Question

I am trying to display an entry from a MySql database which is selected by GET data.

if (isset($_GET["id"])){

        $id=$_GET["id"];
        $result = getSelectedBlog($id); 

        while($row = mysqli_fetch_array($result))
            { 
                extract($row); 
                ?>

                    <div class="headline"><?php echo $headline ?></div>
                    <div class="subtitle"><?php echo $subTitle ?></div>
                    <div class="content"><?php echo $content ?></div>
                    <?php
            } 

Here is the SQL statement:

function getSelectedBlog($id){

$con = mysqli_connect('localhost', 'root', '', 'michaelWebsite') or die('could not connect');
$sql = 'SELECT * FROM tblArticle WHERE tblArticle.articleID LIKE "$id"';
$result = mysqli_query($con, $sql) or die('entry does not exist.:' . mysqli_error($con)); 
return $result; 

}

As you can see, I am passing the get data as $id to the method that returns the result. However nothing is being returned. There are three entries at the moment, if I change $id in the SQL statement to either 1, 2 or 3 it will show the corresponding data but it just will not work with the $id variable.

The URL does end with the correct info ?id=1.

Please excuse me if it is something stupid, I have just been stuck on this for hours now!!

Answer 1

All of these answers will solve your problem, but none have mentioned or prevented SQL Injection.

In your case I recommend (assuming articleID is an integer field).

$sql = 'SELECT * FROM tblArticle WHERE tblArticle.articleID LIKE "' . (int)$id . '"';

I’m also curious why you are using LIKE for an id field.

Note: Since you are using MySQLi, I’d encourage you to look at prepared statements.