Comment Mod System Effects all rows...

[DiscoTrio]

Sorry if its confusing but here is whats going on:  I have a table in a database called comments and there are alot of entries there but can manually be marked flagged with a 1.  Nvm how that is done, but I made it so the comments are printed on a pass protected page with two links below them.  Ignore is supposed to mark that comment with a 0, and delete deletes the row.

 

Everything works fine but the action happens to ALL the comments that are shown.  Can anyone see why that is happening?

 

<?
if($session->isAdmin()){?>
<center><font face="Papyrus" size="5">MOD Center</font></center>
<center><a href='mod1.php'>[News Aproval]</a>  <a href='mod2.php'>[Flagged Items]</a></center>
<?$con = mysql_connect("localhost","bmvybfbk_master","74SAc194G");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("bmvybfbk_website", $con);

$result = mysql_query("SELECT * FROM comments WHERE flagged = '1'");

while($row = mysql_fetch_array($result))

  {
    $cnumber = $row['id'];
  echo $row['writer'] . " wrote:<br>" . $row['comment'];
  echo "<br><a href='mod2.php?action=ignore'>[ignore]</a>";
  echo " <a href='mod2.php?action=delcomment'>[Delete]</a>";
  echo "<br>----------------------------------------------------------------------------------------------------<br>";
  
  
  if ($action == ignore) {
mysql_query("UPDATE comments SET flagged = '0' WHERE id = '$cnumber' LIMIT 1");}

if ($action == delcomment) {mysql_query("DELETE FROM comments WHERE id='$cnumber' LIMIT1");}

else {echo " ";}
  
  }
}else{ echo "*You Don't Have any rights to View this page*'"; } ?>

[DiscoTrio]

anyone need more info?

[rajivgonsalves]

you got your if statements in your while remove them out of the while also pass cnumber to the mod2.php script

 

mod2.php?action=ignore&cnumber=$cnumber

[Iainzor]

Where are you getting the $cnumber variable from?  I'm assuming you getting it from the url (/my/url?cnumber=123).  In this case, you may need to get the variable from the $_GET superglobal since register_globals may be turned off (and should be left off for security reasons).

 

$cnumber = $_GET['cnumber'];

 

You should also use error_reporting(E_ALL) to check for any missing variables or small errors.

[MadTechie]

also apply the same logic (from Iainzor post) to the actions

 

also

LIMIT1

should be

LIMIT 1

[DiscoTrio]

Wow, thanx it worked.