PHP using $_GET['id'] to display database information [closed] - php

Question

Closed. This question is not reproducible or was caused by typos. It is not currently accepting answers.
This question was caused by a typo or a problem that can no longer be reproduced. While similar questions may be on-topic here, this one was resolved in a way less likely to help future readers.
Closed 5 years ago.
Improve this question
I'm trying to build a forum with PHP and PDO at the moment and I have a link which takes you to the page for a category with the categories ID in the URL (eg. WEBSITE/category.php?id=1). When I get there, I want to display the name of the category you are looking at using this $_GET information, but it won't seem to do it for me.
Here is what I've got:
<?php
include 'dbconfig.php';
include 'header.php';
$sql = "SELECT cat_id, cat_name, cat_description FROM categories WHERE cat_id = " . $_GET['id'];
$query = $DB_con->prepare($sql);
$query->execute();
$numRows = $query->fetchColumn();
if (!$query) {
echo 'Something went wrong whilst getting the category from the database.';
} else {
if ($numRows == 0) {
echo 'Sorry, this category does not exist';
} else {
while($catRow = $query->fetch(PDO::FETCH_ASSOC)){
echo $catRow['cat_name'];
}
}
}
include 'footer.php';
?>
So as you can see, I have tried to make a while loop that creates an array using PDO::FETCH_ASSOC allowing me to print category details, but when I go to the page nothing shows up except the header.php and the footer.php. There also aren't any errors that come up. Can anybody see what I'm doing wrong? Or let me know if there's information that I have left out. Thanks.

Answer 1

The problem is with $numRows PDOStatement::fetchColumn does not count the rows that are in the result set. There is PDOStatement::rowCount for that.
As for the sql injection, It is not so much the class or functions you use that make it save, but the way you use the functions. To read more about it go here (link was in the top link in related for me)
Applying what we just learned to your code will give us something like this:
$sql = "SELECT cat_id, cat_name, cat_description FROM categories WHERE cat_id = :id"; // Parameterize query to prevent sql injection
$query = $DB_con->prepare($sql);
$query->execute([":id" => $_GET['id']]); // Binding parameter(s), could also be done using bindParam
$results = $query->fetchAll(PDO::FETCH_ASSOC); // For later use
$numRows = $query->rowCount();
if ($query->errorCode() == "00000") { // I don't think that PDOStatement ever fails to be created, so $query would never not be set
echo 'Something went wrong whilst getting the category from the database.';
} else {
if ($numRows == 0) {
echo 'Sorry, this category does not exist';
} else {
foreach ($results as $category){
echo $category['cat_name'];
}
}
}
Note that the way I bind my parameters (in the execute) is my preferred way, not nessesarily the best way