Question

I’m trying to look up user’s username using $_GET but not actually seing the result of the query. Here’s the code:

<?php
$host     = "localhost";
$username = "root";
$password = "toor"; // :)
$database = "db";

$link = mysql_connect($host, $username, $password);
if(!$link){
    exit('Could not connect to database: '. mysql_error());
}

$email = mysql_real_escape_string(htmlspecialchars(stripslashes($_GET["e"])));

$query = "SELECT username FROM cc_card WHERE email = '$email'";

$result = mysql_query($query);
if(mysql_num_rows($result)){
    $user = mysql_fetch_assoc($result);
    echo $user['username'];
} else {
    echo "Something's wrong";
}

it’s only returnung “Something’s wrong”. I wanted it to display the username field of the cc_card table where email = email. What am I doing wrong?

Answer 1

If you’re getting “Something’s wrong” from the posted code it means nowhere in the cc_card table does the email column match the email value you specify in your query.

You need to verify that the contents of your sanitized $email variable do, in fact, exist somewhere in the table. Try:

} else {
  echo "Something's wrong";
  var_dump($email);
}

To see the contents of the sanitized $email variable and manually query the database from the shell (or phpmyadmin or whatever) to find whether the value you’re specifying exists or not. I’m betting it doesn’t exist.