From: Scott Marlowe <scott.marlowe@gmail.com>
To: Marc Fromm <Marc.Fromm@wwu.edu>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: access data in php
Date: Fri, 2 Jan 2009 13:14:20 -0700
Message-ID: <dcc563d10901021214i77f91688i484ed3bfeb355dd8@mail.gmail.com> (raw)
In-Reply-To: <B0D7C0A3F35FE144A70312D086CBCA9B0213E18FC1@ExchMailbox2.univ.dir.wwu.edu>
References: <B0D7C0A3F35FE144A70312D086CBCA9B0213E18F15@ExchMailbox2.univ.dir.wwu.edu>
<alpine.DEB.2.00.0901021900580.1850@xigix.ioguix.net>
<dcc563d10901021028g3867def2p654d56099d177a5@mail.gmail.com>
<B0D7C0A3F35FE144A70312D086CBCA9B0213E18FC1@ExchMailbox2.univ.dir.wwu.edu>
On Fri, Jan 2, 2009 at 12:40 PM, Marc Fromm <Marc.Fromm@wwu.edu> wrote:
> This is my code:
> <?php
> $dbconn = pg_connect("host=localhost port=5432 user=postgres dbname=studentalerts");
>
> if(isset($_GET["value"])){
> $w_number=$_GET["value"];
> }
You need to scrub user input. use pg_escape_string($_GET['value'])
> //echo $w_number;
>
> $query = "select first_name, last_name, alert from alert_list where w_number='$w_number'";
> $result = pg_query($dbconn,$query);
> if (!$result) {
> echo "Problem with query " . $query . "<br/>";
> echo pg_last_error();
> exit();
> }
>
> $rows = pg_fetch_assoc($result);
Change this to
$rows = pg_num_rows($result);
> if ($rows==0){
> echo "There are no alerts for $w_number!\n\n";
> }else{
> $result = pg_query($dbconn,$query);
> $count=1;
> while ($row = pg_fetch_array($result)){
> echo "Alert $count: ";
> echo htmlspecialchars($row['first_name']) . " ";
> echo htmlspecialchars($row['last_name']);
> echo "\n";
> echo htmlspecialchars($row['alert']);
> echo "\n\n";
> $count++;
> }
> }
> if ($w_number==""){echo "Enter a W number!\n\n";}
> echo "End of line";
>
> pg_free_result($result);
> pg_close($dbconn);
> ?>
>
> -----Original Message-----
> From: Scott Marlowe [mailto:scott.marlowe@gmail.com]
> Sent: Friday, January 02, 2009 10:28 AM
> To: ioguix@free.fr
> Cc: Marc Fromm; pgsql-admin@postgresql.org
> Subject: Re: [ADMIN] access data in php
>
> On Fri, Jan 2, 2009 at 11:09 AM, <ioguix@free.fr> wrote:
>> pg_fetch_assoc behave like pg_fetch_array: it increments the internal
>> pointer to the current result.
>> So if you call it once, then pg_fetch_array will return the 2nd result
>> in the result set.
>
> Wow, I'm so used to seeing
>
> $rows = pg_num_rows() that that's what I saw up there.
>
--
When fascism comes to America, it will be draped in a flag and
carrying a cross - Sinclair Lewis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: scott.marlowe@gmail.com, Marc.Fromm@wwu.edu
Subject: Re: access data in php
In-Reply-To: <dcc563d10901021214i77f91688i484ed3bfeb355dd8@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox