MySQL query and get id values

Question

Thanks for dropping by!

I am trying to do an e-commerce website for my school project. The purpose is to populate my webpages with content from the database and 1 specific conditional don't seem to be recorded for me to be able to pull the data out from the DB to be presented on the website:

One my main page I have this code on residing on a sidebar: which leads to a php page to retrieve all the products base on their product category

  <ul class="left_menu">
    <li class="odd"><a href="categories.php?catno=10familia">Familia Originals</a></li>
    <li class="even"><a href="categories.php?catno=20familia">Ready to Cook</a></li>
    <li class="odd"><a href="categories.php?catno=30familia">Siomai and Buns</a></li>
    <li class="even"><a href="categories.php?catno=40familia">Pork Snacks</a></li>
    <li class="odd"><a href="categories.php?catno=50familia">Ready Made Dishes</a></li>
  </ul>

and I have this code/page that will present the products base on their product category by using the (id)catno= to reference what category should be displayed.

// Sanitize the $_GET['catno'] and match with the correct category:
$sanitize = mysqli_real_escape_string($dbc, $_GET['catno']);

//match cases according to the product category
if ($sanitize == '10familia') {
$catid = 1;
} elseif ($sanitize == '20familia') {
$catid = 2;
} elseif ($sanitize == '30familia') {
$catid = 3;
} elseif ($sanitize == '40familia') {
$catid = 4;
} elseif ($sanitize == '50familia') {
$catid = 5;
} else {
$cat_error = '<div class="center"><h2>There are no products in this category. Please try again later.</h2></div>';
}
?>
<div class="center_content">
<div class="center_title_bar">Latest Products</div>
<div class="scroll_box_tall">
    <?
    $query = "SELECT product_id, name, price, thumbnail FROM products WHERE category_id = '$catid' ORDER BY product_id ASC";
    $request = mysqli_query($dbc, $query);

    if (mysqli_affected_rows($dbc) == 1) {
        while ($row = mysqli_fetch_array($request, MYSQLI_NUM)) {
            $item_id = $row[0]; // Assign product_id to $item_id to be passed on the href
            $item_name = $row[1]; // Assign name to var $item_name
            $item_price = $row[2]; // Assign price to var $item_price
            $item_thumb = $row[3]; // Assign thumbnail to $item_thumb
            // echo item name
            $div1 = '<div class="prod_box"><div class="top_prod_box"></div><div class="center_prod_box"><div class="product_title">' . $item_name . '</div>';
            // echo the thumbnail
            $div2 = '<div class="product_img"><a href="show_product.php?idno=' . $item_id . '"><img src="product/thumb/' . $item_thumb . '" alt="' . $item_name . '"/></a></div>';
            // echo the price
            $div3 = '<div class="prod_price"><span class="price">RRP &pound; ' . $item_price . '</span></div></div><div class="bottom_prod_box"></div></div>';
            echo "$div1$div2$div3";
        }
    } else { // Say an error message if there is no products in the category or the query is unsuccessful
        echo '<div class="center"><h2>There are no products in this category. Please try again later.</h2></div>';
    } ?>
</div>

The conditionals if/else are working fine and works perfectly in retrieving the products and showing it on the page. (categories($catid) 2,3,4,5 - are working fine if they're respective links are clicked) My main problem is that all the conditionals if/else records the value except from the first one:

if ($sanitize == '10familia') {
$catid = 1;
}

the value $catid= 1 is not being recorded for the query to pull all the products from category 1 in the database.

I don't know why this specific conditional won't work but the other four which are identical works..

Note: I just started php and I apologize if there is a better way to do the if-else and i did it with an if/elseif approach.

Thank you to all. :)

Answer 1

mysqli_real_escape_string($dbc,$string) is for cleaning on input. You don't want to use it prior to doing anything with it in PHP. It's specifically for MySQL which is why it requires a DB connection.

 $catno = $_GET['catno'];

Instead of if (which is still okay) you could use a switch() statement:

switch($catno){

  case '10familia':
    $catid = 1;
  break;

  case '20familia':
    $catid = 2;
  break;

  case '30familia':
    $catid = 3;
  break;

  case '40familia':
    $catid = 4;
  break;

  case '50familia':
    $catid = 5;
  break;

  default:
  $cat_error = '<div class="center"><h2>There are no products in this category. Please try again later.</h2></div>';
  $cat_id=-1;
  echo $cat_error;
}

I'm going to leave out the HTML parts of the code here for brevity.

Since we're not even using $catno for querying the DB there is no need to do a mysqli_real_escape_string() on it since we now have a var ( $cat_id ) that will potentially inserted into an SQL statement for the DB that we've set ourselves. This is normally where you would clean any user provided vars for insertion though.

Now we're going to see if that var is positive. We expect it to be negative if the previous var wasn't passed correctly.

if($cat_id > -1){

Just as a preference, I like to pull a count query to check simple things like existence of tables before I try to make MySQL jump through a lot of hoops to see if a join is going to fail way down the line. It's an extra query, but it can save a lot of overhead on massive queries with bad statments passed. It's also easier to hunt down too if you're not chasing a lot of cross table failures.

$count = mysql_result(mysqli_query($dbc, "select count(*) from products where category_id='$catid'"),0);

if ($count == 1){
$query = "SELECT product_id, name, price, thumbnail FROM products WHERE category_id = '$catid' ORDER BY product_id ASC";
$request = mysqli_query($dbc, $query);
while ($row = mysqli_fetch_array($request)) {

On these I like to actually set the names of the columns I'm pulling. once you're into larger tables this will help so you won't have to figure out what column 45 does. Also it makes it easier on the people who might work on this with you or inherit the project.

        $item_id = $row['product_id']; // Assign product_id to $item_id to be passed on the href
        $item_name = $row['name']; // Assign name to var $item_name
        $item_price = $row['price']; // Assign price to var $item_price
        $item_thumb = $row['thumbnail']; // Assign thumbnail to $item_thumb
        // echo item name

Something to get in the habit of is creating a new line after things like divs, this way you can troubleshoot your HTML code on the front end.

        $nl = "\n";

        $div1 = '<div class="prod_box">'.$nl.'<div class="top_prod_box"></div>'.$nl.'<div class="center_prod_box">'.$nl.'<div class="product_title">'.$item_name.'</div>'.$nl;
        // echo the thumbnail
        $div2 = '<div class="product_img"><a href="show_product.php?idno='.$item_id.'"><img src="product/thumb/'.$item_thumb.'" alt="'.$item_name.'"/></a></div>'.$nl;
        // echo the price
        $div3 = '<div class="prod_price"><span class="price">RRP &pound; ' . $item_price . '</span></div>'.$nl.'</div>'.$nl.'<div class="bottom_prod_box"></div>'.$nl.'</div>'.$nl;
        echo "$div1$div2$div3";
    }

} else { // Say an error message if there is no products in the category or the query is unsuccessful
    echo '<div class="center"><h2>There are no products in this category. Please try again later.</h2></div>';
} ?>

Answer 2

Just a guess because there's no information on your test data, but this looks suspect:

if (mysqli_affected_rows($dbc) == 1) {

This checks to see if exactly one row was returned by the query. Is it possible that your test data has one row for categories 2 through 5 and more than one row for category 1? Try changing the logic to this:

if (mysqli_affected_rows($dbc) > 0) {