//run second query
}else{echo'error:'}

answered Mar 21 '13 at 04:21

JJJ

490
4
9

Borik · Answer 4 · 2013-03-21T04:47:43.867

0

I think this should do it...

$result = mysql_query($sqlCmd);
if($row = mysql_fetch_object($result)) {
    if ($row->level > 1)
    {
      mysql_query($sqlUpdate);
      //Might want to add a check here if it was successful... 
      echo "Done";
    }
    else
      echo 'error!!!';

}
mysql_free_result($result);

edited Mar 21 '13 at 04:47

answered Mar 21 '13 at 04:21

Borik

438
3
9

That's what I was looking for , thanks! Now I am trying to add and "correct" msg to the code like "done" , I've tried to add an echo before "mysql_query($sqlUpdate);" , but does not work , any idea? – user1638487 Mar 21 '13 at 04:38
did you add appropriate brasses to code? My **if** statement contains only one line, that why i didn't need them before – Borik Mar 21 '13 at 04:44
I updated the code, let me know if that what you wanted to accomplish. – Borik Mar 21 '13 at 04:52
Nice , thanks again , now i'd like to add another check in the if . I have tried this : if ($row->level > 249 & $row->power!=0) But does not work , can you help me again? – user1638487 Mar 21 '13 at 05:10
Try using **&&** instead of **&** – Borik Mar 21 '13 at 12:40

score 0 · Answer 5 · answered Mar 21 '13 at 04:34

Try this

$sqlCmd = "SELECT user.name,user.level 
FROM user.user 
WHERE user.id = '".$_GET['char']."' 
LIMIT 1";

$resource = mysql_query($sqlCmd);
$temp_arr = mysql_fetch_assoc($resource);
$level    = $temp_arr['level'];
if($level > 1)
{
    $sqlUpdate = "UPDATE user.user 
    SET level='1' 
    WHERE id='".mysql_real_escape_string($_GET['char'])."' 
    LIMIT 1";

    mysql_query($sqlUpdate);
 }

score -1 · Answer 6 · answered Mar 21 '13 at 04:20

-1

    mysql_query("UPDATE user.user SET level='1' WHERE id='".$_GET['char']."' and level>1 LIMIT 1");

answered Mar 21 '13 at 04:20

Suyash

625
1
5
22

If statements with php & Mysql

6 Answers6

Warning

Note