Question

I’ve been trying to figure out the best way to return an order from a database. I’ve come up with this, and it’s working the way I want (I think) it gives me the results I’m looking for but I wanted to know if its correct or if there is a better way.

<?php

$conn = mysql_connect('', '', ''); 
if (!$conn) 
{ 
die('Could not connect: ' . mysql_error()); 
} 
mysql_select_db($dbs, $conn);

$Order_ID = $_POST['Order_ID'];
//$Order_ID = '1001';

    $queryOrderHead = "SELECT * FROM Orders WHERE Order_ID = '$Order_ID' ";

    $queryOrderLines = "SELECT *

    FROM Order_LineDetails 
    WHERE Order_LineDetails.Order_ID = '$Order_ID'

";
        if ($queryRunHead = mysql_query($queryOrderHead)){

                while ($info_HEAD = mysql_fetch_array($queryRunHead))       
                {
                    $OrderID_HEAD = $info_HEAD['Order_ID'];         
                    $User_ID_HEAD = $info_HEAD['User_ID'];  
                    $Customer_ID_HEAD = $info_HEAD['Customer_ID'];                          
                    echo $OrderID_HEAD.' '.$User_ID_HEAD.' '.$Customer_ID_HEAD.'<br>';
                }

                $queryRunLines = mysql_query($queryOrderLines);
                while ($info = mysql_fetch_array($queryRunLines))       
                {
                    $OrderID = $info['Order_ID'];           
                    $OrderLineID = $info['OrderLineItem_ID'];           
                    echo $OrderID.' '.$OrderLineID.'<br>';
                }

        } else {
        echo mysql_error();         
        }

mysql_close($conn);
?>

So what it does, is it uses the Order_ID val from the $_POST and runs the first query then on success it uses the same Order_ID and loops the second query and gets all the Order_LineDetails from a different table.

Other than the mysql_real_escape() tags….

Any pointers or ideas???

Answer 1

Any pointers or ideas???

There’s nothing wrong with selecting the order first, then its items. However, you’d benefit from organizing the data into an array structure as well as following better naming conventions (both for variables and database schema):

$orderId = $_POST['order_id'];

// order_id should be an INT, so no quotes. 
// Also look into parameterized queries with PDO as the mysql_* functions are archaic!
$sqlOrder = "SELECT * 
             FROM orders 
             WHERE order_id = ".mysql_real_escape_string($orderId);

$order = array();
if ($resOrder = mysql_query($sqlOrder)) {

    if ($rowOrder = mysql_fetch_array($resOrder)) {
        $order = $rowOrder;
        // echo $rowOrder['order_id'].' '.$rowOrder['user_id'].' '.$rowOrder['customer_id']."<br />\n";

        $sqlOrderLines = "SELECT * 
                  FROM order_lines
                  WHERE order_lines.order_id = ".mysql_real_escape_string($orderId);

        if ($resOrderLines = mysql_query($sqlOrderLines)) {
            $order['order_lines'] = array();
            while ($rowOrderLines = mysql_fetch_array($resOrderLines)) {
                $order['order_lines'][] = $rowOrderLines;                 
                // echo $rowOrderLines['order_id'].' '.$rowOrderLines['order_line_id']."<br />\n";
            }
        }
    } else {
        echo 'Order not found'.
    }



} else {
    echo mysql_error();         
}

// debug
print_r($order);