Can't account for spaces in my database when echoing out data?

[mcc_22ri]

Hi Everyone,

 

What I'm trying to do is echo out information from a mysql database into my URL. I have done that (please see below code) but what I haven't figured out yet is for the code to handle spaces or two words. For example, if you visit the below URLs the page will echo out the city name (which is what I want) but I have a city called "Las Vegas" in my mysql database which is obviously two words and when I type in las vegas, las-vegas or Las Vegas etc ... at the end of the URL the code isn't echoing out anything. I also just recently added a urldecode within my code to see if that works but it appears it isn't. What am I doing wrong? What do I have to change in my syntax? Thanks everyone!

 

http://whatsmyowncarworth.com/auto/miami

http://whatsmyowncarworth.com/auto/providence

http://whatsmyowncarworth.com/auto/albany

http://whatsmyowncarworth.com/auto/boston

http://whatsmyowncarworth.com/auto/las-vegas <--- not echoing city name

http://whatsmyowncarworth.com/auto/Las%20Vegas <--- not echoing city name

 

<?php

include('init.php'); // connection to database

if (isset($_GET['u'])) {

$city = mysql_real_escape_string(urldecode($_GET['u']));
	// protection against mysql injection
if (ctype_alnum($city)) {
	$data = mysql_query("SELECT State, City FROM cars WHERE City='$city'" );
	if (mysql_num_rows($data) > 0) {
		while ($row = mysql_fetch_assoc($data)) {
		    echo $row["City"];
		}
	}
}
}

?>

 

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

 

.htaccess

 

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /auto/cars.php?u=$1 [NC]

[.josh]

echo "<pre>";
echo $_GET['u'];
echo "</pre>";

 

What does that output for 2-word values?

 

 

 

 

[Jessica]

http://whatsmyowncarworth.com/auto/las-vegas <--- not echoing city name

http://whatsmyowncarworth.com/auto/Las%20Vegas <--- not echoing city name

 

For the first one, you'd want to strreplace '-' with ' '

For the second, when you do the urldecode, make sure your comparison is case insensitive.

[mcc_22ri]

Hi Josh and Jesirose,

 

I appreciate the replies.

 

Josh, I echoed out your above code and I the results didn't change.

 

Jesirose, I'm a little confused at your explantation. What in the syntax would I need to edit?

 

Thanks!

[.josh]

Well I know echoing it out wouldn't change anything... I was sort of asking you to post what it output so that we can see it, since we don't have access to your site to see for ourselves...

[.josh]

oh and another thing I noticed... you wrap your query in a if (ctype_alnum($city)) {...} condition.  Well spaces and hyphens will cause that condition to fail, no query made.

[mcc_22ri]

Hey Josh,

 

Thanks for the reply. My mistake, I wasn't quite sure what you meant. Below are a few examples of what my current php syntax outputs. Everything currently works besides "Las Vegas". What do you think?

 

http://whatsmyowncarworth.com/auto/miami

http://whatsmyowncarworth.com/auto/providence

http://whatsmyowncarworth.com/auto/albany

http://whatsmyowncarworth.com/auto/boston

http://whatsmyowncarworth.com/auto/las-vegas <--- not echoing city name

http://whatsmyowncarworth.com/auto/Las%20Vegas <--- not echoing city name

[.josh]

where are you echoing it?  are you echoing it inside this condition: if (ctype_alnum($city)) { ?  Did you see my post about that condition?

 

oh and another thing I noticed... you wrap your query in a if (ctype_alnum($city)) {...} condition.  Well spaces and hyphens will cause that condition to fail, no query made.

[mcc_22ri]

Brillant!

 

It's now working!

 

I just have to work on making the URL prettier. I'm assuming I would have to edit my .htaccess to fix the spacing issue?

 

http://whatsmyowncarworth.com/auto/Las%20Vegas

 

<?php

include('init.php'); // connection to database

if (isset($_GET['u'])) {

$city = mysql_real_escape_string(urldecode($_GET['u']));
	// protection against mysql injection
if ($city) {
	$data = mysql_query("SELECT State, City FROM cars WHERE City='$city'" );
	if (mysql_num_rows($data) > 0) {
		while ($row = mysql_fetch_assoc($data)) {
		    echo $_GET['u'];
		}
	}
}
}

?>

[Jessica]

Do this:

$sql = "SELECT State, City FROM cars WHERE City='$city'" ;

echo $sql;

$data = mysql_query($sql);

 

What do you get?

[mcc_22ri]

Hi jesirose and everyone!

 

I appreciate the reply. I changed things up a little bit and the code seems is working. The below code isn't very secure so I figured out a way to make it so (or so I think. Look at the code in this forum post). I'm still trying to figure out how to add a - in between city names. For example, instead of Las%20Vegas las-vegas would be better but I'm a little confused on how to do that? Any pointers anyone?

 

http://whatsmyowncarworth.com/auto/Las%20Vegas

 

<?php
include('init.php'); // connection to database

if (isset($_GET['u'])) {
    $city = mysql_real_escape_string(urldecode($_GET['u']));
    // protection against mysql injection
    if (ctype_alnum(str_replace(' ', '', $city))) {
        $data = mysql_query("SELECT State, City FROM cars WHERE City='$city'" );
        if (mysql_num_rows($data) > 0) {
            while ($row = mysql_fetch_assoc($data)) {
                echo $row["City"];
            }
        }
    }
}
?>

[.josh]

The way I understand it, you have in your database "las vegas" and you want to be able to put into the address bar ../las-vegas and treat the city as "las vegas" right?  Assuming your mod rewrite is working correctly and it is putting it into that u url param...this will allow you to do ../las-vegas or ../las%20vegas

 

<?php
include('init.php'); // connection to database

// if city exists...
if (isset($_GET['u'])) {
    // decode and replace hyphen with space
    $city = str_replace('-',' ',urldecode($_GET['u']));
    
    // if value contains only letters, numbers or spaces...
    if ( preg_match('~^[a-z0-9 ]+$~i',$city) ) {
        // select data from database...
        $data = mysql_query("SELECT State, City FROM cars WHERE City='$city'" );
        if (mysql_num_rows($data) > 0) {
            while ($row = mysql_fetch_assoc($data)) {
                echo $row["City"];
            }
        }
    }
}
?>

[mcc_22ri]

Thanks Josh,

 

That's brillant!

 

I just have one quick question for you. How did you go about figuring that out? What was your thought process behind what you did?

 

Thanks again!

 

[.josh]

MAAaaaAAAAaAaaAAaaAGIIIiiiIIIIiiiIIIIiiiiC

[mcc_22ri]

I thought maybe it was a leprechaun because I'm a mick .... guess not ... haha