来自MySQL的MySQL查询和直接来自PHPMyAdmin的不同MySQL行为

Question

I am using a PHP file to return a JSON array to an iOS app. The table that is being consulted has only 32 records. If I execute the iOS app, it receives an empty array when calling the PHP file. If I execute the PHP on the web browser, the result is also an empty array. If I run the query that is included in the PHP file directly in PHPMyAdmin, the query shows the correct result.

This is the PHP file:

<?php
$host= 'localhost';
$db = 'app_mujer';
$uid = 'XXXXXXXXXXXX';//
$pwd = 'XXXXXXXXXXXX';
$link = mysql_connect($host,$uid,$pwd) or die("No se puede conectar ");
mysql_query("SET NAMES 'utf8'");
mysql_select_db($db) or die ("No se puede seleccionar la bbdd");
$id= urldecode($_GET['id']);
$arr = array();
$rs = mysql_query("SELECT * FROM tbcoordenadas where titulo='$id'");
while ($obj = mysql_fetch_assoc($rs)){  
$arr[] = $obj['procedencia'];
}
echo json_encode($arr);
?>

I have detected that the problem occurs only when the URL parameter get by $id contains a '& character in it.

If I run the following query directly at PHPMyAdmin, the result is the expected record:

SELECT * 
FROM  `tbcoordenadas` 
WHERE  `titulo` =  'D & R'

Any help is welcome.

Answer 1

I have detected that the problem occurs only when the URL parameter get by $id contains a '& character in it.

That's where the problem is.

http://www.example.com/example.php?id=1&2&3

For this request, the value of $_GET['id'] will be 1 (and you would expect it to be 1&2&3 ). This is because the & symbol is used to add another URL parameter.

Since the value includes & , you need to urlencode() the ID before sending it to the PHP script. As pointed out by @Jared Farrish, this should be done on every GET value (to prevent problems such as this one).