cannot get pass the variable function

[mark103]

Hi guys,

 

I have a trouble with my php snippet, when I insert the var function in the url bar something is like:

 

http://www.mysite.com/delete.php?favorites&id=0

 

or

 

http://www.mysite.com/delete.php?whateveritis&id=0

 

It doesn't get pass the favorites function to delete the id. It is the same things that it goes for each different function.

 

Here's the current code:

 

<?php

session_start();
    define('DB_HOST', 'localhost');
    define('DB_USER', 'mydbuser');
    define('DB_PASSWORD', 'mydbpass');
    define('DB_DATABASE', 'mydbtablename');

    $errmsg_arr = array();
    $errflag = false;

    $link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
    if(!$link) {
  die('Failed to connect to server: ' . mysql_error());
    }

    $db = mysql_select_db(DB_DATABASE);
    if(!$db) {

die("Unable to select database");
    }

   function clean($var){

return mysql_real_escape_string(strip_tags($var));
    }
    $favorites = clean($_GET['favorites']);
    $id = clean($_GET['id']);

if($favorites && $id == ''){
   // both are empty
   $errmsg_arr[] = 'favorites id are missing.';
   $errflag = true;
}

    if($errflag) {
  $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
  echo implode('<br />',$errmsg_arr);
   }
   else {
$insert = array();
if(isset($_GET['id'])) {
    $insert[] = 'id = \'' . clean($_GET['id']) .'\'';
}
if(isset($_GET['favorites'])) {
    $insert[] = 'favorites = \'' . clean($_GET['favorites']) . '\'';
}

if($favorites && $id) {
   mysql_query("DELETE FROM favorites WHERE id='$id'");
   $deleted = mysql_affected_rows();
   if($deleted > 0) 
   {
  echo "favorites channels is deleted";
   } 
   else 
   {
  echo("favorites is already deleted");
   }
}
}
?>

 

If you do know how to get pass the favorites function, then please say so as i need your help.

 

Any advice would be much appreicated.

[MadTechie]

the URL should be

http://www.mysite.com/delete.php?favorites=favorites&id=0

or

http://www.mysite.com/delete.php?favorites=whateveritis&id=0

[mark103]

Thanks for your quick replied and thanks for your help MadTechie. I can see the problem is fixed, however i would like to print out on my php page when i enter the function name as favorites. When I enter the function name as favorites, it did not print out when I use echo.

 

Code:

 

[code]<?php
session_start();
    define('DB_HOST', 'localhost');
    define('DB_USER', 'mydbuser');
    define('DB_PASSWORD', 'mydbpass');
    define('DB_DATABASE', 'mydbname');
       
    $errmsg_arr = array();
    $errflag = false;

    $link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
    if(!$link) {
  die('Failed to connect to server: ' . mysql_error());
    }

    $db = mysql_select_db(DB_DATABASE);
    if(!$db) {
  die("Unable to select database");
    }

   function clean($var){

return mysql_real_escape_string(strip_tags($var));
    }
  
    $favorites = clean($_GET['favorites']);
    $id = clean($_GET['id']);
    
if($favorites && $id == ''){
   // both are empty
   $errmsg_arr[] = 'favorites id are missing.';
   $errflag = true;
}

    if($errflag) {
  $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
  echo implode('<br />',$errmsg_arr);
   }
   else {
$insert = array();
}
$insert = array();
if(isset($_GET['id'])) {
    $insert[] = 'id = \'' . clean($_GET['id']) .'\'';
}
if(isset($_GET['favorites'])) {
    $insert[] = 'favorites = \'' . clean($_GET['favorites']) . '\'';
}

if($favorites && $id) {
  echo "its working!";
}
?>

 

 

Any idea?

[MadTechie]

okay i have cleaned up the code a little

 

if you use these parameters

?id=123&favorites=456

result

its working!

id = '123'

favorites = '456'

 

 

?id=123

result

its failed!

favorites is missing.

 

?favorites=456

result

its faild!

id is missing.

 

?

result

its faild!

id is missing.

favorites is missing.

 

Here is the code

<?php
session_start();
define('DB_HOST', 'localhost');
define('DB_USER', 'mydbuser');
define('DB_PASSWORD', 'mydbpass');
define('DB_DATABASE', 'mydbname');

$errmsg_arr = array();
$errflag = false;
$insert = array();

$link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
if (!$link) die('Failed to connect to server: ' . mysql_error());

$db = mysql_select_db(DB_DATABASE);
if (!$db) die("Unable to select database");

if(empty($_GET['id'])){
  $errmsg_arr[] = 'id is missing.';
}
if(empty($_GET['favorites'])){
  $errmsg_arr[] = 'favorites is missing.';
}

$insert = array();
if (isset($_GET['id'])) {
  $insert[] = 'id = \'' . clean($_GET['id']) . '\'';
}
if (isset($_GET['favorites'])) {
  $insert[] = 'favorites = \'' . clean($_GET['favorites']) . '\'';
}

if(empty($errmsg_arr)) {
  echo "its working!<br />";
  echo implode('<br />', $insert);
}else{
  $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
  echo "its failed!<br />";
  echo implode('<br />', $errmsg_arr);
}

function clean($var) {
  return mysql_real_escape_string(strip_tags($var));
}