// All good they are logged in, send them to homepage then exit script
include_once 'profile.php?test=$id';
does this send them to the homepage?
diafol
Rhod Gilbert Fan (ardav)
7,792 posts since Oct 2006
Reputation Points: 1,170
Solved Threads: 1,080
don't you need to do this:
header("Location: profile.php?test=$id");
instead?
diafol
Rhod Gilbert Fan (ardav)
7,792 posts since Oct 2006
Reputation Points: 1,170
Solved Threads: 1,080
Well, I suppose if the error code comes from it, it would be a good idea, yes.
diafol
Rhod Gilbert Fan (ardav)
7,792 posts since Oct 2006
Reputation Points: 1,170
Solved Threads: 1,080
perhaps your id options are a bit extreme. You only needd to check if it's an integer. SO you could use
if(is_int($_GET['id']))
and the rest is a bit verbose:
$sql = mysql_query("SELECT * FROM user_info WHERE id='$id' LIMIT 1");
$existCount = mysql_num_rows($sql);
if ($existCount == 0) {
echo '<h3>Error: The user you are trying to access does not exist in our system. Press back.</h3>';
exit();
}
while($row = mysql_fetch_array($sql)){
$username = $row["username"];
$balance = $row["balance"];
}
how about:
$sql = mysql_query("SELECT * FROM user_info WHERE id=$id LIMIT 1");
if(mysql_num_rows($sql) > 0){
$row = mysql_fetch_array($sql)){
$username = $row["username"];
$balance = $row["balance"];
}else{
echo '<h3>Error: The user you are trying to access does not exist in our system. Press back.</h3>';
}
diafol
Rhod Gilbert Fan (ardav)
7,792 posts since Oct 2006
Reputation Points: 1,170
Solved Threads: 1,080
SELECT * FROM user_info WHERE id=$id LIMIT 1
run that in phpmyadmin and substitute $id for a real integer.
Also you can echo the query:
echo "SELECT * FROM user_info WHERE id=$id LIMIT 1";
to see if anything looks weird.
Is the table actually called user_info. Is the field actually id. In your connection details, are you sure you've connected to the right DB.
diafol
Rhod Gilbert Fan (ardav)
7,792 posts since Oct 2006
Reputation Points: 1,170
Solved Threads: 1,080
OK, that means the $id isn't getting passed. It's getting lost somewhere along the line.
You've got this variations on this operation twice:
$id = preg_replace('#[^0-9]#i', '', $id);
just do this once:
$id = intval($_GET['id']);
to force $id to an integer OR
test for an integer with:
if(is_int($_GET['id'])){
...
}
diafol
Rhod Gilbert Fan (ardav)
7,792 posts since Oct 2006
Reputation Points: 1,170
Solved Threads: 1,080
Use either the intval or the is_int. The first forces any old input to an integer, while the second checks to see if the value is an integer, that way you can decide whether you want to proceed or not. Your choice - but I usually use is_int.
I'd still echo the query just to ensure that you're getting the $id in there.
diafol
Rhod Gilbert Fan (ardav)
7,792 posts since Oct 2006
Reputation Points: 1,170
Solved Threads: 1,080
$sql = mysql_query("SELECT * FROM user_info WHERE id='$id' LIMIT 1");
if(mysql_num_rows($sql) > 0){
It suggests that the SQL is all wrong. For now hard-code a value into the SQL for $id:
$sql = mysql_query("SELECT * FROM user_info WHERE id=1 LIMIT 1");
if(mysql_num_rows($sql) > 0){
That will give you details for user #1. See if it works. If it doesn't and user #1 exists, your user_info table or id field is misspelt. OR you've connected to the wrong DB.
diafol
Rhod Gilbert Fan (ardav)
7,792 posts since Oct 2006
Reputation Points: 1,170
Solved Threads: 1,080
Yep, you should see the id=.. in the address bar if your are redirecting.
diafol
Rhod Gilbert Fan (ardav)
7,792 posts since Oct 2006
Reputation Points: 1,170
Solved Threads: 1,080