Tycoon Talk
Become a Big fish!
The number 1 forum for online business!
Post topics, ask questions, share your knowledge.
Tycoon Talk is part of Freelancer.com - find skilled workers online at a fraction of the cost.

PHP Forum


You are currently viewing our PHP Forum as a guest. Please register to participate.
Login



Freelance Jobs

Reply
mysql php displaying table info
Old 11-27-2010, 12:24 AM mysql php displaying table info
Junior Talker

Posts: 2
Name: Justin
Trades: 0
i have a database and have set up a login so that a person can update their current info.

i am using a login form so that the email address on fils will correspod with thenir login and will then generate all their info as values into the form that they will then edit to make current.

i cant get any thing to display though..
PS there will be a form in the bottom table

form

HTML Code:
<form name="login" method="post" action="update.php">
<table border="0" width="225" align="center">
<tr>
<td width="219" bgcolor="#999999">
<p align="center"><font color="white"><span style="font-size:12pt;"><b>Login First</b></span></font></p>
</td>
</tr>
<tr>
<td width="219">
<table border="0" width="220" align="center">
<tr>
<td width="71"><span style="font-size:10pt;">Email:</span></td>
<td width="139"><input type="text" name="email"></td>
</tr>
<tr>
<td width="71"><span style="font-size:10pt;">Password:</span></td>
<td width="139"><input type="password" name="password"></td>
</tr>
<tr>
<td width="71">&nbsp;</td>
<td width="139">
<p align="center"><input type="submit" name="submit" value="Submit"></p>
</td></tr></table>

php

PHP Code:
<?php 
      
if(isset($_POST['submit']))
      {
      if(isset(
$_GET['go']))
      
      
$email=$_POST['email'];
      
      echo 
$email;
      
      
//connect  to the database 
      
$db=mysql_connect ("localhost""username""password") or die ('I cannot connect  to the database because: ' mysql_error()); 
      
      
//-select  the database to use 
      
$mydb=mysql_select_db("apluslis_directory"); 
  
//-query  the database table 
      
$sql="SELECT * FROM providers WHERE  'email' = "$email ."";
      
      
//-run  the query against the mysql query function 
    
$result=mysql_query($sql);
    
    if(
mysql_num_rows($result) != 0){
    
     while(
$row=mysql_fetch_array($result)){ 
              
$company  =$row['company']; 
              
$lastname=$row['lastname']; 
              
$firstname=$row['firstname']; 
              
$category=$row['category'];
              
$city=$row['city'];
              
$state=$row['state'];
              
$email=$row['email'];
              
$website=$row['website'];
              
$phone=$row['phone'];
              
$description=$row['description'];
              
$keywords=$row['keywords'];
              
$logo=$row['logo'];
              
$discountcode=$row['discountcode'];
 echo
      
"<table cellpadding='1' border='3' align='center' bordercolor='#CC0000'>
       
      <tr><td rowspan='16' width='160'align='center' valign='middle'>" 
$logo "</td><td align='center' valign='middle'>" $company "</td> <td align='center' valign='middle'>" $category .  "</td> <tr>
      <tr><td align='center' valign='middle'>" 
$firstname .  " </td> <td align='center' valign='middle'>" $lastname .  " </td> <tr>
     
      <tr><td align='center' valign='middle'>" 
$city .  "</td><td align='center' valign='middle'>" $state .  "</td> <tr>
      <tr><td align='center' valign='middle'>" 
$phone .  "</td> <td align='center' valign='middle'>" $email .  "</td><tr>
      
      <tr><td align='center' valign='middle'>" 
$website .  "</td> <tr>
      <tr><td align='center' valign='middle'>" 
$discountcode .  "</td> <tr>
      <tr><td align='center' valign='middle'>" 
$description .  "</td> <tr>
      <tr><td align='center' valign='middle'>" 
$keywords "</td> <tr>
      </table align='center' valign='middle'>
      "
; }}}
?>

Last edited by justincase289; 11-27-2010 at 11:34 AM..
justincase289 is offline
Reply With Quote
View Public Profile
 
 
Register now for full access!
Old 11-27-2010, 12:39 AM Re: mysql php displaying table info
Backslider's Avatar
Experienced Talker

Posts: 40
Trades: 0
Delete this line:

PHP Code:
if(isset($_GET['go'])) 
I hope you are aware that your script is wide open to SQL injection, since you do not filter user input.
Backslider is offline
Reply With Quote
View Public Profile
 
Old 11-27-2010, 11:35 AM Re: mysql php displaying table info
Junior Talker

Posts: 2
Name: Justin
Trades: 0
im a noob idk what that mean s but i know its not good
justincase289 is offline
Reply With Quote
View Public Profile
 
Old 11-28-2010, 08:57 PM Re: mysql php displaying table info
Super Spam Talker

Posts: 879
Name: Paul W
Trades: 0
Injection means putting things into the form response that can cause queries to be, in effect, hijacked so that they do bad things. If you ask for a username and look up all records where user = 'username', then I might post as a username something like "'; DELETE FROM customers WHERE 1 '" Not nice!To avoid this, never put unvalidated/unprocessed user input into a query. Use mysql_real_escape_string on user input, for example.
PaulW is offline
Reply With Quote
View Public Profile
 
Reply     « Reply to mysql php displaying table info
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off





   
RSS Feed  Feeds: RSS   JS   XML
RSS Feed  Feeds for this forum: RSS   JS   XML



Page generated in 0.20174 seconds with 12 queries