Pages and gallery Problems

Question

Php / mysql gallery issues

I have made a gallery in php. It receives from an index page an "inname" parameter. The gallery every time it passes from page does not manage to send 2 parameters at the same time and in all inombre. Unparameter of the database "idtext" Please tell me the mistakes

enter code here

index.php

Lista de Acontecimientos<Br />  
<?php 
$conexion = mysqli_connect("localhost", "root", "") or trigger_error(mysql_error(),E_USER_ERROR);
mysqli_select_db($conexion,"db674013292"); 
$consulta="Select * from textos where clase=1 ";
$result=mysqli_query($conexion,$consulta); 
?>
<?php  
while($fila=mysqli_fetch_row($result)){
    echo "<a href=\"H.php?inombre='".$fila['0']."'\">".$fila['1']."</a><br>";    }  
?>

Gallery.php

$inombre=$_GET['inombre'];

    $objConnect =  mysql_connect("localhost","root","") or die(mysql_error());
    $objDB =  mysql_select_db("db674013292");

    $strSQL = "SELECT * FROM galeriadecidiendo where idtexto =$inombre ";

    $objQuery = mysql_query($strSQL);
        $Num_Rows = mysql_num_rows($objQuery);

        $Per_Page = 8;   // Per Page

        @$Page = $_GET["Page"];
        if(!@$_GET["Page"])
        {
            $Page=1;
        }

        $Prev_Page = $Page-1;
        $Next_Page = $Page+1;

        $Page_Start = (($Per_Page*$Page)-$Per_Page);
        if($Num_Rows<=$Per_Page)
        {
            $Num_Pages =1;
        }
        else if(($Num_Rows % $Per_Page)==0)
        {
            $Num_Pages =($Num_Rows/$Per_Page) ;
        }

        else
        {
            $Num_Pages =($Num_Rows/$Per_Page)+1;
            $Num_Pages = (int)$Num_Pages;
        }

        $strSQL .=" order  by idgaleriatexto ASC LIMIT $Page_Start , $Per_Page";
        $objQuery  = mysql_query($strSQL);


        echo"<table border=\"0\" align=\"center\" cellspacing=\"0\" cellpadding=\"0\"><tr>";
        $intRows = 0;
        while($objResult = mysql_fetch_array($objQuery))
        {
            echo "<td>"; 
            $intRows++;
    ?>
<img with="150" height="150" src="<?=$objResult["url"]; ?>"><br>                 
    <?PHP
            echo"</td>";
            if(($intRows)%4==0)
            {
                echo"</tr>";
            }
        }
        echo"</tr></table>";
    ?>
        <br>
    <span class="paguinas">Total <?= $Num_Rows;?> Record : <?=$Num_Pages;?> Page :</span>


                <?PHP
        if($Prev_Page)
        {
            echo " <a href='$_SERVER[SCRIPT_NAME]?Page=$Prev_Page&$inombre=idtexto'><< Back</a> ";
        }

        for($i=1; $i<=$Num_Pages; $i++){
            if($i != $Page)
            {
                echo "[ <a href='$_SERVER[SCRIPT_NAME]?Page=$Prev_Page&$inombre=idtexto'>$i</a> ]";
            }
            else
            {
                echo "<b> $i </b>";
            }
        }
        if($Page!=$Num_Pages)
        {
            echo " <a href ='$_SERVER[SCRIPT_NAME]?Page=$Next_Page$Prev_Page&$inombre=idtexto'>Next>></a> ";
        }`enter code here`
        ?>


    <?PHP
mysql_close($objConnect);
?> 




</body>
</html>

Your code is vulnerable to [**SQL injection**](https://en.wikipedia.org/wiki/SQL_injection) attacks. You should use [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) prepared statements with bound parameters as described in [**this post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). — Alex Howansky, Jun 09 '17 at 20:11
Don't use the `mysql_*` functions. They have been deprecated since v5.5 (Jun 2013) and removed since v7.0 (Dec 2015). Instead use the [**mysqli_***](https://secure.php.net/manual/en/book.mysqli.php) or [**PDO**](https://secure.php.net/manual/en/book.pdo.php) functions with [**prepared statements**](https://secure.php.net/manual/en/pdo.prepare.php) and [**bound parameters**](https://secure.php.net/manual/en/pdostatement.bindparam.php). — Alex Howansky, Jun 09 '17 at 20:11

score 0 · Answer 1 · answered Jun 10 '17 at 08:11

Thanks for the comment.

I have already changed the code to mysqli but the problem persists since I wrongly send the parameter inname every time that page step please as I send it

<html><head></head><body>
<?php

$inombre=$_GET['inombre'];
$objConnect =  mysqli_connect("localhost","root","") or die(mysql_error());
$objDB =  mysqli_select_db($objConnect,"db674013292");      
$strSQL = "SELECT * FROM galeriadecidiendo where idtexto =$inombre ";
$objQuery = mysqli_query($objConnect,$strSQL);
$Num_Rows = mysqli_num_rows($objQuery);

$Per_Page = 8;   
?>
        @$Page = $_GET["Page"];
        if(!@$_GET["Page"])
        {
            $Page=1;
        }

        $Prev_Page = $Page-1;
        $Next_Page = $Page+1;

$Page_Start = (($Per_Page*$Page)-$Per_Page);
if($Num_Rows<=$Per_Page)
        {$Num_Pages =1;}
        else if(($Num_Rows % $Per_Page)==0)
        {
            $Num_Pages =($Num_Rows/$Per_Page) ;
        }
        else
        {
            $Num_Pages =($Num_Rows/$Per_Page)+1;
            $Num_Pages = (int)$Num_Pages;
        }


        $strSQL .=" order  by idgaleriatexto ASC LIMIT $Page_Start , $Per_Page";
        $objQuery  = mysqli_query($objConnect,$strSQL);


        echo"<table border=\"0\" align=\"center\" cellspacing=\"0\" cellpadding=\"0\"><tr>";
        $intRows = 0;
        while($objResult = mysqli_fetch_array($objQuery))
        {
            echo "<td>"; 
            $intRows++;

    <img with="150" height="150" src="<?=$objResult["url"]; ?>"><br>                 

                echo"</td>";
                if(($intRows)%4==0)
                {
                    echo"</tr>";
                }
            }
            echo"</tr></table>";


        <span class="paguinas">Total <?= $Num_Rows;?> Record : <?=$Num_Pages;?> Page :</span>



            if($Prev_Page)
            {
                echo " <a href='$_SERVER[SCRIPT_NAME]?Page=$Prev_Page&$inombre=idtexto'><< Back</a> ";
            }

            for($i=1; $i<=$Num_Pages; $i++){
                if($i != $Page)
                {
                    echo "[ <a href='$_SERVER[SCRIPT_NAME]?Page=$Prev_Page&$inombre=idtexto'>$i</a> ]";
                }
                else
                {
                    echo "<b> $i </b>";
                }
            }
            if($Page!=$Num_Pages)
            {
    echo " <a href ='$_SERVER[SCRIPT_NAME] Page=$Next_Page$Prev_Page&$inombre=idtexto'>Next>></a> ";
            }
    mysqli_close($objConnect);

Pages and gallery Problems

1 Answers1