Question

I’ve got a pretty simple request and can’t figure out why it’s wrong:

if ($_GET['linklabel'] !== '')
{
    $query = "SELECT templateid FROM pages WHERE linklabel = {$_GET['linklabel']}";

    $result=mysql_query($query);    

    $templateid = $result['templateid'];

    echo $templateid;

    if ($result !== 0)

    {

        include($templateid.'.php');

    }

    else

    {
        include('404error');
    }
}

The templateid in the table has a VARCHAR value of test. The browser says it can’t locate the file which is test.php

Did I type something wrong?

Echoing the variable $templateid doesn’t output anything either, so my thinking is there’s something wrong with $templateid = $result['templateid'];?

Answer 1

mysql_query() returns a statement handle, not the actual data. You have to fetch rows of data before you can access individual fields from your query results:

$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_assoc($result);
$templateid = $result['templateid'];

also note that you are WIDE OPEN to sql injection attacks and if this going on a public facing website, you can expect to be pwned in very short order.