Hi Guys,

 

Can't seem to populate my table with Game information once I click a "more details" link...

 

game.php

 

<td><a href="details.php?id=<? echo $row['game_ID'] ?>"> View Details </a></td>

 

details.php

 

<?
include 'dbconnect.php';
$nameID = $_GET['id'];
$output = mysql_query("SELECT * FROM game WHERE game_ID = '$game_ID'");
echo "<table border='1'><tr><th>Game Name</th><th>Platforms</th><th>Description</th></tr>";

while($row = mysql_fetch_array($output))
{
echo "<tr>";
echo "<td>" . $row['gameName']. "</td>";
echo "<td>" . $row['platform']. "</td>";
echo "<td>" . $row['description']. "</td>";
echo "</tr>";
}
echo "</table>";
include 'close.php';
?>

 

Please note, the game page is working fine, because it is displaying the list of games from the database.

 

Thanks for your help in advance

 

Matt

Should be

$gameID = $_GET['id'];

Edited November 22, 201114 yr by Samus

Should $nameID and $game_ID be the same variable?

Edited November 22, 201114 yr by Anonimista

Hi Matt,

 

I hate to rain on your parade, but there are a few comments I'd like to make about your code that could help you prevent problems in the future.

 

The first is the fact that you're using the out of date mysql_* functions that were superseded by the mysqli extension which has been available since PHP 5.0.0 (2004). MySQLi, or MySQL Improved, provides enhanced security in the form of prepared statements, and an object-oriented interface which results in cleaner, more maintainable code - just two of the reasons to convert. Personally I'd recommend PDO for it's portability and overall wider range of features.

 

The second is that you're not sanitising or validating user input. GET/POST can contain anything the user wishes - it is your responsibility to escape this data and you should NEVER rely on hoping the user does not enter a value that could potentially be used in an SQL injection. Always, always, always sanitise - it is bad system design not to. In this specific case you should be calling mysql_real_escape_string and casting the variable to the type it will be used as (I'm guessing int).

 

Hope this helps you,

Ben

 

/rant

You missed a semi colon off the end of your line.

my 2 cents :

<?php // use full opening statement, some servers have issues otherwise and it is only 3 letters
 // lets do a bit of input checking
 if(
   isset($_GET['id']) // is the id actually set ?
   and // we use and, because all of these critia must be met
   is_numeric($_GET['id']) // is the id actually a number
   and // we use and, because all of these critia must be met
   strlen($_GET['id']) <= 7 // allow for up to 9999999 games not crucial but still nice to limit as much as possible
   )
 { // open if statement

     // this file is crucial so we use require
     require_once 'dbsettings.php'; // assume dbsettings.php has an array (named $sqlconf) with database settings in it

     $gameID = preg_replace('/[^\d]/','',$_GET['id']); // remove anything that is not a digit ; being pedantic but over caution is good
     $pdo = new PDO('mysql:host='.$sqlconf["host"].';dbname='.$sqlconf['dbase'],$sqlconf["login"],$sqlconf["pass"]); // new pdo instance 
     $stmt = $pdo->prepare("SELECT * FROM `game` WHERE `game_ID` = ? "); // the ? is a place holder for the variable to be passed through
     $stmt->execute(array($gameID));  // pass the ID to the prepared statement, it replaces the ?
     $gameSet = $stmt->fetchAll(PDO::FETCH_ASSOC); // fetch an array with the Game's details

     if(count($gameSet) > 0)
     { // if there was a result
       echo '<table border="1"><tr><th>Game Name</th><th>Platforms</th><th>Description</th></tr>'; // single quotes proccess faster
       foreach($gameSet as $gameRow)
       {
         echo '<tr>
                 <td>',$gameRow['gameName'],'</td>
                 <td>'.$gameRow['platform'],'</td>
                 <td>',$gameRow['description'],'</td>
               </tr>';  // using muliple echo's is slower
       }
       echo '</table>';  
     }
     else
     {//if there was no result
       echo 'No Game with this ID found.';
     }  
 }// close If Statement
 else{
   // handle bad inputs
   echo 'Input Error !';
 } 

 include 'close.php';
?>

You missed a semi colon off the end of your line.

 

The semi colon is not required. Iv managed to miss that and it still works perfectly fine.