PHP sql not getting output

Question

For some reason i am not getting an output from this code. Specifically from this if statement: I inserted an html tag with a test word, but it never appeared on the output. I fixed the "SELECT" typo.. still getting same results.. no output.. i think the problem is from this statement.

$db = new PDO("mysql:dbname=university", "root", "");

I inserted another test phrase right before it - success and another one right after it - didn't output

        if($sel=="getinfo"){
                    try {
                    $db = new PDO("mysql:dbname=university", "root", "");
                    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                    $rows = $db->exec("SEEELECT * FROM fminformationtable WHERE FM_ID = '$_POST[iden]'"); 
                    ?>
                    test
                    <?php
                    }

This is the full function

    if($sel=="addnew"){
    try {
                $db = new PDO("mysql:dbname=university", "root", "");
                $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                $rows=$db->query("INSERT INTO fminformationtable 
                VALUES('$_POST[iden]','$_POST[lname]','$_POST[fname]','$_POST[office]','$_POST[ext]','$_POST[hphone]','$_POST[mobile]','$_POST[address]','$_POST[email]','$_POST[syear]','$_POST[tyear]','$_POST[ldegree]','$_POST[ofrom]','$_POST[dyear]','$_POST[rinterest]')");

            }
            catch (PDOException $ex) {
            ?>
            <p>Your information has been submitted! </p>
            <?php
            }
            if($sel=="update"){


                try {
                    $db = new PDO("mysql:dbname=university", "root", "");
                    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);



                    $rows=$db->query("UPDATE fminformationtable SET
                     Office=`$_POST[office]`,
                     Extension=`$_POST[ext]`,
                     HomePhone=`$_POST[hphone]',
                     MobilePhone=`$_POST[mobile]`,
                     Adress=`$_POST[address]`,
                     Email=`$_POST[email]`,
                     StartingYear=`$_POST[syear]`,
                     TerminationYrear=`$_POST[tyear]`,
                     LatestDegree=`$_POST[ldegree]`,
                     ObtainedFrom=`$_POST[ofrome]`,
                     DegreeYear=`$_POST[dyear]`,
                     ResearchInterest=`$_POST[rinterest]`

                    ");

                    }


                catch (PDOException $ex) {


                }
        }
        }
         if($sel=="delete"){
            try {
                    $db = new PDO("mysql:dbname=university", "root", "");
                    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                    $rows = $db->exec("DELETE FROM fminformationtable WHERE FM_ID = '$_POST[iden]'"); 


            }
            catch (PDOException $ex) {

                }
        }

        if($sel=="getinfo"){
                    try {
                    $db = new PDO("mysql:dbname=university", "root", "");
                    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                    $rows = $db->exec("SEEELECT * FROM fminformationtable WHERE FM_ID = '$_POST[iden]'"); 
                    ?>
                    test
                    <?php
                    }

SEEELECT might be a typo ... it throws, which is never caught! — Eugen Rieck
– Eugen Rieck, Commented Dec 19, 2013 at 1:04
And injecting a POST variable directly in the query is a huge mistake. You need to read up on sql injection. As you are already using PDO, switching to prepared statements with bound variables is easy. — jeroen
– jeroen, Commented Dec 19, 2013 at 1:04
A side note, like @jeroen said, injecting a POST directly in your statment is a huge no-no ... No pun intended .. Or is there? — Zak
– Zak, Commented Dec 19, 2013 at 1:08

Sammitch · Accepted Answer · 2013-12-19 01:10:38Z

2

You're using backticks instead of single quotes.
You never once check your function returns to see if they've failed.
You're using try with empty catch blocks to simply discard any information that might be useful to know. For instance, the errors that are causing your code to not return any data.
SEEEELECT isn't a MySQL operation.
You can't expand array indexes inside a double-quoted string unless you use {$array['index']}

Suggestion: Write your code in chunks of 1-3 lines, test it, write another chunk, test it, and so on. This code looks like it's been written all in one untested shot.

Also: yadda yadda SQL injection, parameterized queries, and so on.

answered Dec 19, 2013 at 1:10

Sammitch

32.5k7 gold badges57 silver badges92 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP sql not getting output

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related