2

If you don't want to get a full summary of what I'm trying to do skip to (Problem starts here)

I'm setting up my new site and came across a problem.

What I'm basically trying to do is to assign ads to specific countries. So for example if your from the UK you would be shown ads that we have in our UK inventory.

So I gathered some data from Google on how to detect a user's country based on their IP. I've made a function which does this perfectly.

$ip_address= $_SERVER['REMOTE_ADDR'];

function ip_location($ip){
    $parts = explode('.', $ip);
    $numeric_ip = $parts[3] + (256 * $parts[2]) + (256 * 256 * $parts[1]) + (256 * 256 * 256 * $parts[0]);

    $sql = "SELECT country FROM iptocountry WHERE lower_bound <= $numeric_ip AND upper_bound >= $numeric_ip LIMIT 1";
    $result = mysql_query($sql);
    $country = mysql_result($result, 0);
    return $country;
}

$country = ip_location($ip_address);
echo $country; // Always echos the correct country

(Problem Starts here)

So this function works fine. After making this function I created a MYSQL query which uses the data from that function to select an ad to show a user.

Here is where the problem starts.

When I type this query:

$sql = "SELECT *  FROM `nuevo__htmlad` WHERE `country` = 'united kingdom' AND `active` = 1 ORDER BY RAND() LIMIT 1";

using country = 'united kingdom' it works fine but when I put country = '$country'

Nothing works it never displays an ad.

Can anyone help me understand why this query doesn't work when I place the PHP variable inside it. This actually is the first time something this simple has troubled me so much.

Any help would be appreciated.

12
  • Start by printing your query echo $sql; and show us the result.
    – Tchoupi
    Jul 27, 2012 at 16:28
  • What @MathieuImbert said, but to clarify, show us what echo $sql shows in both the hard-coded country and the variable use.
    – Ally
    Jul 27, 2012 at 16:31
  • 1
    echo $sql; give this result SELECT * FROM nuevo__htmlad WHERE country = 'United Kingdom ' AND active = 1 ORDER BY RAND() LIMIT 1
    – That guy
    Jul 27, 2012 at 16:36
  • 2
    You have a space after your country name. Is that a typo?
    – Tchoupi
    Jul 27, 2012 at 16:44
  • 1
    php.net/ip2long ? Jul 27, 2012 at 16:45

5 Answers 5

1

I avoid this by using a PDO driver for working with databases. This allows me to use parameters and makes it easy to reuse sql statements. Check out this article for more information.

0
1

All of the code in the answers provided here contains SQL Injection vulnerabilities. You MUST escape the user input.

http://en.wikipedia.org/wiki/SQL_injection

1
0

After asking a few questions in the comments, it turned out that the $country variable contained and additional empty space.

OP fixed it using substr_replace ($country , '' , -1). I would personaly choose trim():

$sql = "SELECT *  FROM `nuevo__htmlad` WHERE `country` = '".trim($country)."' AND `active` = 1 ORDER BY RAND() LIMIT 1";
1
-1
$sql= "SELECT *  FROM nuevo__htmlad WHERE country='$country' AND active=1 ORDER BY RAND() LIMIT 1";

or this try this one also

$sql= "SELECT *  FROM nuevo__htmlad WHERE country='$country' AND active=1 LIMIT 1 ORDER BY RAND()";
3
  • You win a downvote for giving an example without proper SQL escaping.
    – tadman
    Jul 27, 2012 at 20:39
  • That in appropriate. I just provided a specific answer to a specific question. Jul 27, 2012 at 20:44
  • While that's technically correct, answers like these promote extremely dangerous habits.
    – tadman
    Jul 27, 2012 at 21:08
-1

try this one: I always use this style since country is a string

$sql= "SELECT *  FROM nuevo__htmlad WHERE country='".$country."' AND active=1 ORDER BY RAND() LIMIT 1";
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.