PHP Code Help Admin check

[devangel]

hey guys, i got this in an include file (leftbar) with the query in my config file.

 

 

i try to run this little code but its not working, its suppose to show you an admin panel if it works .

 

any help?

[DWilliams]

any help?

 

Not without seeing the code in question, my crystal ball is overheated.

[devangel]

never mind about that one guys, stuck on this:

 

im trying to make an array to store all my users info so i can display it.

 

$data = mysql_query("SELECT * FROM users where userid="$_SESSION['SESS_USERID']) or die(mysql_error());

$usr = mysql_fetch_array( $data );

 

 

this is my code so far. i can pull info from the database, but i edited it with "where userid=$_SESSION['SESS_USERID']}"

to get the users id from my session.

 

but it still doesn't work, this code is located in my config file so i can reference it onto other files.

 

 

[JD*]

Did you try to echo out the sql statement? Do that and see what is being filled in for your session value, and then copy/paste that into your MySQL interface and see if you get results.

 

Right now, from your statement, I see that you may want to try and escape your "" and that you aren't ending the last quote correctly:

mysql_query("SELECT * FROM users where userid="$_SESSION['SESS_USERID'])

to

mysql_query("SELECT * FROM users WHERE userid = '".$_SESSION['SESS_USERID']."'")

 

[devangel]

tried that:

 

$data = mysql_query("SELECT * FROM users WHERE userid = '".$_SESSION['SESS_USERID']."'")) or die(mysql_error());

$usr = mysql_fetch_array( $data );

 

and got this parse error:

 

 

Parse error: parse error in C:\wamp\www\hero\game\includes\config.php on line 43

 

which is clean

 

function clean($str)

{

if (is_numeric($str)) $str=floor($str);

$cleaned=strip_tags($str);

$cleaned=htmlspecialchars($cleaned);

$cleaned=mysql_real_escape_string($cleaned);

$to_clean=array("%20", "\"", "'", "\\", "=", ";", ":");  <-- 43

$cleaned=str_replace($to_clean, "", $cleaned);

return $cleaned;

}

[JD*]

$data = mysql_query("SELECT * FROM users WHERE userid = '".$_SESSION['SESS_USERID']."'")) or die(mysql_error());

 

extra ) at the end of your query (before the "or die") part. Did you try to echo out the whole query (ie, between the $data =... and the $user =... you put a die($data) and see if it successfully executes in MySQL?