Unable to Display the single-product-details page. It's only loading, not going further

Question

The Error I am getting:

Fatal error: Uncaught mysqli_sql_exception: \
You have an error in your SQL syntax; \
check the manual that corresponds to your MariaDB server version \
for the right syntax to use near '' \
at line 1 in C:\xampp\htdocs\ecom\admin\class\adminback.php:364
Stack trace:
#0 C:\xampp\htdocs\ecom\admin\class\adminback.php(364): mysqli_query(Object(mysqli), 'SELECT * FROM `...')
#1 C:\xampp\htdocs\ecom\single_product.php(15): adminback->display_product_byId('')
#2 {main} thrown in C:\xampp\htdocs\ecom\admin\class\adminback.php on line 364

The code that allows me to create that error:

function display_product_byId($pdtId)
    {
        $query = "SELECT * FROM `product_info_ctg` WHERE pdt_id=$pdtId";
        if (mysqli_query($this->connection, $query)) {
            $pdt_info = mysqli_query($this->connection, $query);
            return $pdt_info;
        }
    }

single-product.php

<?php
session_start();
include_once("admin/class/adminback.php");
$obj = new adminback();

$cata_info = $obj->p_display_catagory();
$cataDatas = array();
while ($data = mysqli_fetch_assoc($cata_info)) {
    $cataDatas[] = $data;
}

if (isset($_GET['status'])) {
    $pdtId = $_GET['id'];
    if ($_GET['status'] == 'singleproduct') {
        $pdt_info = $obj->display_product_byId($pdtId);
        $pdt_fetch = mysqli_fetch_assoc($pdt_info);
        $pro_datas = array();
        $pro_datas[] = $pdt_fetch;
    }
}
$ctg_id = $pdt_fetch['ctg_id'];
$rel_pro = $obj->related_product($ctg_id);

It's only loading.

It should display the details of the desired product.. including the ORDER NOW/BUY NOW buttons

**Warning:** Your code is vulnerable to SQL Injection attacks. You should use parameterised queries and prepared statements to help prevent attackers from compromising your database by using malicious input values. http://bobby-tables.com gives an explanation of the risks, as well as some examples of how to write your queries safely using PHP / mysqli. **Never** insert unparameterised data directly into your SQL. The way your code is written now, someone could easily steal, incorrectly change, or even delete your data. — ADyson, Jul 19 '23 at 13:03
https://phpdelusions.net/mysqli also contains good examples of writing safe SQL using mysqli. See also the [mysqli documentation](https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) and this: [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) . Parameterising your queries will also greatly reduce the risk of accidental syntax errors as a result of un-escaped or incorrectly quoted input values. If you learnt your current technique from a tutorial or book, please don't use that resource again. — ADyson, Jul 19 '23 at 13:03
Have you made a debug output of `$query`? Have you verified `$_GET['id']` contained what you thought it should? — CBroe, Jul 19 '23 at 13:04
See also [How to include a PHP variable inside a MySQL statement](https://stackoverflow.com/questions/7537377/how-to-include-a-php-variable-inside-a-mysql-statement). And yes, there's a good chance this is because of a missing input value, compounded by the incorrect way you've built the SQL — ADyson, Jul 19 '23 at 13:05

score 2 · Answer 1 · edited Jul 19 '23 at 13:27

variable $pdtId is empty when executing the SQL query in the display_product_byId function

function display_product_byId(int $pdtId): ?array
{
    $query = "SELECT * FROM `product_info_ctg` WHERE pdt_id=?";
    $stmt = mysqli_prepare($this->connection, $query);
    mysqli_stmt_bind_param($stmt, "i", $pdtId);
    
    mysqli_stmt_execute($stmt);
    $pdt_info = mysqli_stmt_get_result($stmt);

    return $pdt_info->fetch_assoc();
}

Update the single_product.php code to check if the product ID is set before fetching the product details:

<?php
session_start();
include_once("admin/class/adminback.php");
$obj = new adminback();

$cata_info = $obj->p_display_catagory();
$cataDatas = array();
while ($data = mysqli_fetch_assoc($cata_info)) {
    $cataDatas[] = $data;
}

$pro_datas = null;
if (isset($_GET['status'], $_GET['id']) && 'singleproduct' === $_GET['status']) {
    $pro_datas = $obj->display_product_byId((int)$_GET['id']);
}
if (!$pro_datas) {
   // product not found
   http_response_code(404);
   exit;
}

$ctg_id = $pdt_fetch['ctg_id'];
$rel_pro = $obj->related_product($ctg_id);

FYI, a web application should never redirect on error. Instead, it should return appropriate HTTP status code — Your Common Sense, Jul 19 '23 at 13:21

Unable to Display the single-product-details page. It's only loading, not going further

1 Answers1