CODEWITHSUNDEEP
phpmysql
mrpatg
mrpatg

Reputation: 10117

select and echo a single field from mysql db using PHP

Im trying to select the title column from a particular row

$eventid = $_GET['id'];
$field = $_GET['field'];
$result = mysql_query("SELECT $field FROM `events` WHERE `id` = '$eventid' ");
echo $result;

all i get is Resource id #19

How should i do this? What is best method?

Upvotes: 16

Views: 138701

Answers (4)

dfilkovi
dfilkovi

Reputation: 3091

$eventid = $_GET['id'];
$field = $_GET['field'];
$result = mysql_query("SELECT $field FROM `events` WHERE `id` = '$eventid' ");
$row = mysql_fetch_array($result);
echo $row[$field];

but beware of sql injection cause you are using $_GET directly in a query. The danger of injection is particularly bad because there's no database function to escape identifiers. Instead, you need to pass the field through a whitelist or (better still) use a different name externally than the column name and map the external names to column names. Invalid external names would result in an error.

Upvotes: 13

TheGrandWazoo
TheGrandWazoo

Reputation: 2897

Read the manual, it covers it very well: http://php.net/manual/en/function.mysql-query.php

Usually you do something like this:

while ($row = mysql_fetch_assoc($result)) {
  echo $row['firstname'];
  echo $row['lastname'];
  echo $row['address'];
  echo $row['age'];
}

Upvotes: 4

Ben
Ben

Reputation: 11208

And escape your values with mysql_real_escape_string since PHP6 won't do that for you anymore! :)

Upvotes: 1

Franz
Franz

Reputation: 11553

Try this:

echo mysql_result($result, 0);

This is enough because you are only fetching one field of one row.

Upvotes: 19

Related Questions