0

I need something simple; I have page where a user clicks an author to see the books associated with that author. On my page displaying the list of books for the author, I want a simple HTML title saying: 'The books for: AUTHORNAME'

I can get the page to display author ID but not the name. When the user clicks the link in the previous page of the author, it looks likes this:

<a href="viewauthorbooks.php?author_id=<?php echo $row['author_id']?>"><?php echo $row['authorname']?></a>

And then on the 'viewauthorbooks.php?author_id=23' I have declared this at the start:

$author_id = $_GET['author_id']; $authorname = $_GET['authorname'];

And finally, 'The books for: AUTHORNAME, where it says AUTHORNAME, I have this:

echo $authorname

(With PHP tags, buts its not letting me put them in!) And this doesnt show anything, however if I change it to author_id, it displays the correct author ID that has been clicked, but its not exactly user friendly!! Can anyone help me out!

5
  • Are you sure there is a value for $row['authorname']? How are you retrieving the author's name, from a database? Whats $_GET['authorname'] used for? Mar 16, 2010 at 17:39
  • In my authors table I have 'authorname' as a value, is this what you mean?
    – Yvonne
    Mar 16, 2010 at 17:40
  • I meant to say, are you sure the value from the table is being returned from your query? Can you perform a var_dump and see it is actually there. Mar 16, 2010 at 17:41
  • I have this as a query: $sql = "SELECT author_id, authorname FROM authors_tb WHERE author_id=".$author_id; Also, I'm not sure how to do a var_dump? I've never come across this before sorry :S
    – Yvonne
    Mar 16, 2010 at 17:44
  • It's okay, given by the responses below I have a better sense as to what you are asking. Also, everyone who has responded has given you an appropriate answer. Mar 16, 2010 at 17:45

4 Answers 4

0

You could pull the author_id from the query string as you did using $_GET but beware you will need to validate what is coming through by the query. I hope you can see that without validation how bad of a security hole this is.

I am at work at the moment, but this is a quick example that should give you what you need without sanitizing your query.

$id = intval($_GET['author_id']); 
// of course, perform more validation checks
// just don't assume its safe.
$sql = "SELECT authorname FROM authors_tb WHERE author_id=" . $id;
$result = mysql_query($sql);
while($row = mysql_fetch_array($result)) {
   echo "The books for: " . $row['authorname'];
 }

The reason why your approach wasn't working was because you utilize the $_GET URL parameter passing for author_name where you weren't supplying the parameters in the URL, just the author_id.

3
  • @Downvoter, what is wrong with the answer? I will be sure to revise. Mar 16, 2010 at 18:00
  • 1
    To make it $id = intval($_GET['author_id']); is just 8 characters longer. and you spent 10 times more for the useless comment instead. Ever consider than your code would be just copypasted? Mar 16, 2010 at 18:01
  • You are absolutely correct, I spent too much time editing the answer blabbing on about nothing in particular and missed out on the important parts. No argument there. I revised my answer to hopefully make up for it. Mar 16, 2010 at 18:04
0

You don't send it in the query string, thus you can't get it from the $_GET array.
Just request it from the database using id.

An important note: Always use htmlspacialchars() when you display the data, coming from the client side.

0

This is because you do not define the author name in your get.

You should make the following your url:

<a href="viewauthorbooks.php?author_id=<?php echo $row['author_id']?>&authorname=<?php echo $row['authorname']?>"><?php echo $row['authorname']?></a>

Or rather select the data from the database again, on the new page, using the ID you retrieved from the URI.

1
  • Thats what I'm trying to do (on the new page) with this: $sql = "SELECT author_id, authorname FROM authors_tb WHERE author_id=".$author_id" Have I got the gist of this wrong, or even the syntax?
    – Yvonne
    Mar 16, 2010 at 17:47
0

Author name won't be in $_GET. As your code stands, you only use it as the link title. It is no where in the address. Try this instead:

<a href="viewauthorbooks.php?author_id=<?php echo $row['author_id']?>&authorname=<?php echo $row['authorname']?>"><?php echo $row['authorname']?></a>

It would be better to re-request it from the database using the author_id though.

EDIT:

To explain the problem in more detail. You have two pages, the new.php page and the viewauthorbooks.php page. You're sending users from the new page to the view page using the link you posted, right?

The problem with that is, your link assigns one variable in get. Here's the query string it would generate:

viewauthorbooks.php?author_id=13

What that will do is send the user to viewauthorbooks and place the value '13' in the $_GET variable: $_GET['author_id']. That is why the author_id is there and displays on viewauthorbooks. However, authorname is never passed to viewauthorbooks, it isn't in $_GET['authorname'] because you never set $_GET['authorname']. If you want it to be in $_GET, then you need your query string to look like this:

viewauthorbooks.php?author_id=13&authorname=bob

You can accomplish that using the new HTML code for the link I posted above. Look at it closely, there's a key difference from the one you have now.

However, it is generally discouraged to pass data through GET, because the query string is displayed to the user and it leaves you open to injection attacks. A better way to do this would be to use the author_id you are already passing to viewauthorbooks.php to retrieve the authorname from the database again. You can use the same code you used on the new.php page.

2
  • Thats what I'm trying to do (on the new page) with this: $sql = "SELECT author_id, authorname FROM authors_tb WHERE author_id=".$author_id" Have I got the gist of this wrong, or even the syntax?
    – Yvonne
    Mar 16, 2010 at 17:49
  • 1
    Your select is fine, however, variables don't transfer across pages in php. You aren't passing the authorname value to the viewauthorbooks.php page anywhere. You need to send the authorname value to viewauthorbooks.php somehow. You can do it through $_GET by using the link I posted above. Or you could use the author_id and run that same query again on the viewauthorbooks.php page. Mar 16, 2010 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.