Display value from database in a form value fields

Question

I've been trying to display data from database as value in a form field. But the system keep saying there's an error at "while($row = mysql_fetch_array($result))" .. So im a bit confuse here . How can i fix this error . Below is my codes.

<?php
if (isset($_GET['serialno'])){

    echo '<form action="update.php" method="post">';
    echo '<br>';
    echo '<input type="hidden" name="serialno" value="'. $_GET['serialno'] .'">';

    $con = mysql_connect("localhost","root","");
    if (!$con){
        die('Could not connect: ' . mysql_error());
    }

    mysql_select_db("sys", $con);

    $id=$_GET['serialno'];
    $result = mysql_query("SELECT * FROM main WHERE serialno = $id");

    while($row = mysql_fetch_array($result)){
        echo'Date: '.'<input type="text" name="date" value="'. $row['date'] .'">'; 
        echo '<br>';
        echo'Work Description: '.'<input type="text" name="desc" value="'. $row['desc'].'">';
        echo '<br>';
        echo'Company Name: '.'<input type="text" name="comp" value="'. $row['comp'] .'">'; 
        echo '<br>';

        echo '<input name="save" type="submit" value="Save" />';
    }

    echo '</form>';
}
?>

Can anyone help me .. Really appreciate it .

`echo mysql_error();` before `while` would tell you if the query is failing. — AyB, Apr 13 '14 at 12:22
Your code is vulnerable to SQL injections. You should read on [how to prevent them in PHP](http://stackoverflow.com/q/60174/53114). — Gumbo, Apr 13 '14 at 12:34
thank u everyone .. and thanks for the link .. it helps me lot improving my code :) — zara, Apr 13 '14 at 12:41

Jonan · Accepted Answer · 2014-04-13T12:37:54.067

3

You forgot the single quotes around $id in you query, if you add them it will work.

$result = mysql_query("SELECT * FROM main WHERE serialno = '$id'");

It's smart to add or die(mysql_error()) behind mysql_query(), so you can see where the error is.

Also, if someone typed in ' OR 1='1 as serialno, your script will select all the rows in the database and then display them all. You can prevent this by changing $id= $_GET['serialno']; to $id=mysql_real_escape_string($_GET['serialno']);

edited Apr 13 '14 at 12:37

answered Apr 13 '14 at 12:32

Jonan

2,485
3
24
42

thanks .. how could i forget that simple thing .. no wonder it didnt work .. thank u so much .. it finally working .. i have also add echo mysql_error() – zara Apr 13 '14 at 12:39
you're welcome, still happens to me sometimes too :) – Jonan Apr 13 '14 at 12:40

Display value from database in a form value fields

1 Answers1