Function arguments php not working

Question

So, I'm trying to get the name of a forum title through a function by using the category_id in the url.

It's not returning the title. Yes, I am including the functions.php.

The link is:

http://www.dxbridge.com/view_category.php?cid=1

functions.php:

function getForumsCategoriesName($cid) {

    $query = "SELECT * FROM categories WHERE id='" . $cid . "'";

    try {
        global $db;
        // Execute the query against the database
        $stmt = $db->prepare($query); 
        $stmt->execute();
        $result = $stmt->fetchAll();
        foreach($result as $forums) {
            $forumsID = $forums['id'];
            $forumsTitle = $forums['category_title'];
            $forumsTopicAmount = $forums['topic_amount'];
            $forumsCategoriesName = "<h1>" . $forumsTitle . "</h1>";
            echo $forumsCategories3;
        }
    }
    catch(PDOException $ex) { 
        // Note: On a production website, you should not output $ex->getMessage(). 
        // It may provide an attacker with helpful information about your code.  
        die("Error loading names"); 
    }
}

trying to grab the name from function

$cid = $_GET['cid'];
getForumsCategoriesName($cid);

Also, I know the variable is being set, it's jsut not going through the function.

Your variable echo $forumsCategories3; doesn't have a value. You have several other variables populated there, but not that one. — Michael Berkowski
– Michael Berkowski, Commented Oct 20, 2014 at 1:50
Always when developing code, turn on PHP's error display. It would be complaining about an undefined variable $forumsCategories3. At the top of you script: error_reporting(E_ALL); ini_set('display_errors', 1); — Michael Berkowski
– Michael Berkowski, Commented Oct 20, 2014 at 1:51
@Ghost points this out below - you are getting none of the security benefit of PDO by passing $cid right into your SQL string. Now is the time to learn to use prepare()/execute() properly with bound parameters. — Michael Berkowski
– Michael Berkowski, Commented Oct 20, 2014 at 1:52

Kevin · Accepted Answer · 2014-10-20 02:00:21Z

You haven't returned/echoed anything (actually you echoed something, an undefined variable). Bind the value, don't directly inject it on the query string:

function getForumsCategoriesName($cid) 
{ 
    $result = array();
    try {
        global $db;

        // Execute the query against the database
        $query = 'SELECT * FROM categories WHERE id = :cid '; // put a named placeholder
        $stmt = $db->prepare($query); 
        $stmt->bindParam(':cid', $cid); // bind the value
        $stmt->execute();
        $result = $stmt->fetchAll(PDO::FETCH_ASSOC);
        return $result; // return the values
        // echo $forumsCategories3; // this doesn't make sense, its undefined.
    }
    catch(PDOException $ex) { 
        // Note: On a production website, you should not output $ex->getMessage(). 
        // It may provide an attacker with helpful information about your code.  
        die("Error loading names"); 
    }
}

Then on usage:

$cid = $_GET['cid'];
$result = getForumsCategoriesName($cid);

foreach($result as $forums) {
    $forumsID = $forums['id'];
    $forumsTitle = $forums['category_title'];
    $forumsTopicAmount = $forums['topic_amount'];
    $forumsCategoriesName = "<h1>" . $forumsTitle . "</h1>";

    echo $forumsID . '<br/>'; // echo everybody else

}

Collectives™ on Stack Overflow

Function arguments php not working

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related