Hi

 

A little problem..

 

I have my list of users from db displaying....

 

<?php 

error_reporting (E_ALL);

$page_title = 'gallerytest.php'; 
	require_once ('../../mysql_connect.php'); // Connect to the db. 



	   /// selected everything from db 
  $query = "SELECT name FROM users ORDER BY date_entered DESC";
  $result = @mysql_query ($query) or die (mysql_error()); 
  $num = mysql_num_rows($result); 

  if ($num > 0) { // If num	 

  while ($myrow = mysql_fetch_assoc($result)) { //While


  echo'<a href="gallerypage_insert.php?name=' . $myrow['name'] . '">'. $myrow['name'] .'</a>'; 


  } //End of if num
 } //End of while


else { /// if db not run display error 
echo '<table align="center" cellspacing="0" cellpadding="5">';
echo'<td><span class = "style1">Sorry, no records found!</span></td>';
echo '</table>'; 
} 

?>

 

So when clicked It takes me to this page (gallerypage_insert.php):

 

<?php

error_reporting (E_ALL);

$page_title = 'gallerypageinsert.php';

//view details




require_once ('../../mysql_connect.php'); // Connect to the db.


$name = mysql_real_escape_string($_GET['name']);



if($name){ 

  $query = "SELECT * FROM gallery WHERE users='$name'"; 
  $result = @mysql_query ($query); // Run the query. 
  $num = mysql_num_rows($result); 
  $myrow = mysql_fetch_array($result, MYSQL_ASSOC); 


  echo '<h3>gallery</h3> ';
  // display 

  echo '<p class="indent"><strong>' .$myrow['user'] .'</strong></p>'; 



  	  echo '<br />  ';
} //End if name
else { 

echo'Sorry, no records found!';

} 


mysql_close(); // Close the database connection.


?>

 

This when clicked produces ..http:// etc etc......gallerypage_insert.php?name=john in the address bar? but does not display the record or error message?

 

 

Hope this makes sense.

 

Thanks Ben

<?php

error_reporting (E_ALL);

$page_title = 'gallerypageinsert.php';

require_once ('../../mysql_connect.php'); // Connect to the db.

$name = mysql_real_escape_string($_GET['name']);


$query = "SELECT * FROM gallery WHERE user=$name"; 
$result = mysql_query ($query) or die("Query error: ". mysql_error()); // Run the query. 
$myrow = mysql_fetch_array($result, MYSQL_ASSOC); 


if($name){ 

  echo '<h3>gallery</h3> ';
  // display 

  echo '<p class="indent"><strong>' .$myrow['user'] .'</strong></p>'; 



  	  echo '<br />  ';
} //End if name
else { 

echo'Sorry, no records found!';

} 


mysql_close(); // Close the database connection.


?>

 

Have this in my address bar now..

 

gallerypage_insert.php?name=john%20smith

 

With this error message:

 

Query error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'smith' at line 1

 

 

???

you need to escape your query string.

 

Change:

SELECT * FROM gallery WHERE user=$name

to

SELECT * FROM `gallery` WHERE `user`='$name'

 

the backticks ( ` ) aren't needed for this example, but it pays to use them, incase you inadvertently use a MySQL keyword as a table/column name.

oh I see!

 

For some reason its still not working, just displaying no records found?

 

<?php

error_reporting (E_ALL);

$page_title = 'gallerypageinsert.php';

require_once ('../../mysql_connect.php'); // Connect to the db.

$name = mysql_real_escape_string($_GET['name']);


$query = "SELECT * FROM `gallery` WHERE `user`='$name'"; 
$result = mysql_query ($query) or die("Query error: ". mysql_error()); // Run the query. 
$myrow = mysql_fetch_array($result, MYSQL_ASSOC); 
$num = mysql_num_rows($result); 

if($num > 0){ 

  echo '<h3>gallery</h3> ';
  // display 

  echo '<p class="indent"><strong>' .$myrow['user_id'] .'</strong></p>'; 



  	  echo '<br />  ';
} //End if name
else { 

echo'Sorry, no records found!';

} 


mysql_close(); // Close the database connection.


?>

 

 

Page supplying the 'name'

 

 

<?php 

error_reporting (E_ALL);

$page_title = 'gallerytest.php'; 
	require_once ('../../mysql_connect.php'); // Connect to the db. 



	   /// selected everything from db 
  $query = "SELECT name FROM user ORDER BY date_entered DESC";
  $result = @mysql_query ($query) or die (mysql_error()); 
  $num = mysql_num_rows($result); 

  if ($num > 0) { // If num	 

  while ($myrow = mysql_fetch_assoc($result)) { //While


  echo'<a href="gallerypage_insert.php?name=' . $myrow['name'] . '">'. $myrow['name'] .'</a>'; 


  } //End of if num
 } //End of while


else { /// if db not run display error 
echo '<table align="center" cellspacing="0" cellpadding="5">';
echo'<td><span class = "style1">Sorry, no records found!</span></td>';
echo '</table>'; 
} 

?>

 

 

 

gallerypage_insert.php?name=john%20smith is in the address bar so this sets 'name' which should then search db? I do have a john smith in 'user' - so it should work???

perhaps the name is being submitted to the MySQL as "john%20smith" rather than "john smith". Try echoing the $_GET['name']

<?php

error_reporting (E_ALL);

$page_title = 'gallerypageinsert.php';

require_once ('../../mysql_connect.php'); // Connect to the db.

$name = mysql_real_escape_string($_GET['name']);


$query = "SELECT * FROM `gallery` WHERE `user`='$name'"; 
$result = mysql_query ($query) or die("Query error: ". mysql_error()); // Run the query. 
$myrow = mysql_fetch_array($result, MYSQL_ASSOC); 
$num = mysql_num_rows($result); 

echo $name; 


if($num > 0){ 

  echo '<h3>gallery</h3> ';
  // display 

  echo '<p class="indent"><strong>' .$myrow['user_id'] .'</strong></p>'; 


  echo '<br />  ';
} //End if name
else { 

echo'Sorry, no records found!';

} 


mysql_close(); // Close the database connection.


?>

 

 

 

With $_GET['name'] echoded I get 'john smith' ?

Another part of the puzzle...

 

<?php

error_reporting (E_ALL);

$page_title = 'gallerypageinsert.php';

require_once ('../../mysql_connect.php'); // Connect to the db.

$name = mysql_real_escape_string($_GET['name']);



$query = "SELECT * FROM `gallery` WHERE `user` = '$name'"; 
$result = @mysql_query ($query); 
$num = mysql_num_rows($result); 
$myrow = mysql_fetch_array($result, MYSQL_ASSOC); 


echo '<h3>'.$name.'</h3> '; 
echo '<br />  ';

if($num > 0){ 


  echo '<h3>gallery</h3> ';
  // display 


  echo '<p class="indent"><strong>' .$myrow['user_id'] .'</strong></p>';

  echo '<p class="indent"><strong>' .$myrow['registration_date'] .'</strong></p>';


  echo '<img src="uploads/'.$myrow['file1'] .'"/>';



  	  echo '<br />  ';
} //End if name
else { 

echo'Sorry, no records found!';

} 





?>

 

Not sure how its got working but it does now...

 

This now selects '$name' from user...

 

but if there are 2 'john smith' it only shows one record when there is two in the db? there is no limit set?

You'll only every display one record because you only call mysql_fetch_array once. to get them all you need a while loop like you had earlier.

 

If you do want to limit the number of results returned you can do taht by $query = "SELECT * FROM `gallery` WHERE `user` = '$name'" LIMIT 1;

Thanks TT should have spotted that! doh!

 

Also have a problem displaying a record with '&' in ?

 

but the full record is displayed in the address bar?

 

name=ben%20smith%20&%20sons%20limited?

 

$name is only displaying 'ben smith' nothing after the &?

that is because the & character is an essential part of URL encoding. Use the + character if you want to specify a different "spacer" character to %20 without encroaching on other reserved chars.

Thanks pp, how would I do that?

Use rawurlencode() to add your variables to your query string.

...
while ($myrow = mysql_fetch_assoc($result)) { //While


  echo'<a href="gallerypage_insert.php?name=' . rawurlencode($myrow['name']) . '">'. $myrow['name'] .'</a>';


  } //End of if num
...

Brilliant !

 

Another question thou.. have a name with an ' in, getting the problem viewing the \

 

eg stephen\'s

 

 

$name = stripslashes(mysql_real_escape_string($_GET['name']));

 

before I added the stripslashes I was getting 3 \ eg stephen\\\'s

 

how would I get rid of that extra \ ?

 

Cheers!

hmm.... you're stripping the slashes you add with mysql_real_escapestring?

 

echo the content of $_GET['name'] before you add or strip any slashes. Maybe slashes is allready added... maybe Magic Quotes is interfering.

Hi !

 

When I echo $_GET['name'] I got:

 

stephen\'s

 

So I added

 

echo stripslashes($_GET['name']);

 

which works! and get stephen's

 

I echo

 

$name = stripslashes(stripslashes(mysql_real_escape_string($_GET['name'])));

 

That works too! I get stephen's

 

But now I get this error:

 

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /public_html/site/html/gallerypage_insert.php on line 14

 

<?php

error_reporting (E_ALL);

$page_title = 'gallerypageinsert.php';

require_once ('mysql_connect.php'); // Connect to the db.

$name = stripslashes(stripslashes(mysql_real_escape_string($_GET['name'])));




$query = "SELECT * FROM `gallery` WHERE `user` = '$name'"; 
$result = @mysql_query ($query); 
$num = mysql_num_rows($result); 



echo '<h3>'.$name.'</h3> '; 
echo '<br />  ';

echo stripslashes($_GET['name']); 



if($num > 0){ 

while ($myrow = mysql_fetch_assoc($result)) { //While

  echo '<h3>gallery</h3> ';
  // display 


  echo '<p class="indent"><strong>' .$myrow['user_id'] .'</strong></p>';

  echo '<p class="indent"><strong>' .$myrow['registration_date'] .'</strong></p>';


  echo '<img src="uploads/'.$myrow['file1'] .'"/>';



  	  echo '<br />  ';
} //End if name
}
else { 

echo'Sorry, no records found!';

} 





?>

 

 

Is it ok to add two stripslashes around my string? I thought one would have done it?

Sounds like there's an error in your SQL query. Check $result after the query and output mysql_error if it returns false.

 

$name = stripslashes(stripslashes(mysql_real_escape_string($_GET['name'])));

Look at this again. Do you see the logical flaw here? You adding slashes only to remove them again.

The results are just the same if you wrote

$name = stripslashes($_GET['name']);

Thanks TT

 

It only happens on with a record with ' in?

 

Query error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's '' at line 1

 

this error only occurs with

 

$name = stripslashes($_GET['name']);

 

if I remove the 'stripslashes'

 

$name = $_GET['name'];

 

no error but displays the \ in the name?

 

stephen\'s

 

 

The code to select from db is:

 

$query = "SELECT * FROM `gallery` WHERE `user` = '$name'";

Right, I see. The thing is that you need to escape quotation characters before you use variables inside SQL queries. Otherwise they'll be misformatted. ( echo out your query variable ($query = "SELECT * FROM `gallery` WHERE `user` = '$name'" and you'll see why. You'll get a string like this: SELECT * FROM `gallery` WHERE `user` = 'stephen's. What the database see here is SELECT * FROM `gallery` WHERE `user` = 'stephen' and then an additional "s" at the end, and this is where the error is thrown.

 

This is why you need to escape the data so the string will look like SELECT * FROM `gallery` WHERE `user` = 'stephen\'s'

 

For your code you don't need to use the stripslashes at all since the variable you get from $_GET['name'] is allready escaped.

 

But the data value stored in the database is stephen\'s so when you fetch that data you need to stripslashes() so you end up with stephen's.

Thanks tt, yes that did sort it! Cool! But I found my other problem is where source name came from...

 

this selects the name from the db, it displays the name 'stephen's' from the drop down list as well as when I look at the html source:

 

<option value='stephen's'>stephen's</option>

 

But when posted into the db and viewed I get 'stephen' missing the ' 's '?

 

(PS I have deleted some code as some of it related to an image upload)

 

When echoed $query I get ...

 

INSERT INTO gallery (name, registration_date) VALUES ('stephen', NOW())

 

After submit?

 

 

<?php 


/************************** change to match your connection method ********************/ 

require_once ('../../mysql_connect.php'); // Connect to the db. 



if(isset($_POST['Submit'])) { ///// CHECK FORM  WHEN SUMBMITTED (if One) 


if(empty($_POST['name'])){ /// CHECK FORMS HAVE BEEN FILLED IN 
$whatsediterror[2]='<p class="style1">Please choose name.</p>'; 
$error='FALSE'; 
} 


  if (empty($error)){ // IF THERE ARE NO ERRORS THE CARRY ON 





	 // obtain the input form details into variables for the db 
$name=$_POST['name'];


	 $query = "INSERT INTO gallery (name, registration_date) VALUES ('$name', NOW())";  
	 $result = @mysql_query ($query); // Run the query. 

		 if (mysql_affected_rows() == 0) { // A record was added so what next
		 echo'<p>There seems to be an error.</p>'; 
		 echo'<p>ERROR: The insertion into the db</p>'; 
			exit; 
		 } // end if three 

	 /****************** ALL WENT OK AND ENTERED INTO DATABASE DO SOMETHING ***************************/ 



  // display the heading,news and image 
		echo '<h3>' .$name.'</h3>'; 


  exit;			 
	 } // end if two 

} // end if One 

/****************** DISPLAY FORM WITH ERROR OR NOT ***************************/ 
?> 





<br /> 
<p>
<form action="<?php $_SERVER['PHP_SELF'] ?>" enctype="multipart/form-data" method="post"> 


<?php
echo '<select name="name">';
require_once ('../../mysql_connect.php'); // Connect to the db.
$query = mysql_query("SELECT `name` FROM `user`");
while( $name = mysql_fetch_array( $query, MYSQL_ASSOC ) ) {
$opts .= "<option value='".$name['name']."'>".$name['name']."</option>";
}
print $opts;

echo '</select>';
?>

<span class="smallerrormessage">Required</span><br /><? echo $whatsediterror[2] ?></span><br />

<input type="Submit" name="Submit" value="Submit"> 
</form>
</p>

Again, this is conflicting with the HTML's quotes.

 

Instead if single quotes in the OPTION element, try double

<option value="stephen's">stephen's</option>

 

This might work. But it might also not work if browsers try to be "nice" and think you've accidentally mixed single and double quotes. Not even sure if quote characters is allowed in HTML attributes.

 

Why not use the user ID as the value propertly instead? Since it's numeric it'd be a safe value to use.

Your a genious! Yes user_id ! Wicked!

 

Was getting a parse error with the double quotes!

 

How long have you been using php, you know everything!

 

Really thanks!

I got started with PHP in 2003 before I went to England and study. I built a site for other people moving there as well to sign up and arrange accommodation and generally getting to know each other. It was somewhat of a bodgejob and I had my head deep into the PHP manual and a book, PHP Bible.

 

I had played around before with Visual Basic so I already had a grasp of basic programming/scripting concepts. That helped allot. I think PHP was the first curly bracket language I learnt properly. Still learning though, as with everything .

Where did you study?

 

Sounds I bit like my path really! I was asked to quote for a job and the client needed a CMS, didnt have a clue what that involved and a friend sad Yeah I can do that EASY! (Famous last words!)

 

As time passed I did my bit and my mate gave me the brush off, kept saying I do it and that day never come - just give me one more week ended up 3 months and still not a trace on edvidence he worked on it! The client kept asking whens it ready... So I didnt want to look stupid, so then managed to learn the basics myself and get it up and running!

Yea, if you want something done you do it yourself.

 

As a notorious procrastinator I've become very cautions about offering my help because I know that unless I'm being pushed I'll always find some other project to do first. (It wasn't until yesterday I discovered this word and realised there was a specific word for this.) The last few months I've denied myself from starting new projects until I've completed my other backburners.

 

I studied BA (Hons) Modelmaking for Design and Media at the Arts Institute at Bournemouth. Basically I made models of stuff. Stuff = Anything. But the main industry is within architecture and that's where I am today.

 

I had registered my own Webdesign company after I moved back to Norway, and thought I'd be my new career path. But I got a job offer that sounded somewhat more interesting than chasing my clients and always looking for where the next money will come from.

 

The only thing I didn't like about professional webdesign was the business side of it. I'm not a born businessman. I value fun far more than money.

 

 

Just keep playing with PHP and things will become clearer. Remember that the Manual is your Best Friend.

thanks for sharing the code! and I suggest to visit this site phpfreaks.com

thanks for sharing the code! and I suggest to visit this site phpfreaks.com

 

Thanks for sharing that link. I think we should put it in the list of Resources for PHP.