Still need some help

[Parker Clack]

I have a link that I am using to call on a php file with an id in it. For some reason the external file doesn't get the id.

If I use http://www.myplace.com/my.php?do=edit&id=133

and I have in my php file

if ($_REQUEST['do'] == 'edit') {

  $ba = $db->query("SELECT * FROM " . TABLE_PREFIX ."mytable WHERE id='$id'");

The value of the id doesn't make it to the php file and I get a database error at id=.

Any ideas what has changed in 3.51 that the file doesn't get the id number? It used to work in 2.xx just fine.

Thanks,
Parker

[tnguy3n]

and what's the variable $id in your script?

[Marco van Herwaarden]

It should at least be $_REQUEST['id'], but using it like this in a query, will open your script to SQL insertions.

You should really consider sanatizing the input before using it.

[Parker Clack]

the variable id comes from the link after the do=edit.

Marco:

So something like

$ba = $db->query("SELECT * FROM " . TABLE_PREFIX ."mytable WHERE id=$_Request['id']");

[tnguy3n]

TRY:

PHP Code:

$vbulletin->input->clean_array_gpc('r', array('id' => TYPE_INT));

$ba = $db->query("SELECT * FROM " . TABLE_PREFIX ."mytable WHERE id = '" . intval($vbulletin->GPC[id]) . "'");