Check my code please

[Voodoo Jai]

I have a piece of code that I have been writing but I think its not secure and tatty, could you please check it for me and advise of possible problems.

 

<?php require_once('Conn/Menu_con.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{
  $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;    
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}

if (isset($_POST['postcode'])) {
  $PostCodeVAR_Adverts = (get_magic_quotes_gpc()) ? $PostCodeVAR_Adverts : mysql_real_escape_string($PostCodeVAR_Adverts);
}
$PostCodeVAR_Adverts = $postcode;
$postcode = $PostCodeVAR_Adverts;


mysql_select_db($database_Menu_con, $Menu_con);
$query_PostCodeSearc = "SELECT TakeawayID, Post_Code, Takeaway_Name, location, t.CountyID, t.LocationID, t.City, t.FreePhone, t.TextOrder, t.List_Type , t.EnhancedListing 
FROM takeaway t, location 
WHERE t.Post_Code like '$postcode%' AND t.locationID = location.town_cityID 
ORDER BY t.EnhancedListing DESC, t.List_Type DESC,  location, Post_Code ASC";

$PostCodeSearc = mysql_query($query_PostCodeSearc, $Menu_con) or die(mysql_error());
$row_PostCodeSearc = mysql_fetch_assoc($PostCodeSearc);
$totalRows_PostCodeSearc = mysql_num_rows($PostCodeSearc);

if (isset($_POST['postcode'])) {
  $PostCodeVAR_Adverts = (get_magic_quotes_gpc()) ? $PostCodeVAR_Adverts : mysql_real_escape_string($PostCodeVAR_Adverts);
}

$query_Adverts = sprintf("SELECT AdvertID, Link, districtCode 
FROM adverts, postcodedistrict 
WHERE districtCode = %s AND adverts.PostalDistrict = postcodedistrict.PostCodeID;", GetSQLValueString($PostCodeVAR_Adverts, "text"));
$Adverts = mysql_query($query_Adverts, $Menu_con) or die(mysql_error());
$row_Adverts = mysql_fetch_assoc($Adverts);
$totalRows_Adverts = mysql_num_rows($Adverts);
?>

 

I have changed some of the connections details.

 

Many thanks in advance

 

VoodooJai

[wildteen88]

That code looks likes it been generated by Dreamweaver. I do not recommend any PHP code generated by Dreamweaver. You're better of coding it yourself, that you know what the code does/should do plus it will much more readable.