Mysql Problem!

I am trying to do a page that show an adoptables stats.
adoptable.php :

<title>Adopt Monster - Adoptable</title>
<?php
session_start();
require_once("connect.php");
$row = mysql_query("SELECT * FROM adoptables WHERE owner='".$_GET[id]."' ");
echo 'Adoptable : ';
echo $row[name];
echo '</br>';
echo $row[image];
?>
<img src="/adoptables/img/<?php echo $row[image];?>" alt="<?php echo $row[name];?>"></br>
<?php
echo 'Adoptable belongs to : </br>';
?>
<a href="/useradopts.php?username=<?php echo $row[owner]; ?>"><?php echo $row[owner]; ?></a></br>
<a href="/index.php">Home</a>



if i go to adoptable.php?id=1 it does not show anything except the text.

Sam

Screenshot your database please.

Ash's to ash's, dust to dust.

I see your problem. You forgot mysql_fetch_array. It should be:

$row=mysql_fetch_array(mysql_query("SELECT * FROM adoptables WHERE owner='variable here'"));

...

/closed

Ash's to ash's, dust to dust.

ok thanks!

Sam

With $_GET['id'] use mysql_real_escape_string($_GET['id']) To prevent hacking

but how does the mysql real escape string thingy work?

Sam

It makes it like this... Lets say you have something being inputted like


It's a me!

This wouldn't work it would give a error because of the '... What that function does is makes it this


It's a me!

This will pervent hacking because the insert script would be like ...''DELETE TABLE members'' ANd boom your site is done...

Do not use mysql_real_escape_string() It's a deprecated function and provides you with essentially no protection if someone actually wants to hack you.

Search up a tutorial on MySQLi or (preferably) PDO. Query parameterization and prepared statements are the way to go.

It's my job to help the next generation, and set a good example for them. And for that I'll gladly lay down my life.

Shouldn't session_start() go before all code? You have the title tag before session_start().

Hate is such a weak emotion

The distinguished LinkZelda spake:

Shouldn't session_start() go before all code? You have the title tag before session_start().

Correct LinkZelda Session_start(); does come first at the top.


Here complete example of the finally version of the script


<title>Adopt Monster - Adoptable</title>
<?php
session_start();
require_once("connect.php");
$GetAdop = mysql_query("SELECT * FROM adoptables WHERE owner='".$_GET[id]."' ");
$row = mysql_fetch_array($GetAdop);
echo 'Adoptable : ';
echo $row[name];
echo '</br>';
echo $row[image];
?>
<img src="/adoptables/img/<?php echo $row[image];?>" alt="<?php echo $row[name];?>"></br>
<?php
echo 'Adoptable belongs to : </br>';
?>
<a href="/useradopts.php?username=<?php echo $row[owner]; ?>"><?php echo $row[owner]; ?></a></br>
<a href="/index.php">Home</a>




This should answer you question, Plus Skittle gave you some tips on how to protect your script.

A true developer