Really simple ?id= question for news page

[tomhoad]

Hello.

 

I have a really simple news page set up. On the home page I have the titles of the latest 3 news articles displayed. I have linked the titles to my news.php page which displays the full articles (of all news articles).

 

Ideally I'd like to be able to click on a news article on the front page, and it display the title, content and date for just the selected news article.

 

Index.php code:

 

<?php 

include 'secure/config.php'; 
include 'secure/opendb.php'; 

$query   = "SELECT id, title
FROM news ORDER BY id DESC LIMIT 3"; 

$result  = mysql_query($query) or die('Error : ' . mysql_error()); 
while ($row     = mysql_fetch_array($result, MYSQL_ASSOC)) { 

$title   = $row['title']; 
echo stripslashes (
'
<a href="news.php" class="news-header" >'.$title.'</a>
<br />
'
);    

}
?>

 

News.php code:

 

<?php 

include 'secure/config.php'; 
include 'secure/opendb.php'; 

$query   = "SELECT id, title, content, FROM_UNIXTIME(date+21600, '%W %D %M %Y at %h:%i %p') as dttm 
FROM news ORDER BY id DESC LIMIT 10"; 

$result  = mysql_query($query) or die('Error : ' . mysql_error()); 
while ($row     = mysql_fetch_array($result, MYSQL_ASSOC)) { 

$title   = $row['title']; 
$content   = $row['content'];
$dttm   = $row['dttm'];

echo stripslashes (
'
<p class="news-header">'.$title.'</p>
<p class="news-body">'.$content.'</p>
<p class="news-footer">Posted on: '.$dttm.'</p>
<br />
'
);    

}

?>

 

e.g. I would like the part that says a href="news.php" to direct to news.php?id=3  etc.

 

How do I do this? I'm sure it's really simple, so thanks for your patience!

 

Cheers.

[napurist]

I think what you are asking for is to dynamically create the href link so you can use $_GET to display your news article.

 

If that is so then just replace

 

<a href="news.php" class="news-header" >'.$title.'</a>

 

with

 

<a href="news.php?id='.$row['id'].'" class="news-header" >'.$title.'</a>

 

Let me know if that help...

[tomhoad]

Cool, that's generating the right link now. However, I'm not sure where to place the $_GET

 

My query in news.php now looks like:

 

$query   = "SELECT id, title, content, FROM_UNIXTIME(date+21600, '%W %D %M %Y at %h:%i %p') as dttm 
FROM news ORDER BY id WHERE id=".$_GET['id']; 

 

However my syntax is busted - and I'm blind as to where it is...

 

Thanks very much for your help so far

[tomhoad]

Damn, that was stupid of me    Why the hell am I ordering by ID when I'm using only one ID...

 

FIXED!

 

Cheers

[Maq]

Damn, that was stupid of me    Why the hell am I ordering by ID when I'm using only one ID...

 

FIXED!

 

Cheers

 

Lol, I was just going to mention that.

 

Before you use $_GET['id'] in the SQL statement, it's a good idea to sanitize it to prevent SQL Injections:

 

$id = mysql_real_escape_string($_GET['id']);

$query   = "SELECT id, title, content, FROM_UNIXTIME(date+21600, '%W %D %M %Y at %h:%i %p') as dttm
FROM news WHERE id='$id'"; 

 

You don't need single quotes if id is an integer (auto_increment).

[tomhoad]

Great, cheers Maq.

 

Just out of interest, what do you mean by sanitising the ID? Should I be using mysql_real_escape_string on other parts (see above) to prevent SQL injections?

 

Cheers.

[Maq]

Here's a very basic example & explanation, Tizag.

 

If you search the forums for, "SQL Injections", you should find more than enough information.