Cannot call value from mysql - php

Question

I've tried many times to call the values but it's failed. Maybe my code is not perfect enough.
loginprocess.php //this is the process to call the value
<?php
include("connection.php");
$noic = mysql_real_escape_string($_POST['noic']);
$katalaluan = md5(mysql_real_escape_string($_POST['katalaluan']));
$query = mysql_query("SELECT * FROM daftar_pengguna WHERE noic = '".$noic."'
AND katalaluan = '".md5."'");
$count=mysql_num_rows($query);
if($count==0)
{
echo "Tiada rekod di jumpai.<br>";
echo "<a href='index.php'>Kembali</a>";
}
else
{
$row=mysql_fetch_array($query);
echo("<script>location.href = 'carianstatuspemohonresult.php?
id=$row[noic]';</script>");
}
?>
userinfo.php //this is to display the value
<?php
include ("connection.php");
$getId=$_REQUEST["id"];
$query= "SELECT * FROM daftar_pengguna WHERE noic='$getId'";
$result=mysql_query($query);
<table width="50%" border="1" align="center">
<?php
while($row=mysql_fetch_array($result))
{
?>
<tr>
<td align="center"><b>NAMA</b></td>
<td align="center"><?php echo $row["nama"];?></td>
</TR>
<TR>
<td align="center"><b>NO IC</b></td>
<td align="center"><?php echo $row["noic"];?></td>
</TR>
<TR>
<td align="center"><b>KATA LALUAN</b></td>
<td align="center"><?php echo $row["katalaluan"];?></td>
</TR>
<TR>
<td align="center"><b>JAWATAN</b></td>
<td align="center"><?php echo $row["jawatan"];?></td>
</tr>
<tr>
<td align="center"><b>PERINGKAT</b></td>
<td align="center"><?php echo $row["peringkat"];?></td>
</tr>
<tr>
<td align="center"><b>EMAIL</b></td>
<td align="center"><?php echo $row["email"];?></td>
</tr>
<?php } ?>
</td></table>
And sorry. I'm using mysql. Hope you can help me fix them even though I'm using the mysql. Also, hope you can understand the code without understanding the malay language.
Tell me if you need to see other code.
I've changed them. It's the same result. No values called. Hmmm.. :(

Answer 1

You create a md5 value from a posted value, but aren't including it in your WHERE clause... Try ...
$query = mysql_query("SELECT * FROM daftar_pengguna WHERE noic = '".$noic."'
AND katalaluan = '".$katalaluan."'");

Answer 2

You have two while fetching data on userinfo.php file:
while($row=mysql_fetch_array($result)){ // <- Remove this one
?>
<table width="50%" border="1" align="center">
<?php
while($row=mysql_fetch_array($result))
Later in the first file use proper quotes around "noic":
echo("<script>location.href = 'carianstatuspemohonresult.php?
id=$row['noic']';</script>"); //<-- noic => 'noic'
It seems that you have to remove the first one.
EDIT: Also, you should follow the #DuaneLortie solution and use the variable you've created in your query:
$query = mysql_query("SELECT * FROM
daftar_pengguna
WHERE noic = '".$noic."'
AND katalaluan = '".$katalaluan."'");
Your code has a sintax error. md5 is a function and you are using as a variable.
You should stop using mysql_* functions since it's deprecated in PHP 5.5 and removed in PHP 7. And finally, md5 hash isn't secure for hashing passwords. Use bcrypt instead.