Help with youtube video

im trying to display youtube video on my site using php

[riggerz29]

Hi all ive made some code to display a list of videos when they click on the link it passes the value of video to the master page where i then have some code to display the youtube video i have stored in my database i only have the youtube video id stored but its not working here is my code

<?php

if (!$_GET['video']) {
} else {
$video_id = ereg_replace("[^0-9]", "", $_GET['video']); // filter everything but numbers & letters for security
}

$sqlCommand = "SELECT videoid, title FROM tv WHERE tvid='$video_id' AND showing='1' ORDER BY tvid DESC LIMIT 1";
$query = mysqli_query($myConnection, $sqlCommand) or die (mysqli_error());

$watch = '';
while ($row = mysqli_fetch_array($query)) {
$videoid = $row['videoid'];
$title = $row['title'];

$watch .='<table width="95%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td align="center" valign="top">&nbsp;<table width="100%" border="0" cellpadding="0" cellspacing="0" class="video_Player">
<tr>
<td align="center" valign="top"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="409" colspan="2" align="center" valign="bottom"><object width="640" height="385">
<param name="movie" value="http://www.youtube.com/v/'.$videoid.'=en_GB&fs=1&rel=0&color1=0x3a3a3a&color2=0x999999&hd=1" />
<param name="allowFullScreen" value="true" />
<param name="allowscriptaccess" value="always" />
<embed src="http://www.youtube.com/v/'.$videoid.'=en_GB&fs=1&rel=0&color1=0x3a3a3a&color2=0x999999&hd=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="385"></embed>
</object></td>
</tr>
<tr>
<td width="20" height="41" align="left" valign="middle">&nbsp;</td>
<td width="658" align="left" valign="middle" class="video_txt">'. $title .'</td>
</tr>
</table></td>
</tr>
</table></td>
</tr>
</table>';

}
mysqli_free_result($query);

?>

any help would greatly be appriciated

[riggerz29]

For some reason it seems to be working now i havent changed a thing

[rocknbil]

Well, something I see right off:

ereg_replace("[^0-9]", "", $_GET['video']);

First, ereg is deprecated and will be eliminated in v6, use preg_replace() instead.

Second, your comment there is incorrect - this only filters anything NOT a number. If this is intended behavior, fine, but to filter only letters and numbers you need to add A-Z with the "i" (case insensitive) operator. Also 0-9 and \d are synonymous.

preg_replace("/[^A-Z\d]/i", "", $_GET['video']);
preg_replace("/[^A-Z0-9]/i", "", $_GET['video']);

"If it works it works" but I always suggest using SwfObject [code.google.com] for inserting video as the old school embed-inside-object is invalid html.