0

When i enter a user id that is in the database, i want it to echo/print all the data from that one users file. So if i enter "user_id = 2", i want the users "name", "age" etc etc. I got to where that it gives me everything without the parameters. The code:

$link = mysqli_connect("localhost", "root", "");
mysqli_select_db($link, "magicsever");

if(mysqli_connect_error()){
    die ("Database connection error");
}

$query = "SELECT * FROM classified_videos";
$result = mysqli_query($link, $query);
while($row = mysqli_fetch_array($result)){      
    print_r ($row);
}

But i want from a specific user and this is what i think is the code 

if(isset($_POST['submit'])){

    $link = mysqli_connect("localhost", "root", "");
    mysqli_select_db($link, "magicsever");

    if(mysqli_connect_error()){     
        die ("Database connection error");
    }   

    $query = "SELECT * FROM classified_videos WHERE user_id ='".mysqli_real_escape_string($link, $_POST['userid'])."' LIMIT 1";
    $result = mysqli_query($link, $query);
    while($row = mysqli_fetch_array($result)){      
        print_r ($row['vid_category_1']);
    }
}
?>

<form method="post">
    <input type="text" name="userid" placeholder="user id...">
    <input type="submit" value="submit">
</form>
CodeGodie
  • 12,116
  • 6
  • 37
  • 66
Jagr
  • 484
  • 2
  • 11
  • 31
  • 1
    [Little Bobby](http://bobby-tables.com/) says [your script is at risk for SQL Injection Attacks](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). Learn about [prepared statements](http://en.wikipedia.org/wiki/Prepared_statement) for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe. – junkfoodjunkie Jun 07 '17 at 01:53
  • Yes i know this is just a test, but thank you i will look into it more – Jagr Jun 07 '17 at 01:59
  • ohhh i see thank you, is there any like other tips or videos that i might find useful in sql injection prevention ? – Jagr Jun 07 '17 at 02:04
  • @junkfoodjunkie, you dont use $link? are you sure? – CodeGodie Jun 07 '17 at 02:05
  • @CodeGodie i was thinking the same because, the video i watched always used $link. – Jagr Jun 07 '17 at 02:06
  • Ah, sorry - I realise now that mysqli_ is, as always, increadibly stupid, and actually use the connection when using the escape-string function. My bad, and the reason I'm using proper prepared statements. – junkfoodjunkie Jun 07 '17 at 02:07
  • @Jagr you need $link, its in the docs. – CodeGodie Jun 07 '17 at 02:07
  • Thanks @CodeGodie – Jagr Jun 07 '17 at 02:08
  • Using http://php.net/manual/en/function.error-reporting.php would have thrown you an undefined index about it, set to catch and display. – Funk Forty Niner Jun 07 '17 at 02:26

1 Answers1

1

This if(isset($_POST['submit'])) expects that an input with name submit is submitted, but youre currently sending only userid

add this name="submit" to your button:

<input type="submit" value="submit" name="submit">
CodeGodie
  • 12,116
  • 6
  • 37
  • 66