interface for editing a Mysql record, won't pass the entire string

[yankeesjtj]

I'll see if i can explain myself, as I've been beating my head against the wall for quite some time.

I have a database with info about EDI transactions, The info is entered on a few different days, day one when we send/receive an invoice, some info about it, and when its been acknowledged if its been accepted or declined. Thats all working hunky dory. its all singe word, date, etc stuff. However my last field is notes. The only time notes are entered is if something is declined. Then we enter a note saying what happened, what we did to fix it, etc. The insert part works with out a problem however, if i go through the interface i built to edit a current record, I have it pass all the current info back to the form all filled in. This works fine for every field but notes, it only passes back the first word of the string. For Example one of the notes will say something like "Resend from 4/10, declined because qty was wrong", When i go into edit mode it All the fields are filled in, but The notes field will only contain "Resend"

Here is the chunk of code that returns the value

<?
//gets the id of the record to edit
$cid= $_GET['p'];
//connects to DB
include 'library/config.php';
include 'library/opendb.php';
$query9 = "Select Notes FROM TL_Orders WHERE id=$cid";
$result9 = mysql_query($query9) or die("Error in query: $query9. ".mysql_error());
$row = mysql_fetch_array($result9, MYSQL_ASSOC);

echo "value =".$row['Notes']."></td> </tr>";
?>

I've tried using mysql_fetch_object, with the same result.. Any ideas would be great.

Thanks,

Jason

[yankeesjtj]

Never mind... figures after a couple days trying to get it.. i finally post something then figure it out LOL

<?
$cid= $_GET['p'];
include 'library/config.php';
include 'library/opendb.php';
$query9 = "Select Notes FROM TL_Orders WHERE id=$cid";
$result9 = mysql_query($query9) or die("Error in query: $query. ".mysql_error());
$row = mysql_fetch_object($result9);
$note= $row->Notes;

echo "value ='$note'>";

?>

[coopster]

Welcome to WebmasterWorld, yankeesjtj.

Glad you decided to post anyway because you really should be escaping your user-supplied input. Your query is ripe for a hack.
See mysql_real_escape_string [php.net] for the proper way to prepare your query with user-supplied input and if you have any questions about what you are reading you let let us know.