Forum Moderators: coopster
I am working on a project but got stuck at what seems to be a really simple thing. But I am a beguinner at PHP and I just cant figure out how to solve this.
I have a page where I have a dynamically generated product list. Each product has a checkbox. The checkboxes has the following variables:
name="prod[]" value="<?php echo $row_articles['unique'] type="checkbox"
That form seems to be working fine. However, I want to send this form to another page. On that page I want to print, not the unique ID that are being transferred from the form, but the product title of all the selected products on the previous page. Here is the code that I have put on the second page:
<html>
<head>
<title>Page title</title>
<?php
$arts = $_POST[prod];
$length = count($arts);
$query_products = "SELECT title FROM articles WHERE unique = 'mysql_fetch_array($arts)'";
$products = mysql_query($query_products) or die(mysql_error());
?>
</head>
<body>
<?php
for($i=0; $i < $length; $i++) {
$row = mysql_fetch_array($products);
print_r($row);
}
?>
This code doesnt print anything. If I enter echo $products in the body I get Resource id #3 but as soon as I use the mysql_fetch_array I get nothing. Does the Resource id #3 mean there is something or would this also show if the value was empty? Where am I going wrong?
The way you have it set up, $_POST['prod'] gives you an array of unique ids.
mysql can look for a column matching an array, but it wants the array to be a comma separated list. You can do something like this:
$arts = implode(',',$_POST['prod']);
$arts = mysql_real_escape_string($arts);
The first line turns the array into a comma separated string: 10,20,25,30
The second one immunizes you from sql injection - you should get into the habit of doing that to all POST or GET values (well, to ones that will be used in queries and such - generically, you should always make sure that data you get back doesn't have any surprises).
Now you can structure your query like this:
$query_products = "SELECT title FROM articles WHERE unique IN ($arts)";
The above assumes that unique is numeric. If it's not, each of the values needs to be surrounded by quotes like you have in your posted sql. To get that, you'd modify the implode:
$arts = implode("','",$_POST['prod']);
That first parameter is a double quote, single quote, comma, single quote, double quote.
That gets you to 10','20','25','30
You'd still need single quotes at the beginning and end, so you could either concatenate them on or just take care of it in the sql:
$query_products = "SELECT title FROM articles WHERE unique IN ('$arts')";
The resource id means that mysql didn't have any problems with the query - it may not have any data, but there's no problems. To make your scripts more robust, you can use a structure similar to:
if($result = mysql_query($sql)) {
if(mysql_num_rows($result) {
// do stuff
} // EndIf have row(s) of data
else {
// do other stuff
} // EndElse no records match
} // EndIf query worked
else {
echo mysql_error(); // report the error (during debugging, do something more elegant later)
} // EndElse problem in query
[edited by: cameraman at 10:43 am (utc) on Feb. 9, 2007]
Welcome to Webmaster World. :)
$arts is an array and cannot be accessed how you are using it. If you echo it directly you will see simply 'Array', which is why your query is failing. Try something like this:
$query_products = "SELECT title FROM articles WHERE unique IN(".implode(",",$arts).");
$products = mysql_query($query_products) or die(mysql_error());
while ($row=mysql_fetch_array($products))
{
echo $row->product;
}
Assuming product is your product field name.
dc
edit: cameraman, you beat me to it.:)
..mysql_fetch_object($products))
dc
Assuming product is your product field name.
Please bare with me, this is all very new to me ;)
I was assuming the field you wanted displaying was called 'product'. Looking through the info, maybe its called 'title'? Just change the name to the correct field name when you do the loop. And don`t use the class operator unless you call the data using mysql_fetch_object. Should be a numerical or associative array if using mysql_fetch_array. That was a little mistake on my part, sorry.
Oh and as cameraman pointed out, using IN asumes your unique data is numeric.
dc
<?php
$arts = implode("','",$_POST['prod']);
$arts = mysql_real_escape_string($arts);
$query_products = "SELECT title FROM articles WHERE unique = ('$arts')";
$products = mysql_query($query_products) or die(mysql_error());
?>
<?php
while ($row = mysql_fetch_object($products))
{
echo $row -> title;
}
?>
If it doesn't then add this line right after real_escape_string:
echo "I'm looking for $arts <br />";
so that you can make sure your data is the way you're expecting back from the form.
I'm looking for 089u0j\',\'9u98hj\',\'34vg35
(yes, these are the correct values)
<?php
$arts = stripslashes(implode("','",$_POST['prod']));
$arts = mysql_real_escape_string($arts);
$query_products = "SELECT title FROM articles WHERE unique = ('$arts')";
echo "<p>The query: $query_products</p>\n";
$all = mysql_query("SELECT title,unique FROM articles");
for($i = 0; $i < 3; $i++) {
$row = mysql_fetch_object($all);
echo "<p>Title: " . $row->title . "<br />unique: " . $row->unique . "</p>\n";
} // EndFor get 3 articles
echo "<hr>\n";
mysql_free_result($all);
$products = mysql_query($query_products) or die(mysql_error());
?>
<?php
while ($row = mysql_fetch_object($products))
{
echo $row -> title;
}
?>
Try that. You should see the query as it's been built, then the first three records from the table, just to make sure they're stored as expected.
The query: SELECT prodtitel FROM articles WHERE uniktid = ('089u0j\',\'9u98hj\',\'34vg35')
Title:
unique: 089u0j
Title:
unique: 9u98hj
Title:
unique: 34vg35
Here is the output, I messed it up, sorry:
The query: SELECT prodtitel FROM articles WHERE uniktid = ('089u0j\',\'9u98hj\',\'34vg35')
Title: asdklfjkl
unique: 089u0j
Title: asfjaslj ljk
unique: 9u98hj
Title: sadlfkl
unique: 34vg35
<?php
while ($row = mysql_fetch_object($products))
{
echo $row -> title;
}
?>
So do this:
$arts = implode(",",$_POST['prod']);
$arts = mysql_real_escape_string($arts);
$arts = str_replace(",","','",$arts);
First line will get you:
089u0j,9u98hj,34vg35
Second line will have no effect unless someone's trying to sql inject you.
Third line will get you:
089u0j','9u98hj','34vg35
which is what we want.
Thank you so much for helping me through this.
You guys rule!
