mysql_fetch_array() parameters issue

Question

$uid = $_GET['id'];
echo $sql = "select * from notice where id=$uid";
echo $result = mysql_query($sql);
$row = mysql_fetch_array($result);
    echo $row['headline'];
    echo $row['description'];
    echo $row['image'];

Is producing

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in C:\xampp\htdocs\willammary\staff-admin\edit_notice.php on line 5

There are hundreds of duplicates of this question on SO. Did you check any of them? — Spudley, Aug 22 '13 at 11:02
Besides the obvious SQL injection flaws, the lack of any error handling, the use of the old deprecated MySQL extension, what's the value of id? — Mark Baker, Aug 22 '13 at 11:02

score 0 · Answer 1 · answered Aug 22 '13 at 11:02

Try this,

$uid = $_GET['id'];
echo $sql = "select * from notice where id=".$uid;
echo $result = mysql_query($sql);
if($result === FALSE) {
    die(mysql_error()); // error handling
}
$row = mysql_fetch_array($result);
echo $row['headline'];
echo $row['description'];
echo $row['image'];

Alternatively,

$uid = $_GET['id'];
echo $sql = "select * from notice where id=$uid";
echo $result = mysql_query($sql);
if($result) {
   $row = mysql_fetch_array($result);
   echo $row['headline'];
   echo $row['description'];
   echo $row['image'];
}

Or

$uid = $_GET['id'];
echo $sql = "select * from notice where id=$uid";
echo $result = mysql_query($sql) or die(mysql_error());
$row = mysql_fetch_array($result);
echo $row['headline'];
echo $row['description'];
echo $row['image'];

Also mysql extension is deprecated as of PHP 5.5.0 Read http://www.php.net/manual/en/intro.mysql.php

Maybe you can also address the SQL injection vulnerability. – Michael Berkowski Aug 22 '13 at 11:03 — Michael Berkowski, Aug 22 '13 at 11:03

mysql_fetch_array() parameters issue

1 Answers1