Question

im learning php and to keep it simple (i think), this is what im trying to do below.

–Work so far:

I made a small mini form and what i want to do is that when the person enters their email address, that a few things happen:

1. display a dummy message with actual first name based on database info gotten from email entered.
2. delete DB row based on email entered.

the process page that comes next has a custom message like ” hello NAME HERE, sorry to see you go blah blah”

Now i havent written the account deletion part because im getting an error. i don’t get syntax or any other errors in DW or Aptana..just when i test.
the error that i receive is: Notice: Use of undefined constant mysqli_error – assumed ‘mysqli_error’ in line 32 which is this line that has

$sn_nameQueryStringResults = mysqli_query($connect2db, $sn_nameQueryString) or die( "Sorry but theres a connection to database error" . mysqli_error);

this is what i have so far for the form:

<form method="post" action="snDelAcc_proc.php">
<table width="500" border="0">
    <tr>
        <td>Enter your email address here:</td>
        <td>
        <input type="text" name="accDel" width="250" >
        </td>
    </tr>
    <tr>
        <td>
        <input type="submit" name="submit">
        </td>
    </tr>

</table>

and this is the process page:

<?php




// - - connect to db.
$connect2db = mysqli_connect('127.0.0.1','root','passhere','dbtest');
if(!$connect2db){
    die("Sorry but theres a connection to database error" . mysqli_error);
}

//get emailfrom first page.
$emailaddy = $_POST['accDel'];


$sn_nameQueryString = " SELECT FROM email_list WHERE email = '$emailaddy'";




$sn_nameQueryStringResults = mysqli_query($connect2db, $sn_nameQueryString) or die( "Sorry but theres a connection to database error" . mysqli_error);




//get the name with fetch
$actualFnameGet = mysqli_fetch_array($sn_nameQueryStringResults);
//$sn_query = " DELETE FROM email_list WHERE email= ";


echo $actualFnameGet['firstname'];


?>

any ideas as to why im wrong?
Im a bit lost, thanks in advance.

Answer 1

First of all, your error can’t be printed because mysqli_error is a function, so you have to write mysqli_error().

Second, you have an error in your query: Either enter all the fields you want or simply a *:

SELECT * FROM email_list WHERE email = ...

Last but not least, your query is very vulnerable to sql injections by putting the post variable $emailaddy directly into the query without escaping it, so you should use:

"SELECT * FROM email_list WHERE email = '".mysqli_real_escape_string($emailaddy)."'";