Question

I have the following PHP script :

 <?php
       $all_threads=mysql_query("SELECT * FROM forum_threads WHERE category=$_GET[id]");

       if($all_threads){ ?>
            //Do something.
     <?php
       }
       else { ?>
            //Do something else
      <?php
       } ?>

The table forum_threads is empty, so the query should return ‘false’ according to the documentation at http://php.net/manual/en/function.mysql-query.php and the ‘else’ block should get executed. However, strangely, the if-block is getting executed. How come?

Answer 1

It will return a MySQL resource, not FALSE on 0 rows. It will return FALSE on a query error.

You can check mysql_num_rows() instead. It will be 0 if there were no rows returned.

You also have a SQL injection vulnerabilities. Escape the GET param with mysql_real_escape_string().

If you can, just ditch mysql_*() and use PDO.