基于$ _GET结果执行MYSQL查询

Question

When a user clicks an item on my items page, it takes them to blank page template using $_GET to pass the item brand and model through.

I'd like to perform another MYSQL query when that user clicks through to populate the blank page with the product details from my database. I'd like to retrieve the single row using the model number (unique ID) to populate the page with the information. I've tried a couple of things but am having a little difficulty.

On my blank item page, I have

                $brand = $_GET['Brand'];
                $modelnumber = $_GET['ModelNumber'];

                $query = mysql_query("SELECT * FROM items WHERE `Model Number` = '$modelnumber'");
                $results = mysql_fetch_row($query);

                echo $results;

I think having ''s around Model Number is causing troubles, but without them, I get a Warning: mysql_fetch_row() expects parameter 1 to be resource, boolean given error.

My database columns looks like

Brand | Model Number | Price | Description | Image

A few other things I have tried include

$query = mysql_query("SELECT * FROM item WHERE Model Number = $_GET['ModelNumber']");

Which gave me a syntax error. I've also tried concatenating the $_GET which gives me a mysql_fetch_row() expects parameter 1 to be resource, boolean given error

Which leads me to believe that I'm also going about displaying the results incorrectly. I'm not sure if I need to put it in a where loop like I have with my previous page which displays all items in the database because this is just displaying one.

Answer 1

First, notice the first comment on your question. You definitely want to add some sort of sanitation, mysql_real_escape_string at the very least, although PDO or Mysqli would be preferred.

Second, before getting a real answer to your question, let's get some more information about your error.

Try the following:

$brand = mysql_real_escape_string($_GET['Brand']);
$modelnumber = mysql_real_escape_string($_GET['ModelNumber']);

$query = mysql_query("SELECT * FROM items WHERE `Model Number` = '$modelnumber'")OR die(mysql_error());
$results = mysql_fetch_row($query);

var_dump($results);

mysql_error tell us what is going on behind the scenes.

Answer 2

It seems that your "result" is pulling in too much information for a single variable. Also, I don't think your table should have column names with spaces, I would suggest filling them all with dashes or underscores.

Here's my suggestion:

$qry = mysql_query("SELECT * FROM items WHERE Model_Number = '$modelnumber'"); //REMEMBER TO MAKE THE CHANGE "Model Number" -> "Model_Number"
while($row = mysql_fetch_array($qry)){
    $brand = $row['Brand'];
    $modelnumber = $row['Model_Number'];
    $price = $row['Price'];
    $description = $row['Description'];
    $image = $row['Image'];
}

This will populate all of these variables with whatever you have in your tables.

Answer 3

If you are using mysql_fetch_row it will only returns a numerical array of strings that corresponds to the fetched row, or FALSE if there are no more rows http://php.net/mysql_fetch_row

If you need to retrieve the data inside that row. You need to use mysql_fetch_array()

also try using mysql_error();

 $results = mysql_fetch_row($query) or die(mysql_error());

you will see the error output produce by your code