Can't take data from mysql while using $citizenid

Question

so i can't take data from mysql when i put into the query $citizenid, who returns the unique 8 digits code of a member and if i'm using $citizenid it only returns the citizenid from database, but if i put that manually, its working just perfect, any ideas?

$con=mysqli_connect("localhost","ye","yeye","yeeee");

if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

// $records = mysqli_query($con,"select * from players where `citizenid` = '$citizenid'"); // Not working
$records = mysqli_query($con,"select * from players where `citizenid` = 'YHN76994'");
while($row = mysqli_fetch_array($records)) 
echo "<h3>". $row['name'] ."</h3>";
mysqli_close($con);

In this context I do not think ``$citizenid`` is initialized. — Dula, Oct 13 '21 at 22:46
If you echo `$citizenid`, or the SQL string that includes `$citizenid`, what do you get? It must be different from the other query you're sending. — Willis Blackburn, Oct 13 '21 at 22:47
**Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) — Dharman, Oct 13 '21 at 22:48
Obligatory _"use [prepared statements with parameter binding](https://www.php.net/manual/mysqli.quickstart.prepared-statements.php)"_ — Phil, Oct 13 '21 at 22:49
_"if i'm using $citizenid it only returns the citizenid from database"_... this sounds like you have a record in your table with both `name` and `citizenid` equal to `$citizenid`. Check your data — Phil, Oct 13 '21 at 22:52
Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking. — Community, Oct 15 '21 at 08:45

score -2 · Answer 1 · answered Oct 14 '21 at 01:58

In your current code you never assigned anything to $citizenid As there is no code example how you get your $citizenid variable assigned.. So here is a code example how it should be done.

<?php
define('DB_HOST', 'localhost');
define('DB_NAME', 'yeeee');
define('DB_CHARSET', 'utf8');
define('DB_USER', 'ye');
define('DB_PASSWORD', 'yeye');

try{
  $con = new PDO(
    "mysql:host=" . DB_HOST . ";charset=" . DB_CHARSET . ";dbname=" . DB_NAME,
    DB_USER, DB_PASSWORD, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, PDO::ATTR_EMULATE_PREPARES => false]
  );
}catch(Exception $ex){
  print_r($ex);
  die();
}

if (isset($_POST['citizenidBTN'])){
    
    $id = $_POST["citizenid"];
    $sql = "SELECT * FROM players WHERE citizenid = '$id'";
    $query = $con -> prepare($sql);
    $query->execute();
    $results = $query->fetchAll(PDO::FETCH_OBJ);                                   
    if($query->rowCount() > 0){
        foreach($results as $result){
            echo $result->name;
        }
    }
}

?>

<form method="post">
    <label for="citizenid">CitizenID</label>
    <input type="text" id="citizenid" name="citizenid">
    <button type="submit" name="citizenidBTN">Post</button>
</form>

or if you're working with $_SESSION

<?php
define('DB_HOST', 'localhost');
define('DB_NAME', 'yeeee');
define('DB_CHARSET', 'utf8');
define('DB_USER', 'ye');
define('DB_PASSWORD', 'yeye');

try{
  $con = new PDO(
    "mysql:host=" . DB_HOST . ";charset=" . DB_CHARSET . ";dbname=" . DB_NAME,
    DB_USER, DB_PASSWORD, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, PDO::ATTR_EMULATE_PREPARES => false]
  );
}catch(Exception $ex){
  print_r($ex);
  die();
}


$id = $_SESSION["player"]["citizenid"];
$sql = "SELECT * FROM players WHERE citizenid = '$id'";
$query = $con -> prepare($sql);
$query->execute();
$results = $query->fetchAll(PDO::FETCH_OBJ);                                   
if($query->rowCount() > 0){
    foreach($results as $result){
        echo $result->name;
    }
}

?>

Can't take data from mysql while using $citizenid

1 Answers1