
Originally Posted by
e1seix
PHP Code:
$product_sku = $_GET['product_sku'];
// Get a specific result from the "example" table
$result = mysql_query("SELECT * FROM shaving WHERE product_sku=$product_sku AND DEF='T05'") or die(mysql_error());
I hope that you don't do exactly that: you're exposing your database to injection attacks. Call the mysql_real_escape_string function and insert the returned value into the query. I also hope you don't really send MySQL error messages to the client upon failure: that can also expose your database to attacks by revealing the mechanics of your site and database. Moreover, it looks rubbish to end users. Fail gracefully, instead.
As for the actual problem, what does an actual query contain? That is, what is the value(s) of $product_sku in your tests? Is the resulting query actually legal?
PHP Code:
echo "<table border='0' cellpadding='5' cellspacing='0' width='100%'>";
while($row = mysql_fetch_array( $result )) {
// Print out the contents of each row into a table
echo "<tr><td bgcolor='#ffff00'><p class='BRAPRO'>";
echo $row ['BRA']. " | ". $row['PRO'];
echo "</p></td></tr>";
}
Drop out of PHP when outputting significant amounts of plain text:
PHP Code:
<table border="0" cellpadding="5" cellspacing="0" width="100%">
<?php
while ($row = mysql_fetch_array($result)) {
?>
<tr><td bgcolor="#ffff00"><p class="BRAPRO"><?php echo "{$row['BRA']} | {$row['PRO']}"; ?></p></td></tr>
<?php
}
?>
</table>
Preferably use CSS, rather than HTML attributes, to style documents, too.
Bookmarks