populate a switch statement with database stuff

[surrealillusions]

Hi all,

I'm trying to populate a switch statement using data from a database.

This is what I tried, but it kept throwing errors. As it is, it says theres an unexpected T_INCLUDE, expecting a } instead. Put the switch line after the includes, and it says unexpected while, expecting a } again.

What am I doing wrong? Is it possible to do this?

<?php
switch($_GET['item']) {

// Connect to the database here
include 'config.php';
include 'opendb.php';

while ($info = mysql_fetch_array( $data )){

$title = $info['title'];
$desc = $info['description'];
$id = $info['id'];

case $id;
$header = $title;
$description = $desc;
break;
}
mysql_close($conn);

default:
$header = "No item selected";
$description = "Nothing selected!";
// In the strange case that something is there that shouldn't be, the program will execute the code that's here.
}
?>

[blang]

You shouldn't have anything inside the switch block except case statements. You're trying to do a bunch of database stuff just inside the switch block. Either do this before the switch statement or within one of the case statements.

// connect to the database here 
// 
// switch block 
switch($somevar) { 
 case "option1": 
 // pull data from the db based on "option1" 
 break; 
 case "option2": 
 // pull data from the db based on "option2" 
 break; 
 default: 
 // do something else 
} 

[rocknbil]

Your while is nested in your switch, which may or may not be syntactically correct, but it's downright confusing. :-) Also a case, like a terniary statement, is delimited with a colon, not a semicolon(note your "case $id;")

// Connect to the database here 
include 'config.php'; 
include 'opendb.php'; 
while ($info = mysql_fetch_array( $data )){ 
 $title = $info['title']; 
 $desc = $info['description']; 
 $id = $info['id']; 
 switch($_GET['item']) { 
 case $id: 
 $header = $title; 
 $description = $desc; 
 break; 
 default: 
 $header = "No item selected"; 
 $description = "Nothing selected!"; 
 } 
} 
mysql_close($conn); 

But a case structure is generally used for a list of cases. With only two conditions, you might be better off doing this:

// Connect to the database here 
include 'config.php'; 
include 'opendb.php'; 
while ($info = mysql_fetch_array( $data )){ 
 $header = (isset($info['title']))?$info['title']:'No Item Selected'; 
 $description = (isset($info['description']))?$info['description']:'Nothing Selected!'; 
} 
mysql_close($conn); 

Finally, it looks like you're getting one item with $_GET['item']. If this is the case, a while is not necessary.

// Connect to the database here 
include 'config.php'; 
include 'opendb.php'; 
$info = mysql_fetch_array( $data ); 
mysql_close($conn); 
$header = (isset($info['title']))?$info['title']:'No Item Selected'; 
$description = (isset($info['description']))?$info['description']:'Nothing Selected!'; 

[surrealillusions]

Thanks for the replies.

I have solved this in a different way to what i was originally thinking.

Basically get the url variable (which is a number), then get the result from the database by that id number, which should only be 1 result, then display the database rows from that id onto the page.

Is there any security issues with this? I did a bit of testing, like adding random characters, and this error appears

Unknown column 'lkajfdsg' in 'where clause'

Same goes for no variable added onto the page,

Nothing selected.
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

The 'nothing selected' is what i have put into the script if nothing is found for a number that isnt in the database.

[rocknbil]

Is there any security issues with this? I did a bit of testing, like adding random characters, and this error appears

Unknown column 'lkajfdsg' in 'where clause'

Well you still haven't shown us how you're compiling your initial select, and that's where the error is. :-) Somehow you're entering the form/query string input as a column name, not a column value.

If this is your intent- to select a column name - there are some security issues with that, never reveal your table structure in any way. Simply solved with a conversion hash/associative array; if this is the case, we can show samples.

For the immediate problem at hand, first look at this:

Same goes for no variable added onto the page, Nothing selected.

Look at your program; this is expected behavior if nothing is entered, it's doing exactly what you tell it to:

$_GET['item'] = '' you entered nothing.

Whatever your select is, it's selecting "where (whatever) is nothing", at least, I think it is.

This returns no results from the DB. So $title and $description are never set:

$description = (isset($info['description']))?$info['description']:'Nothing Selected!';

Perfect, as far as I can see. Now apply that to the first problem: you entered random characters. Since you're probably looking for a number here, the default behavior of most programming languages is to interpret "text" as "0" (zero.) So in effect, when you enter random characters, it should give you the same result, "Nothing selected" because none of the values should be zero (all this is speculation without the initial select.) The fact that it doesn't tells us you have something wrong with that initial select.

But if you want to be specific, and it's always good to be specific, if you're expecting a number, make sure it is:

if (! preg_match('/^\d+$/',$_GET['item'])) {
header("content-type:text/html\n\n");
echo "Program halted, invalid data requested.";
exit;
}

There is a number test in PHP, I just prefer regexps.

Show us the initial select . . .