Using parameters in a GET request

Question

I know this sound simple but this has been troubling me for a while, i have a simple get request and it just doesnt work when i try to use parameters, if i just use a full query it works, but if i try to use parameters it just wont

this is my code

<?php
include('function.php');
$dni=$_GET["DNI"];


if($resultset=getSQLResultSet("SELECT * FROM `table` WHERE DNI='$dni'")){
    while ($row = $resultset->fetch_array(MYSQLI_NUM)){
        echo json_encode(var_dump( $row));
    }
}

?>

now, no matter what value dni has it just doesnt work i just get an empty json

array(5) { [0]=> string(0) "" [1]=> string(0) "" [2]=> string(0) "" [3]=> string(0) "" [4]=> string(0) "" } null

like so

but if i just change that query to

SELECT * FROM table WHERE DNI= 1111

it returns what it has to return for that dni

the parameter is the problem, but i dont know whats wrong about it

How do you access this page??? Also you must do this https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — AbraCadaver, Feb 14 '19 at 21:03
its just a file, so i just do http://mysite.co/api-route/file.php?dni=xxxx — leonidas56, Feb 14 '19 at 21:10
@leonidas56 `DNI` and `dni` are NOT the same thing. Use the right case in your URL. — ceejayoz, Feb 14 '19 at 21:11
Your code is horrifically insecure and opens up your database to anyone at all with a slight knowledge of application security. Please make sure you switch to parametrized queries before you make this script publicly accessible anywhere. — Morgan, Feb 14 '19 at 21:18

score -3 · Accepted Answer · answered Feb 14 '19 at 21:15

-3

Solved, i was asking for "dni" when i should've been asking for "DNI"

answered Feb 14 '19 at 21:15

leonidas56

755
1
6
15

Using parameters in a GET request

1 Answers1