Member Avatar for sedalnas

Hi , i'm trying to add a hyperlink in the php code , the "href" of the hyperlink is the books names generated from the db but i want to the clicked link to show the relative book description and the book's image in another page but i don't know how to get and passes the clicked book's name to another to make a sql statement that generate relative description .

Edited by sedalnas because: n/a
  • 2 Contributors
  • 1 Reply
  • 127 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by cossay

Dani AI

Generated

wanted to pass the clicked book link to another page and show its description/image. correctly shows the basic idea (put an identifier on the link and read it on the detail page). The important improvements to add now are: validate the incoming value, use prepared statements (avoid SQL injection), escape output (prevent XSS), and use modern APIs (PDO or mysqli) because the old mysql_* functions are removed in current PHP.

Here is a minimal, safer pattern for the list page (generate links) and the detail page (validate, fetch, display). Replace the DSN/credentials and table/column names to match your schema.

<?php
// list.php - fetch id+title and output safe links
$pdo = new PDO('mysql:host=localhost;dbname=yourdb;charset=utf8mb4','user','pass');
$stmt = $pdo->query('SELECT id, title FROM books ORDER BY title');
echo "<ol>\n";
while ($r = $stmt->fetch(PDO::FETCH_ASSOC)) {
    $id = rawurlencode($r['id']);
    $title = htmlspecialchars($r['title'], ENT_QUOTES, 'UTF-8');
    echo "<li><a href=\"book.php?id=$id\">$title</a></li>\n";
}
echo "</ol>\n";
?>
<?php
// book.php - validate input, prepared statement, safe output
$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if (! $id) { header('HTTP/1.1 400 Bad Request'); exit; }

$pdo = new PDO('mysql:host=localhost;dbname=yourdb;charset=utf8mb4','user','pass');
$stmt = $pdo->prepare('SELECT title, description, image_path FROM books WHERE id = :id LIMIT 1');
$stmt->execute([':id' => $id]);
$book = $stmt->fetch(PDO::FETCH_ASSOC);
if (! $book) { header('HTTP/1.1 404 Not Found'); echo 'Not found'; exit; }

echo '<h1>'.htmlspecialchars($book['title'], ENT_QUOTES, 'UTF-8').'</h1>';
echo '<p>'.nl2br(htmlspecialchars($book['description'], ENT_QUOTES, 'UTF-8')).'</p>';
if (!empty($book['image_path'])) {
    $img = htmlspecialchars($book['image_path'], ENT_QUOTES, 'UTF-8');
    echo "<img src=\"$img\" alt=\"".htmlspecialchars($book['title'], ENT_QUOTES, 'UTF-8')."\">";
}
?>

Notes: prefer numeric IDs for lookup; if you need SEO-friendly titles, generate a unique slug and query by the slug instead of raw title text. Always sanitize output with htmlspecialchars, validate inputs with filter_input, and use prepared statements. See PDO::prepare and htmlspecialchars for details.

Member Avatar for cossay

Assume the name of your database is books and that it contains a table called book with the following field names book_id, title, description, picture.
The most important part of the code is in bold

Here is the code for the first page called books.php

<?php
$connection = mysql_pconnect("localhost", "root", "man") or die("Connection failed. ".mysql_error());
mysql_select_db("books") or die("Unable to select database.".mysql_error());

//Fetch books from the book tables
$query = "SELECT * FROM book";
$result = mysql_query($query) or die("Unable to process query. ".mysql_error());

//Display books as list
echo "LIST OF BOOKS AVAILABLE";
echo "<ol>";
	while($mybooks = mysql_fetch_object($result))
	{
		echo "<li>[B]<a href = 'description_page.php?book=".urlencode($mybooks->book_id)."'>$mybooks->title</a>[/B]</li>";
	}
echo "</ol>";

?>

The code for the second page, description_page.php is shown below

<?php
$connection = mysql_pconnect("localhost", "root", "man") or die("Connection failed. ".mysql_error());
mysql_select_db("books") or die("Unable to select database.".mysql_error());

echo "BOOk DESCRIPTION<br>";
//Now the value you passed from the other page is contained in $_GET['book']
//Now you can use this value to query your database for any information about 
//the books in your database as follows
$id = $_GET['book'];
$query = "SELECT * FROM book WHERE book_id = '$id' LIMIT 1";
$result = mysql_query($query) or die("Error processing query. ".mysql_error());
$book_returned = mysql_fetch_object($result);
echo "<table width = '400' border = '1'>";
	echo "<tr>";
		echo "<td colspan = '2'>".$book_returned->title."</td>";
	echo "</tr>";
	echo "<tr>";
		echo "<td>".$book_returned->picture."</td>";
		echo "<td>".$book_returned->description."</td>";
	echo "</tr>";
echo "</table>";




?>
Edited by cossay because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.