Checking querystring values in PHP

Question

http://localhost/?area=characters&name=Michal+Stroganof



$result = mysql_query("SELECT * from players WHERE name = '$_GET[name]'");

while ($row = mysql_fetch_assoc($result)) {

    echo "Name: " .$row['name']. "<br>";
    echo "Level: " .$row['level']. "<br>";

}

This is all code of my characters.php

If the get variable "name" is not included in the URL i want to show a search form that searches the table players. How would I do this?

Read on about SQL injections: unixwiz.net/techtips/sql-injection.html — BalusC
– BalusC, Commented Nov 16, 2009 at 23:01
It is probably the case that your example is just for simplicity's sake, but if it is live code please research SQL Injection and Prepared Statements. — Rob Drimmie
– Rob Drimmie, Commented Nov 16, 2009 at 23:01
use an input function to filter input and avoid sql injection type problems, as well as escaping the input when it gets put into the sql, as jheddings mentions above! never trust user data. — Kzqai
– Kzqai, Commented Nov 16, 2009 at 23:02

jheddings · Accepted Answer · 2009-11-16 22:56:53Z

9

Do you mean just to change your SQL string like so?

$sql = 'SELECT * from players';
if (isset($_GET['name'])) {
    $safename = mysql_real_escape_string($_GET['name']);
    $sql .= " WHERE name='$safename'";
}
$result = mysql_query($sql);

Be sure to sanitize your SQL!

answered Nov 16, 2009 at 22:56

jheddings

27.7k10 gold badges58 silver badges68 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Paige Ruten · Accepted Answer · 2009-11-16 23:03:09Z

5

Use isset():

if (isset($_GET['name'])) {
    // your above code
} else {
    // display form        
}

edited Nov 16, 2009 at 23:03

answered Nov 16, 2009 at 22:56

Paige Ruten

177k37 gold badges183 silver badges199 bronze badges

Comments

Percutio · Accepted Answer · 2009-11-16 23:00:30Z

1

Quick and dirty:

<?php
if (!isset($_GET['name']))
{
    echo  '<form action="'. $_SERVER['PHP_SELF'] .'" method="GET">'
         .'<input type="text" name="name" />'
         .'</form>';
}
else
{
    // your current code that queries your database here
}
?>

answered Nov 16, 2009 at 23:00

Percutio

9547 silver badges8 bronze badges

Collectives™ on Stack Overflow

Checking querystring values in PHP

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related