2

I need to do a "SELECT inside SELECT" using PDO method, because I need data from the 1st 

SELECT (`$result('nom')`)

for the 2nd one.

I'm getting no php error but the page redirects to "404 File Not Found", SQL syntax seems correct. What am I getting wrong?

Here's my code:

<?php

include("../access.php");
session_start();
$date = "tableau_suivi_".date("d-m-Y").".csv";
$table_echo = array();

header('Content-type: text/csv');
header('Content-Disposition: attachment; filename='.$date.'');

header('Pragma: no-cache');
header('Expires: 0');

$csv_file = fopen('php://output', 'w');

fputs($df, "\xEF\xBB\xBF" );
fwrite($csv_file, "Nom ; Prenom ; RSCA 1 ; RSCA 2 ; RSCA 3\n");

$sql='SELECT * FROM membre WHERE prof = 0';
$nb = $bdd->query($sql);

while($result = $nb->fetch()){

  $sql1='SELECT nom_eval FROM rsca_valides WHERE nom_etu = "'.$result('nom').'" AND numero = 1';
  $nb1 = $bdd->query($sql1);
  if($res1 = $nb1->fetch()){
    $eval1 = $res1('nom_eval');
  }

  $sql2='SELECT nom_eval FROM rsca_valides WHERE nom_etu = "'.$result('nom').'" AND numero = 2';
  $nb2 = $bdd->query($sql2);
  if($res2 = $nb2->fetch()){
    $eval2 = $res2('nom_eval');
  }

  $sql3='SELECT nom_eval FROM rsca_valides WHERE nom_etu = "'.$result('nom').'" AND numero = 3';
  $nb3 = $bdd->query($sql3);
  if($res3 = $nb3->fetch()){
    $eval3 = $res3('nom_eval');
  }

  $line = $result['nom'].";".$result['prenom'].";".$eval1.";".$eval2.";".$eval3."\n";
  fwrite($csv_file, $line);
}


fclose($csv_file);

?>

It runs fine without $sql1, $sql2 and $sql3. My goal is to generate a CSV file containing nom, prenom, $res1('nom_eval'), $res2('nom_eval') and $res3('nom_eval') on each line.

Funk Forty Niner
  • 74,450
  • 15
  • 68
  • 141
  • 1
    SQL syntax issues != 404 problem. You're not showing us the code causing the problem. – Jay Blanchard May 16 '17 at 12:07
  • [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard May 16 '17 at 12:08
  • @JayBlanchard cool man, now do you have a real answer? –  May 16 '17 at 12:12
  • `$result('nom')` is populated from where exactly? check for the real error. – Funk Forty Niner May 16 '17 at 12:13
  • No man - because you didn't include the part of the code which causes the 404 error. – Jay Blanchard May 16 '17 at 12:15
  • @Fred-ii- `$result('nom')` is a column in `membre` table, and there are values in the database. –  May 16 '17 at 12:15
  • oh... cool man!! – Funk Forty Niner May 16 '17 at 12:15
  • @JayBlanchard updated the post, it doesn't get error 404 without the 3 subqueries –  May 16 '17 at 12:16
  • Can you show us what `$csv_file` is? And can you tell us which page shows the 404 error? – Jay Blanchard May 16 '17 at 12:16
  • `$csv_file` is a file pointer connected to the output stream, and again, everything works fine without the 3 sub-SELECT. –  May 16 '17 at 12:19
  • `$eval1 = $res1('nom_eval');` is neither an array or object item. Should be either `$eval1 = $res1['nom_eval'];` or `$eval1 = $res1->nom_eval;` this goes for all query results. – Jay Blanchard May 16 '17 at 12:26
  • [I'm with @JayBlanchard here](http://stackoverflow.com/questions/44000903/sql-pdo-select-another-table-inside-while-loop-of-the-first-select?noredirect=1#comment75030876_44000903). We also don't know which api you're using to connect with, so we can't give you the right error checking method on the query. I'm out. Good luck. – Funk Forty Niner May 16 '17 at 12:28
  • Updated full code. @Fred-ii- by the way thank you for the downvote, you are so useful! –  May 16 '17 at 12:29
  • What page does the code try to go to where the 404 is thrown? – Jay Blanchard May 16 '17 at 12:30
  • 1
    *"by the way thank you for the downvote"* - you shouldn't always think that the people who are present in the question downvoted you. Including the ones trying to help you. So again; check for the real errors. Wishing you well with your project :-) @hopesfall – Funk Forty Niner May 16 '17 at 12:32
  • 404 is thrown when calling the page itself, but when removing the subqueries this code make the user download a csv file –  May 16 '17 at 12:32
  • Correct the queries as I have pointed out. Since the queries are wrong the CSV file never gets written and therefore throws the 404. – Jay Blanchard May 16 '17 at 12:32
  • Damn @JayBlanchard, it was just because of these brackets... Thank you so much, been pulling my hair for several hours... Should I delete the question now? –  May 16 '17 at 12:40
  • 1
    Toé tu connais ça mon chum @JayBlanchard – Funk Forty Niner May 16 '17 at 12:45
  • @Fred-ii- en fait t'es un putain de francais toi aussi mdr ^^ –  May 16 '17 at 12:48
  • @hopesfall bin ch'comprend bin! ;-) *salute!* si, io parlo una altra lingua anche! e tu? – Funk Forty Niner May 16 '17 at 12:49
  • 1
    @JayBlanchard so please add your answer, I'd be glad to upvote it and to mark it as best answer. Thank you, again. –  May 16 '17 at 12:50
  • 1
    @hopesfall since you appear to be using PDO, using http://php.net/manual/en/pdo.error-handling.php if you're not already, would have helped you, as would PHP's error reporting http://php.net/manual/en/function.error-reporting.php :-) – Funk Forty Niner May 16 '17 at 12:55
  • @hopesfall *Hmm..* - capito un poquito ;-) ma non parlo abbastanza – Funk Forty Niner May 16 '17 at 12:56
  • @DragandDrop you're a bit late *lol!* - May 16th? that was like 2-3 weeks ago *haha!!* – Funk Forty Niner Jun 06 '17 at 13:36

1 Answers1

1

$eval1 = $res1('nom_eval'); is neither an array or object item. It should be either $eval1 = $res1['nom_eval']; or $eval1 = $res1->nom_eval; depending on your fetch method.

This goes for all query results. For example:

 $sql1='SELECT nom_eval FROM rsca_valides WHERE nom_etu = "'.$result['nom'].'" AND numero = 1';
Jay Blanchard
  • 34,243
  • 16
  • 77
  • 119