Field Is Not Being Echoed Into Textfield

Question

I am using the same working code used on one of my other websites and for some weird odd reason it is not echoing the 'title' field from my database. this is my code:

  <?php
$id = $_GET['meeting_id'];

$query = mysql_query("SELECT * FROM Meetings WHERE meeting_id = '$id'")
or die(mysql_error());  

while($info = mysql_fetch_array($query)) {
echo "";

$title = $info['title'];

}
?>

<form action="bookedsuccessfully.php" method="post">

<table width="100%" border="0">
  <tr>
    <td><label>Meeting Title:</label></td>
    <td><input type="text" value="<?php echo $title;?>" name="title" disabled/></td>
  </tr>
...

i want the title to be displayed but the field to be disabled from any edits. any help?

You code is prone to SQL injection http://stackoverflow.com/questions/601300/what-is-sql-injection — konsolenfreddy, Jan 03 '12 at 20:52
what HTML source does running this produce? Also is $title being set? And, for god's sake, check for $id for sql injection. — ben, Jan 03 '12 at 20:53
can you do a print_r($info) within the while loop to see if anything is returned from the DB? — konsolenfreddy, Jan 03 '12 at 20:59
what does a print_r($info) do and where shall i insert this line of code? — user1114080, Jan 03 '12 at 21:02
print_r($var) prints the keys & values of an array. @konsolenfreddy means for you to print the contents of $info inside the while loop between the `echo "";` and the `$title = $info['title'];` for example. Also, are you sure the query came up with results? id you `echo $id`? — Yaniro, Jan 03 '12 at 21:49

score 0 · Answer 1 · answered Jan 03 '12 at 21:07

Dunno what is your problem but

the field to be disabled from any edits.

is because of disabled attribute, I believe.

while the code itself should work

with little refactoring and removing unnecessary code, it is going to be

<?php
error_reporting(E_ALL);
$query  = "SELECT * FROM Meetings WHERE meeting_id = ".intval($_GET['meeting_id'];
$result = mysql_query($query) or trigger_error(mysql_error()." ".$query);  
$info   = mysql_fetch_array($result));
$title  = htmlspecialchars($info['title']);
?>
<form action="bookedsuccessfully.php" method="post">
<table width="100%" border="0">
  <tr>
    <td><label>Meeting Title:</label></td>
    <td><input type="text" value="<?php echo $title ?>" name="title" /></td>
  </tr>

score 0 · Answer 2 · answered Jan 03 '12 at 21:07

If you don't want to edit the field, don't render it as a form element. instead of : <input type="text" value="<?php echo $title;?>" name="title" disabled/> use : <p> <?php echo $title;?> <p/> Regarding your db problem, try to echo the meeting id and check to see if it is in the db. As others posted you are completely exposed to SQL injections,if someone only knew your domain he could have complete control on your database.

Field Is Not Being Echoed Into Textfield

2 Answers2