ban or unban based on get method

[RogueDogg]

here are my 2 urls:

<?PHP echo '<a href=refsearch.php?rid='.$row['rid'].'ban=1>Ban</a>'; ?>

<?PHP echo '<a href=refsearch.php?rid='.$row['rid'].'ban=0>UnBan</a>'; ?>

Here is my statement:

$banned=$_GET['rid'];
$ban=$_GET['ban'];
if (!empty($banned)) {
$update = "UPDATE referrals set banned='$ban' WHERE rid='$banned'";
$result = mysql_query($update) or die(mysql_error());

The only part that seems to be working at this point is setting the banned status to 0, once set to 0 I click on "ban" to set it back to 1 and it's not working, it says it is based on my echo but it's not updating it to 1 in the db.

[cameraman]

zero is considered empty(). If you're trying to make sure the parameter was supplied, use isset() [us2.php.net]. Check for 0 or 1 explicitly.

[janharders]

is it a typo or did you miss a & or ; in
rid='.$row['rid'].'ban=

?

[RogueDogg]

K this is the fix:

<a href=refsearch.php?rid='.$row['rid'].'&ban=1>Ban</a>'; ?>

had to add & before the word ban in the url.

should have paid closer attention before posting...sorry :-)

[eelixduppy]

Make sure to also check for correct input, and sanitize if needed. Since they are both integers from what I can see, you should add something like this which type-casts to an integer in the case whee its not:

$banned = (int)$_GET['rid']; 
$ban = (int)$_GET['ban'];

>> is it a typo or did you miss a & or ; in

Nice catch :)

[RogueDogg]

Is there a proper way to santize for other methods other than int, such as varchar or ?

[eelixduppy]

Yes, use mysql_real_escape_string. It's not "sanitizing" however it is escaping the data from the query, at least.