user3117253
user3117253

Reputation: 1

PHP sql not getting output

For some reason i am not getting an output from this code. Specifically from this if statement: I inserted an html tag with a test word, but it never appeared on the output. I fixed the "SELECT" typo.. still getting same results.. no output.. i think the problem is from this statement.

$db = new PDO("mysql:dbname=university", "root", "");

I inserted another test phrase right before it - success and another one right after it - didn't output

        if($sel=="getinfo"){
                    try {
                    $db = new PDO("mysql:dbname=university", "root", "");
                    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                    $rows = $db->exec("SEEELECT * FROM fminformationtable WHERE FM_ID = '$_POST[iden]'"); 
                    ?>
                    test
                    <?php
                    }

This is the full function

    if($sel=="addnew"){
    try {
                $db = new PDO("mysql:dbname=university", "root", "");
                $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                $rows=$db->query("INSERT INTO fminformationtable 
                VALUES('$_POST[iden]','$_POST[lname]','$_POST[fname]','$_POST[office]','$_POST[ext]','$_POST[hphone]','$_POST[mobile]','$_POST[address]','$_POST[email]','$_POST[syear]','$_POST[tyear]','$_POST[ldegree]','$_POST[ofrom]','$_POST[dyear]','$_POST[rinterest]')");

            }
            catch (PDOException $ex) {
            ?>
            <p>Your information has been submitted! </p>
            <?php
            }
            if($sel=="update"){


                try {
                    $db = new PDO("mysql:dbname=university", "root", "");
                    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);



                    $rows=$db->query("UPDATE fminformationtable SET
                     Office=`$_POST[office]`,
                     Extension=`$_POST[ext]`,
                     HomePhone=`$_POST[hphone]',
                     MobilePhone=`$_POST[mobile]`,
                     Adress=`$_POST[address]`,
                     Email=`$_POST[email]`,
                     StartingYear=`$_POST[syear]`,
                     TerminationYrear=`$_POST[tyear]`,
                     LatestDegree=`$_POST[ldegree]`,
                     ObtainedFrom=`$_POST[ofrome]`,
                     DegreeYear=`$_POST[dyear]`,
                     ResearchInterest=`$_POST[rinterest]`

                    ");

                    }


                catch (PDOException $ex) {


                }
        }
        }
         if($sel=="delete"){
            try {
                    $db = new PDO("mysql:dbname=university", "root", "");
                    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                    $rows = $db->exec("DELETE FROM fminformationtable WHERE FM_ID = '$_POST[iden]'"); 


            }
            catch (PDOException $ex) {

                }
        }

        if($sel=="getinfo"){
                    try {
                    $db = new PDO("mysql:dbname=university", "root", "");
                    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                    $rows = $db->exec("SEEELECT * FROM fminformationtable WHERE FM_ID = '$_POST[iden]'"); 
                    ?>
                    test
                    <?php
                    }

Upvotes: 0

Views: 55

Answers (1)

Sammitch
Sammitch

Reputation: 32232

  1. You're using backticks instead of single quotes.
  2. You never once check your function returns to see if they've failed.
  3. You're using try with empty catch blocks to simply discard any information that might be useful to know. For instance, the errors that are causing your code to not return any data.
  4. SEEEELECT isn't a MySQL operation.
  5. You can't expand array indexes inside a double-quoted string unless you use {$array['index']}

Suggestion: Write your code in chunks of 1-3 lines, test it, write another chunk, test it, and so on. This code looks like it's been written all in one untested shot.

Also: yadda yadda SQL injection, parameterized queries, and so on.

Upvotes: 2

Related Questions