Code logic should not allow query to go through but it still does PHP SQL

Question

I receive a $_GET['id'] from the URL - I want it only numeric if not go to a 404 page. I believe I should work - but I have new relic that tells me otherwise and im stump. (note i'm working with legacy code so I apologize for the mysql_query commands and i'm aware I should be using PDO instead)

    if(isset($_GET['item']) && is_numeric($_GET['item'])) {
        $id = $_GET['item'];
    }
    else {
        $timestamp = date("Y-m-d");
        $get_item = json_encode($_GET['item']);
        $err = date("Y-m-d").": Get Item is wrong:".$get_item."\n";
        $file = "/logs/error_log_".$timestamp.".log";
        file_put_contents($file, $err, FILE_APPEND | LOCK_EX);
        header( 'Location: http://www.example.com/404.php' ) ;
    }

    $iquery = "SELECT * FROM products WHERE products_id = $id";
    $iresult = mysql_query($iquery);

    if ($iresult == false) {
        $timestamp = date("Y-m-d");
        $err = date("Y-m-d").": SQL:".$iquery."\n";
        $file = "logs/error_log_".$timestamp.".log";
        file_put_contents($file, $err, FILE_APPEND | LOCK_EX);        
        header( 'Location: http://www.examples.com/404.php' ) ;
    }
    $iline = mysql_fetch_array($iresult, MYSQL_ASSOC);

according to my log the query itself receive nothign so $id receives nothing and my log file fires with nothing and new relic fires and tells me that my query is failing.

I don't get it.

Jordan Running · Accepted Answer · 2014-03-14 20:30:16Z

2

It seems like you expect the script to stop after you call header(), but there's nothing in your code that would cause that to happen. header() just adds an HTTP header to the response; it doesn't end your script. If you only want the query to be executed when $_GET['id'] is numeric then you should do the query inside the first if block, not after the else block.

answered Mar 14, 2014 at 20:30

Jordan Running

107k18 gold badges193 silver badges189 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

AD7six Over a year ago

Or: exit after issuing the redirect.

azngunit81 Over a year ago

So when I change the header for the redirect - the browser redirects the user but the script runs till the end and therefore the best way to cut things is an exit if I just dont want it to continue and save myself some time for processing.

Jordan Running Over a year ago

Yeah, more or less. In general PHP will execute your entire script (up to an exit or die, anyway) before sending anything to the browser. If it stopped your script as soon as you called header that would be a problem, since you'd only ever be able to add one header—and sometimes you need to add many different headers.

Collectives™ on Stack Overflow

Code logic should not allow query to go through but it still does PHP SQL

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related