[SOLVED] So Simple, whats wrong with this?

[virtuexru]

OK. So I have a link with an ?id=$username field on the first page that works fine... Here's the code on the next page to try and get it to work but I get an error:

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

 

Here's the code:

 

include('config/config.php');

include('config/connect.php');

 

$display  = "SELECT displayname, joindate, posts FROM userlist WHERE displayname = $id";

$result  = mysql_query($display) or die(mysql_error());

$userinfo = mysql_fetch_array($result);

[B34ST]

try this:

 

include('config/config.php');
include('config/connect.php');

$display  = "SELECT displayname, joindate, posts FROM userlist WHERE displayname = '$id'";
$result   = mysql_query($display) or die(mysql_error());
$userinfo = mysql_fetch_array($result);

[virtuexru]

You saved me, what a stupid mistake. Thanks B34ST.

[kenrbnsn]

Register_globals are probably disabled for security reasons. If you are learning from an old book, the examples were written with the assumption that they were enabled. You need to explicitly retrieve the value from the $_GET superglobal array for values passed on the URL. Also, strings in MySQL need to be quoted.

 

<?php
$display  = "SELECT displayname, joindate, posts FROM userlist WHERE displayname = '" . $_GET['id'] . "'";
$result   = mysql_query($display) or die("Problem with the query: <pre>$display</pre><br>" . mysql_error());
$userinfo = mysql_fetch_assoc($result);
?>

 

Ken

[trq]

<?php

  include('config/config.php');
  include('config/connect.php');

  if (isset($_GET['id'])) {
    $id = $_GET['id'];
    $display  = "SELECT displayname, joindate, posts FROM userlist WHERE displayname = '$id'";
    $result   = mysql_query($display) or die(mysql_error());
    $userinfo = mysql_fetch_array($result);
  }

?>

[per1os]

Along with Beast, do this:

 

include('config/config.php');
include('config/connect.php');

// Note to retrieve post/get should always be done this way.
$display  = "SELECT displayname, joindate, posts FROM userlist WHERE displayname = '".mysql_real_escape_string($_GET['id'])."'"); // the real excape helps prevent sql injection.
$result   = mysql_query($display) or die(mysql_error());
$userinfo = mysql_fetch_array($result);

 

[virtuexru]

Wow, thanks for all the help guys. Worked perfectly.