[SOLVED] more include variable problems

[envexlabs]

ok, so this is part 2 to my previous post which was solved using global.

 

index.php

<?php 
                
$store_id = $_GET[store_id];
                
select_store(); 
                
?>

 

functions.php

function select_store(){

global $store_id;

$store_info_query = mysql_query('SELECT * FROM `store` WHERE ID = ' . $store_id . '');
global $store_info = mysql_fetch_row($store_info_query);
    
}

 

I can't seem to access any of the $store_info variables in my index.php file.

 

any suggestions?

[pocobueno1388]

Why don't you make the storeID a parameter in your function?

 

<?php

function select_store($store_id){

$store_info_query = mysql_query('SELECT * FROM `store` WHERE ID = ' . $store_id . '');
global $store_info = mysql_fetch_row($store_info_query);
    
}

?>

 

Now just use the function like this:

 

<?php

select_store($_GET['store_id']);

?>

 

[cooldude832]

using returns

<?php
function select_store($store_id){
$store_info_query = mysql_query('SELECT * FROM `store` WHERE ID = ' . $store_id . '');
$store_info = mysql_fetch_row($store_info_query);
return $store_info;
}
$store_id = $_GET[store_id];
$store_info = select_store($store_id);
?>

[envexlabs]

my function.php is a seperate file that is included in index.php

 

i think thats where the variable is getting lost.

[cooldude832]

try me method it shouldn't matter if its a separate file, plus mine is easy for reusablilty which is the definition of functions

[pocobueno1388]

my function.php is a seperate file that is included in index.php

 

i think thats where the variable is getting lost.

 

That shouldn't matter if you are including it in the file your using (which you have to be doing). So thats not the problem.

 

Cooldude832's method should work good for you....

[envexlabs]

worked like gang busters.

 

i guess i messed something up when i was testing.

 

Thanks!

[cooldude832]

for added safety use this:

 

using returns

<?php
function select_store($store_id){
$store_id = mysql_escape_string($store_id)
$store_info_query = mysql_query("SELECT * FROM `store` WHERE ID = '$store_id' ");
$store_info = mysql_fetch_row($store_info_query);
return $store_info;
}
$store_id = $_GET[store_id];
$store_info = select_store($store_id);
?>

[cooldude832]

other wise a person could say || '' and cheat the system

[envexlabs]

so for every mySQL query i execute, should i use mysql_escape_string?

[marcus]

For ever variable that will be executed in your mySQL queries.

[cooldude832]

for your WHERE type logic especially on login scrips beceause a user can say for password || '' and as long as the username was valid they get logged in

[envexlabs]

thanks!