[SOLVED] will this query statement work?

[jim.davidson]

  $query_getCust = sprintf("SELECT * FROM customer WHERE updated_by = %s OR created_by =%s", GetSQLValueString($_POST['user_id'], "int"));

[Maq]

Why don't you try it out first?

[jim.davidson]

Ok I trued it

 

$userid = 1;

 

  mysql_select_db($database_mine, $mine);

  $query_getCust = sprintf("SELECT * FROM customer WHERE updated_by = %s OR created_by =%s", GetSQLValueString($userid, "int"));

  $getCust = mysql_query($query_getCust, $mine) or die(mysql_error());

  $row_getCust = mysql_fetch_assoc($getCust);

  $totalRows_getCust = mysql_num_rows($getCust);

echo $totalRows_getCust;

 

Here's the error I'm getting.

 

Warning: sprintf() [function.sprintf]: Too few arguments in C:\Sites\shoppe\testsql.php on line 38

Query was empty

 

 

[jim.davidson]

Sorry I meant to say tried, no trued.  Also this is line 38

 

$query_getCust = sprintf("SELECT * FROM customer WHERE updated_by = %s OR created_by = %s", GetSQLValueString($userid, "int"));

 

I think it has to do with GetSQLValueString($userid, "int"), I'm pretty sure I'm missing something here.

 

Any help will be appreciated

 

[kickstart]

Hi

 

Don't normally use sprintf, but it appears you are using 2 parameters in the SQL but only only passing one.

 

So this would work (although horrible and pointless):-

 

$query_getCust = sprintf("SELECT * FROM customer WHERE updated_by = %s OR created_by = %s", GetSQLValueString($userid, "int"), GetSQLValueString($userid, "int"));

 

However not sure but think this would work and is better

 

$query_getCust = sprintf("SELECT * FROM customer WHERE updated_by = %1$s OR created_by = %1$s", GetSQLValueString($userid, "int"));

 

All the best

 

Keith

[jim.davidson]

Ok I tried a different route,

$userid = 1;

$query_getCust = "SELECT * FROM customer WHERE updated_by = $userid OR created_by = $userid";

  $row_getCust = mysql_fetch_assoc($getCust);

  $totalRows_getCust = mysql_num_rows($getCust);

  echo $totalRows_getCust;

 

$totalRows_getCust equaled 4 and thats the correct total

 

Am I asking for trouble going this way? I'm new to this and learning as I go.

[kickstart]

Hi

 

It is the way I would do it. Just make sure that $userid is escaped properly to make sure it hasn't got any malicious code in it.

 

All the best

 

Keith