Question

Hi I am trying to display specific entries in a database by appending the variable name to a URL like:

echo '<td><a class="index_table" href="includes/view.php?id=$row[id]>$row[Orderno]">

and then in my view.php I have:

<?php
include 'connect.php';
//Display the Data//
$id=$_GET['id']; 
$result=mysql_query("select * from Products where ID=$id");
$row=mysql_fetch_object($result);
echo "<table>";
echo "
<tr bgcolor='#f1f1f1'><td><b>ID</b></td><td>$row->ID</td></tr>

However the specific ID is not being passed to the script, and the table in view.php is blank. When changing the where clause to ‘where id = ‘1’ the correct product displays. So I know that this is working.

Many Thanks

Answer 1

Basic PHP syntax: Strings quoted with ' do not interpolate variable values:

echo '<td><a class="index_table" href="includes/view.php?id=' . $row['id'] . '>' . $row['Orderno'] . '">';
                                                            ^^^^^^^^^^^^^^^^^^

note that you’re wide open to SQL injection attacks and are just begging to get your server pwn3d.