Recovering MySQL items with specific ID

Question

I currently have a database where items are stored with a specefic ID (EventCode). When I try to display them on my website with their unique ID, it's all messed up. Some items are ok, and show A, B, C and D correctly. Some others items show the same A, B, C and D of others events. When I look at the EventCode for each item, it's a different code... so regarding to the code below, what is my problem? Why does some item show perfecly what they are supposed the show, and others show the same as items alredy created?

<?php
include('base.php');
?>

<?php
if(isset($_GET['EventCode']))
{
     $EventCode = intval($_GET['EventCode']);
     $dn = mysql_query("select A, B, C, D from users_event where EventCode=$EventCode ");
     if(mysql_num_rows($dn)>0)
     {
             $dnn = mysql_fetch_array($dn);
     ?>
 This is the profile of "<?php echo htmlentities($dnn['A']); ?>" :
 <table style="width:500px;">
     <tr>
     <td><?php
 if($dnn['B']!='')
{
     echo '<img src="'.htmlentities($dnn['B']).'" alt="B" style="max-width:100px;max-height:100px;" />';
}
else
{
     echo 'B is not existing.';
}
?>
</td>
     <td class="left"><h1><?php echo htmlentities($dnn['C']); ?></h1>
     Field: <?php echo htmlentities($dnn['D']); ?><br />
      </tr>
 </table>
<?php
     }
     else
     {
             echo 'Sorry, no record found.';
     }
}
else
{
     echo 'No item found';
}
?>
                      </body>
</html>

Stay away from mysql_* ._. http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php — Ben Fortune, Aug 02 '13 at 19:30
http://yoursite.com?EventCode=1;CREATE%20TABLE%0sql_injection(yes%20INT);-- — Sammitch, Aug 02 '13 at 19:35
@sammit: won't work. the `(intval)` will force the value to be just an int. but yes, otherwise there'd be an injection vulnerability. — Marc B, Aug 02 '13 at 19:36
NOthing in this could would rearrange the values like that. Are you sure they're in the DB in the right order? e.g. try running the various queries manually and see what you get for different records. — Marc B, Aug 02 '13 at 19:36

score 0 · Accepted Answer · answered Aug 02 '13 at 20:02

0

If $EventCode is not unique, you'll only get the 'first' record only, because you're not iterating over your resultset.

If you want to list all the records: - Do a while ($dnn = mysql_fetch_array($dn)) { /*...*/ }

If you only want one record: - Use a UNIQUE key or combination. Alternatively you can ORDER and LIMIT your query.

answered Aug 02 '13 at 20:02

Robert de W

316
8
24

The event code is unique. I actually have the list of all the records. The problem is when I click on a specific record, it sometimes show the same elements of an other record. – freddy Aug 02 '13 at 20:14

Recovering MySQL items with specific ID

1 Answers1