-1

Im facing an issue with my php script connecting to mysql:

    $Category = $_POST["Category"];
$Name = $_POST["Name"];

//Check if name exists
$namecheckquery = "SELECT Name,EnergyLevel,Range,Price,Catergory,Owner FROM LVM_Tools WHERE Owner IS NULL
        AND Catergory = '".$Category."' AND Name='".$Name."' LIMIT 1";

$namecheck = mysqli_query($con, $namecheckquery) or die("SOLD OUT");

image from mysql

I checked everything 100 times and still cant solve it.

the $Catergory gets "MetalDetector" and $Name gets "TH-1000"

I keep getting the "SOLD OUT" message

Can someone please help me solve my issue??

Dharman
  • 26,923
  • 21
  • 73
  • 125
MitchZ
  • 1
  • 4
  • 1
    I have no idea why you're printing SOLD OUT if your query fails – Your Common Sense May 11 '22 at 19:36
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) – Dharman May 11 '22 at 21:21
  • If your query has a bug, you should fix the bug and not display a message like "SOLD OUT" – Dharman May 11 '22 at 21:22

0 Answers0