File listing does not work

[EPCtech]

Hi,

In my site people submit games that they have created and let others download them. Anyways, you must upload the game first. And I want it to list the files. What is wrong with this SQL code?

 

SELECT file FROM myfiles WHERE file LIKE '%.zip' OR file LIKE '%.exe' OR file LIKE '%.gmk' OR file LIKE '%.gm6' OR file LIKE '%.gmd' OR file LIKE '%.rar' OR file LIKE '%.zip' AND user='".$name."'

Yes, $name is set.

 

Is there a problem with this code?

 

Thanks for any help,

En-Psyche

[.josh]

column names spelled right, capitalization correct?

[EPCtech]

I just finished triple-checking. 

[.josh]

you sure it's the query string's fault? have you tried running it directly in your db?

[EPCtech]

I tried.

 

The user I am testing with has 1 file.

The first file is listed, but then he also gets 3 other submissions that were uploaded by someone else.

[.josh]

how about wrapping some parenthesis around all those OR conditions

[EPCtech]

I tried. Same result.

 

But I did noticed one thing: It lists all files with the conditions. It completely drops the 'AND user=""' statement.

[.josh]

so you tried:

SELECT file FROM myfiles WHERE (file LIKE '%.zip' OR file LIKE '%.exe' OR file LIKE '%.gmk' OR file LIKE '%.gm6' OR file LIKE '%.gmd' OR file LIKE '%.rar' OR file LIKE '%.zip') AND user='".$name."'

 

(except replacing user='".$name."' with user='somename')

[xtopolis]

I was going to suggest limiting by username first:

SELECT file FROM myfiles 
WHERE user='$name'
AND (file LIKE '%.zip' 
OR file LIKE '%.exe' 
OR file LIKE '%.gmk' 
OR file LIKE '%.gm6' 
OR file LIKE '%.gmd' 
OR file LIKE '%.rar' 
OR file LIKE '%.zip')

[.josh]

I don't think that should really matter.  the AND should get evaluated first regardless. But without the parenthesis, it's doing

 

file LIKE '%.zip' AND user='$name' which would evaluate false if it's not a zip file, but then it evaluates all the other ORs and they all come up positive without being filtered by the user.  Hence the parenthesis around all of the ORs, which will first evaluate all of them and then filter against the user.