Reputation: 291
i am makin a quiz in php and mysql . now i am fetching the questions from database, suppose if i don't know the no of questions in the datbase. i want my code to fetch the data till questions are not over, but i don't the no of questions which are there . so which condtion will be applicable . code which is fetching data .
<?php
function ravi($qid=NULL)
{
$con = mysql_connect('localhost', 'root', '') or die(mysql_error());
$db = mysql_select_db('quiz', $con) or die(mysql_error());
$q="select * from question where qno=$qid";
$rq=mysql_query($q,$con);
if(!$rq)
{
echo " the sql query faiiled to work ";
}
else
{
while ($sub_row=mysql_fetch_array($rq))
{
$id=$sub_row["qno"];
$question=$sub_row["question"];
$option1=$sub_row["option1"];
$option2=$sub_row["option2"];
$option3=$sub_row["option3"];
$option4=$sub_row["option4"];
echo "<h5>Q".$id." : ".$question."</br></h5>";
echo"</br>
<br>
<h4><input type= radio id='1' name=\"{$id}\" value=\"{$option1}\">$option1</h4>
</br>
<h4><input type= radio id='2' name=\"{$id}\" value=\"{$option2}\">$option2</h4>
</br>
<h4><input type= radio id='3' name=\"{$id}\" value=\"{$option3}\">$option3</h4>
</br>
<h4><input type= radio id='4' name=\"{$id}\" value=\"{$option4}\">$option4</h4>
</br></br>";
}
}}
?>
Upvotes: 0
Views: 76
Reputation: 2279
To enhance security greatly you should use mysqli
which is using prepared statements (auto-escaped typecasted variables), PHP webpage.
Something like this:
# Database credentials
$mysqlsrv = "localhost";
$mysqlusr = "myusr";
$mysqlpsw = "mypsw";
$mysqldb = "mydb";
# Connect to database in the secure "prepared statement" way
$mysqli = new mysqli($mysqlsrv,$mysqlusr,$mysqlpsw,$mysqldb);
# Check for database connection errors
if(mysqli_connect_errno()) {
echo "Cannot connect to database";
exit();
}
$searchNum = 1;
$searchStr = "Text";
$query = "SELECT question FROM mytable WHERE num=? OR str=?";
if($stmt = $mysqli->prepare($query)) {
$stmt->bind_param("is",$searchNum,$searchStr);
$stmt->execute();
$stmt->bind_result($question);
if($stmt->fetch()) {
while($stmt->fetch()) {
echo "$question<br />";
}
} else {
echo "Could not find any post in table";
} // if($stmt->fetch())
$stmt->close();
} // if($stmt = $mysqli->prepare($query))
Upvotes: 0
Reputation: 657
if (mysql_num_rows($rq) == 0) {
echo "database is empty.";
}
But you really should stop using mysql_*
as has been said in the comments.
Upvotes: 2