Question

I want to do a really simple task: check if an inserted id matches one found in a mysql database. If no match, an alert box will appear displaying an invalid id message. The problem that I have is my script ALWAYS returns found, even if the id does not exist in the database. Here is my script, any idea what is wrong?

PHP SCRIPT:

<?php
//connect to server....

$id = $_GET["id"];

$query = 'SELECT * from users where id = $id';
$result = mysql_query($query) or trigger_error(mysql_error().$query);

if (empty($result))
{
$response = "notfound";
echo $response;
}
else
{
$response = "found";
echo $response;
}


// Close connection to the database
mysql_close($con);
?>

Answer 1

Try:

$query = 'SELECT * from users where id = '.(int) $id;
$result = mysql_query($query) or trigger_error(mysql_error().$query);
$num_rows = mysql_num_rows($result);
if($num_rows > 0) {
echo "found";
}
else {
 echo "not found";
}