Question

I want to add an edit button for a script called spiral url, but the problem is that I can’t get the URL id. This is what I’ve tried:

/** get url id **/
$id = isset($_GET['id']) ? $_GET['id'] : '';
@mysql_query("UPDATE short_urls SET long_url = 'test' WHERE url_id = '".$id."' LIMIT 1");

What am I doing wrong?

Also I emailed the author and his response:

“I recommend you post on Stackoverflow – https://stackoverflow.com/.
I would love to help you but I don’t see what you are doing wrong. I’m still learning PHP as well.”

Answer 1

1. You’re wide open to SQL injection attacks.
2. You’re supressing errors with the @ operator. NEVER suppress errors
3. You’re not checking the return value of mysql_query(), which returns a boolean FALSE on failure.

Scrap that code and use this:

if (!isset($_GET['id'])) {
    die("missing query parameter");
}
$id = intval($_GET['id']);
if ($id === '') {
    die("Invalid query parameter");
}
$sql = "UPDATE short_urls SET long_url = 'test' WHERE url_id=$id LIMIT 1";
$result = mysql_query($sql);
if ($result === FALSE) {
    die("Mysql error: " . mysql_error() . $sql);
}

Note that I’m assuming that the id parameter is numeric. If it’s not, then remove the intval() stuff.