Retrieving SQL data using variables

[limessl]

I have an SQL table with three columns id, Code, and Description.

 

I have written the SQL that appends the correct data into the table, but I am struggling with the code to retrieve it.

 

<?php

$tempvar=$_POST['variable'];

$result = mysql_query("SELECT * FROM tablename

WHERE Code = $tempvar");

 

while($row = mysql_fetch_array($result))

  {

  return $row['Description'];

 

  }

?>

 

The problem is that it is just retrieving EVERY line from the table rather than just the ones where Code= the variable.

 

I have checked that the variable concerned is still valid in the $_POST array, so now I am very stuck! The $_POST varaibles is actually set on a previous page, so it isn't the case that I'm not posting the variable and expecting something on the same page to not know what it is.

[Maq]

1) Please use

or

tags around code.

2) Have you echoed $tempvar to see what the actual value is?

3) You must invoke mysql_real_escape_string on any input to the database to prevent MySQL injections.

[knsito]

is 'Code' a string?

WHERE Code = '$tempval'

 

Also as Maq said you should sanitize your variables

[limessl]

Sanitise?

[limessl]

is 'Code' a string?

WHERE Code = '$tempval'

 

I thought you'd cracked it - but I tried adding in the single quote marks and it made no difference

 

Code is indeed a string.

[srujana]

try to echo the $tempval

or echo the complete sql and see what it returns.

[Maq]

is 'Code' a string?

WHERE Code = '$tempval'

 

Also as Maq said you should sanitize your variables

 

MySQL doesn't have a String type.  Maybe you meant VARCHAR or TEXT?

 

OP, if your query is returning all the records then there is nothing wrong with your query.  For the second time, please echo $tempvar and tell us what the value is.

 

 

[limessl]

$tempvar returns something like XX1234567890 - no quote marks or anything else

 

The table looks like this (data made up)

 

id/Code/Description - yes those are the real names of the columns

 

1/XX1234567890/info@domain.com

2/XX1234567890/postmaster@domain.com

3/XX1234567890/webmaster@domain.com

4/XX0987654321/info@another.com

5/XX0987654321/postmaster@another.com

6/XX0987654321/webmaster@another.com

 

So - the code is SUPPOSED to look at the 'Code' column and pull out the 'Description' that have ONLY the variable as their value - but let's say I run the query using XX1234567890 as value in the 'Code' column it STILL returns ALL 6 values in the table, not JUST the 3 where the 'Code' matches the correct value that's being passed.

 

My original post did say "I have an SQL table with three columns id, Code, and Description."

 

So if there has been any confusion about what Code meant, that should have cleared it up?

 

[Maq]

Why are you returning?  Is this part of a method I'm not seeing?

 

Run this code and tell me what it outputs.

 

$tempvar = mysql_real_escape_string($_POST['variable']);
echo "tempvar: $tempvar 
";
$sql = "SELECT * FROM tablename WHERE Code = $tempvar";
echo "sql: $sql 
";
$result = mysql_query($sql);

while($row = mysql_fetch_array($result))
{
   echo $row['Description'] . "
";
}
?>

[limessl]

Return is required because the outout generates a dropdown box in a CMS add-on, and return is the only code that works successfully.

 

I'll check that code....

[Maq]

Return is required because the outout generates a dropdown box in a CMS add-on, and return is the only code that works successfully.

 

I'll check that code....

 

You can echo it to the browser rather than returning the data.