Yeah I have to agree, this won't work right..
Quote:
Code:
$result = mysql_query("SELECT * FROM $table WHERE ID",$db);
|
I think "this works" is because it is still a valid mysql query.
You need to understand some things about first) sql, then second) php, as the process should go like this:
1) Process posted/url variables with a security check. As in you're expecting a record id which should be a number. So if $_GET['id'] is valid then do a mysql query to get that row.
2) If query returned a row, then display results, otherwise display some kind of error like "No results found". This can be done with:
Code:
if (!$result) {
print('No Results Found.');
}
3) Also, there are libraries that help with this sort of thing... as in I can construct a sql query and send variables to it without worrying about sql injection, etc... I use pear db. A sample of this is...
Code:
// From url: http://mysite.com/user/?userid=1234
$sql = "SELECT id FROM users WHERE username = ?";
$res = $db->getRow($sql, array($_GET['userid']), DB_FETCHMODE_ASSOC);
// Now $res['username'] = 'username'
4) There are other kinds of php mysql database abstractions you can use as well.., but this one I find easy to use once I have learned it.
Hope that helps!
|