GET issue I'm 'GET'-ing... haw haw:)

[woolyg]

Hi all,

 

I'd like to be able to display mypage.php?categoryid=1, and I got that working ok. However, when I now try to just go to mypage.php on its own, I get an error (supplied argument is not a valid mySQL resource). Here's the code:

 

if(isset($_GET['categoryid']) && !empty($_GET['categoryid'])){
$q = "SELECT * FROM `doc_content` WHERE `categoryid`=".$_GET['categoryid'];
$r = mysql_query($q);
$categoryid = $_GET['categoryid'];
}
while($row = mysql_fetch_array($r)){
echo $row['id'];
echo $row['categoryid'];
echo $row['question'];
echo $row['answer'];
}

 

..do I need to add something in for the standard page to display normally?

Wooly

[genericnumber1]

<?php
if(isset($_GET['categoryid']) && !empty($_GET['categoryid'])){
$q = "SELECT * FROM `doc_content` WHERE `categoryid`=".$_GET['categoryid'];
$r = mysql_query($q);
$categoryid = $_GET['categoryid'];

while($row = mysql_fetch_array($r)) {
	echo $row['id'];
	echo $row['categoryid'];
	echo $row['question'];
	echo $row['answer'];
}
}
?>

 

this script is vulnerable to sql injection as well

[woolyg]

Thanks for that - much obliged.

-Woolyg.

[woolyg]

Bah!! I managed to break it again..

 

I'm using the code

<?php
$q = "SELECT `id`,`question`,`answer`,UNIX_TIMESTAMP(`last_updated`) 'last_updated' FROM `doc_content` WHERE `categoryid` = ".$_GET['categoryid']." ORDER BY `last_updated` ASC";
$r = mysql_query($q,$db) or die(mysql_error());
$n = mysql_num_rows($r);
?>

 

which works fine when I want to view mypage.php?categoryid=1, but when I try to view simply mypage.php i get the error:

 

Undefined index: categoryid

 

 

can anyone help? How can I view mypage.php without error, while also being able to view mypage.php?categoryid=1  ???

 

Cheers,

Woolyg

[genericnumber1]

you need to make sure $_GET['categoryid'] is set.... use the same technique as before...

 

<?php
if(isset($_GET['categoryid']) && !empty($_GET['categoryid'])){
    $q = "SELECT `id`,`question`,`answer`,UNIX_TIMESTAMP(`last_updated`) 'last_updated' FROM `doc_content` WHERE `categoryid` = ".$_GET['categoryid']." ORDER BY `last_updated` ASC";
    $r = mysql_query($q,$db) or die(mysql_error());
    $n = mysql_num_rows($r);
}
?>

[woolyg]

Hi,

 

Is there a way I can utilise the variables

 

echo $row['id'];

echo $row['categoryid'];

echo $row['question'];

echo $row['answer'];

 

past the closing '}'?

 

each time I try, I get an undefined index error..

[black.horizons]

just have an if statement checking that the categoryid is not null

 

if($categoryid != "")

{

..

}

 

else

{

echo "oi ye git enter a value!";

}