mysql_num_rows works when it feels like it?

[law]

Well the title is kinda true.. here is what goes down.. (in my form processor) It retrieved the data with no issues.. it uses the UPDATE query perfectly ($row =1).. the problem is that if $row doesn't = 1.. it actually returns NO value @ all!! So all my code just craps out.. the }else{ statement that is supposed to make the query INSERT INTO never gets called.. in fact when i try to make it INSERT the entire page goes blank and only shows the background (the form dissappears) This is weird because the form isn't even in the php code its all written in html and is below the form processor (on the same page.. the form target is "self") 

 

Anyone see what im doing wrong here? Also PLEASE inform me if any thing im doing is not safe!! im a newbie and i need all the safety tips i can get!!

 

<?php
//==========================Form Processor============================
$listval1 = mysql_escape_string($_POST['list1']);
$listval2 = mysql_escape_string($_POST['list2']);
$urlval = mysql_escape_string($_POST['url']);
$titleval = mysql_escape_string($_POST['title']);
$captionval = mysql_escape_string($_POST['caption']);
$infoval = mysql_escape_string($_POST['info']);
if($listval1 != null){
for ($num=1;$num<10;$num++){
		if($listval1 == $num){
		$table = $urlname[$num];
		echo "$table";
		}
	}
if($listval2 != null){
	$listval2++;
	echo "$listval2";
			$row = 0;
			$query = "SELECT * FROM $table WHERE id='$listval2'";
			$sql = mysql_query($query) or die(mysql_error());
			$row = mysql_num_rows($sql) or die(mysql_error());
			echo "$row";
				if($row == 1){
					$updatequery = "UPDATE $table SET title='$titleval',url='$urlval',caption='$captionval',info='$infoval' WHERE id='$listval2'";
					$updatesql = mysql_query($updatequery) or die(mysql_error());
				echo"<div id='caption'><h2><font color='orange'>Updated $table data Sucessfully</font></h2></div>";
				}else{
				$insertquery = "INSERT INTO $table (title, url, caption, info) VALUES ('$titleval','$urlval','$captionval','$infoval')";
				$inssql = mysql_query($insertquery) or die(mysql_error());
				echo"<div id='caption'><h2><font color='orange'>Submitted $table data Sucessfully</font></h2></div>";
				}
			}
}
//----------------------------------------------------------------------------------------------------
?>

[bryan52803]

For fun, replace echo "$row"; with:

 

    echo "row=$row listval2=$listval2";

 

Make sure two things are happening. 1) that line is output 2) listval2 is a valid value

 

echo "$row"; is bad practice, because you don't know if the code's even getting there! You can't assume it's just empty because nothing shows up.

 

Bryan

[Barand]

$row = mysql_num_rows($sql) or die(mysql_error());

 

if $row == 0 (no recs found) the line above will cause the program to die with no error.

 

Don't "or die()" where 0 is a valid result and not an error

[law]

haha ooop i did not know = 0 was treated as failing

[unsider]

haha ooop i did not know = 0 was treated as failing

 

0 = false

1 = true

 

Boolean values....? should do some reading if you didn't know that.