ok im going crazy

[Odoggy5]

I know I'm missing something small, somebody help please!

<?
$field=$_GET['field'];
include("dbinfo.inc.php");
mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
$query='SELECT * FROM `memfiles` WHERE `field` = \'$field\' '; 
$result=mysql_query($query);
$num=mysql_numrows($result); 
mysql_close();

$i=0;
while ($i < $num) {
$field=mysql_result($result,$i,"field");
$definition=mysql_result($result,$i,"definition");
$file=mysql_result($result,$i,"file");
?>

<form action="updated.php">
<input type="hidden" name="ud_field" value="<? echo "$field"; ?>">
Definition: <input type="text" name="ud_definition" value="<? echo "$definition"?>"><br>
File: <input type="text" name="ud_file" value="<? echo "$file"?>"><br>
<input type="Submit" value="Update">
</form>

<?
++$i;
} 
?>

The URL I am sending is "//hostname/update.php?field=cnfg10", I keep coming up with a blank webpage and I have data for "cnfg10" in my db.

I'm thinking to do what I am doing here I have to use a field type of INT? In my MySQL DB? I don't know just a shot in the dark I guess?

[teknomage1]

Shouldn't this line

PHP Code:

$query='SELECT * FROM `memfiles` WHERE `field` = \'$field\' '; 


look like this instead

PHP Code:

$query=sprintf("SELECT * FROM `memfiles` WHERE `field` = '%s'", $field); 


The main thing is $field won't get interpolated into a single quoted string, use sprintf or double quotes.

[Odoggy5]

cool, that totally worked. I just looked that sprintf up, very cool. So basically I represented my field "$field", with %s a string. Thank you much!

[redhead]

Or perhaps simply just:

PHP Code:

$query="SELECT * FROM `memfiles` WHERE `field` = \'$field\' "; 


[sde]

i guess it's all the same thing, but the original code just had single quotes inside single quotes which seemed to be the problem, so you could really just use double quotes like in red's last example and shouldn't have to escape the single quotes after that.

backticks arouind table names is proper i believe, but i haven't found that they are necessary unless you have a table name with spaces ( i think )

i'm too lazy to check, but if you escape single quotes when they don't need to be escaped, will that generate an error?

most of my queries are formatted in this style:

PHP Code:

 $query="SELECT * FROM memfiles WHERE field = '{$field}' ";