0

Hello I have the following url 

http://www.test.nl/test.php?itemnr=123

In my database in table items2 my columns are: 

itemnr | itemId | Description | etc

Because I want to show the itemnr AND the itemId on this page I have this query: 

<?php
$itemnummer = intval($_GET['itemnr']);
$itemIDnummer = "SELECT DISTINCT itemId from items2 where itemnr = '" .$itemnummer. "'";
$resultaat = mysql_query($itemIDnummer) or die(mysql_error());

echo "$resultaat"; 
?>

Can anyone see my fault?

wallyk
  • 56,922
  • 16
  • 83
  • 148
Bas Schreuder
  • 172
  • 1
  • 13
  • 4
    What fault? What strange results? Do you get an error? A blank screen? You're currently trying to print out the result set directly; you'll need to iterate through it with something like `mysql_fetch_array` to get at the data. You're also wide open to SQL injection; if you're just learning now, you should look at using PDO instead of the deprecated `mysql_` library – andrewsi Jul 25 '14 at 15:15
  • 2
    this code is [gravely vulnerable to sql injections](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php), consider using mysqli or pdo instead of mysql. – Hristo Valkanov Jul 25 '14 at 15:15
  • 1
    Also, `$resultaat` isn't a string, so this will throw an error even when the query is successful. Likely 'array to string conversion' error. – naththedeveloper Jul 25 '14 at 15:16
  • Ok guys thanks for the help so far. so instead of mysql_query() is should use mysqli_query ? I am working on a very old website so I take bits and pieces and try to get the result I need. so $resultaat is not a string, but a number indeed, so how would i write this down ? --> BTW strange result is: RecordID #5. This shows with every different itemnr. – Bas Schreuder Jul 25 '14 at 15:19
  • @BasSchreuder - to fix this immediate issue, have a look at the code samples here: http://php.net/manual/en/function.mysql-fetch-array.php – andrewsi Jul 25 '14 at 15:26
  • @BasSchreuder - but I'd suggest you look at http://ca1.php.net/manual/en/book.pdo.php and switch to using PDO instead - it will help you write code that's more secure. – andrewsi Jul 25 '14 at 15:27
  • @andrewsi I was JUST looking there :D. Because I am a beginner. I have trouble implementing it in my code so it works. Could you be so kind as to insert this into my code so i can see how i should be doing this ? – Bas Schreuder Jul 25 '14 at 15:28
  • 1
    @BasSchreuder - you'll need something like `while ($row = mysql_fetch_array($resultaat)) { echo $row['itemId']; }` – andrewsi Jul 25 '14 at 15:30
  • @andrewsi - > also I will look at PDO asap. But i think I should learn the basics of php and then look at PDO, not ? – Bas Schreuder Jul 25 '14 at 15:31
  • 2
    @BasSchreuder - I agree. But if you're learning PHP now, you can skip right past using the `mysql_` functions and learn PDO. – andrewsi Jul 25 '14 at 15:32
  • No I have this: i get no error, but i dont get any return, blank page – Bas Schreuder Jul 25 '14 at 15:38
  • @HristoValkanov Actually, this code is perfectly safe from SQL injections because the call to [`intval`](http://php.net/manual/en/function.intval.php) means that only numbers can get through. (Of course, that's assuming there's no bug in `intval`, but you have to trust *any* protection method that you use.) – Moshe Katz Jul 25 '14 at 15:42
  • I have edited the question's title because it was incredibly obtuse before. It still needs work to include the essence of the problem. – wallyk Jul 25 '14 at 15:44
  • GUYS! thanks! The code from DanceSC works! It was my mistake in formulating my initial question. you all presumed that the itemnr was always a number, but sometimes it contains a letter. I changed intval to strval en it works! happy! – Bas Schreuder Jul 25 '14 at 15:51

1 Answers1

1

Add so that your code looks like this 

<?php
$itemnummer = intval($_GET['itemnr']);
$itemIDnummer = "SELECT DISTINCT itemId from items2 where itemnr = '" .$itemnummer. "'";
$resultaat = mysql_query($itemIDnummer) or die(mysql_error());
$fetchaat = mysql_fetch_assoc($resultaat);

echo $fetchaat["itemId"]; 
?>

Updated Question:

Because I want to show the itemnr AND the itemId on this page I have this query: 

<?php
$itemnummer = intval($_GET['itemnr']);
$itemIDnummer = "SELECT DISTINCT itemId, itemnr from items2 where itemnr = '" .$itemnummer. "'";
$resultaat = mysql_query($itemIDnummer) or die(mysql_error());
$fetchaat = mysql_fetch_assoc($resultaat);

echo $fetchaat["itemId"]; 
echo $fetchaat["itemnr"];
?>
DanceSC
  • 521
  • 1
  • 4
  • 14
  • Just as the comment to the OP, your code is vulnerable to SQL injection attacs – Barranka Jul 25 '14 at 15:41
  • 1
    As the OP asked "Can anyone see my fault" I noticed that he was trying to echo the array. The echo suggested his intentions, if he felt his sql statment was vulenrable to injections then he would have asked for that. – DanceSC Jul 25 '14 at 15:42
  • @Barranka No, it isn't. See my comment on the question. – Moshe Katz Jul 25 '14 at 15:43
  • @DanceSC - does not show errors, but it shows a blank 'page'. No result is printed. – Bas Schreuder Jul 25 '14 at 15:44
  • maybe, just maybe, because I use intval it only lets trough number and this particular itemnr I am testing on contains characters. Replace intval with ...? – Bas Schreuder Jul 25 '14 at 15:47
  • I personally use `htmlentities($_GET['itemnr'],ENT_QUOTES)` over intval – DanceSC Jul 25 '14 at 15:48