loops, php and mysql data

[Stat]

Greetings all. I am writing a profile creator script where a user gets
a URL invite in their mail in the form of;

http://domain.com/profile-create.php...d98jadf098asdf

Things are working well except for a small annoyance in which someone
might have a solution to.

In the event that someone accesses profile-create.php without an
access_code the script generates a warning. If there is an access_code
that matches the access code entered in the MySQL database then they
are directed to the profile creation page. My problem is;

If someone accesses profile-create.php with an access_code but it
doesn't match any entries in the database I would like to generate a
warning.

When I try to do this with an else statement it produces an error for
every access code listed in the database which isn't the correct one,
so I could end up with a successful profile creation page with a bunch
of errors.

I've played with break and pattern matching but no results. Here is
the script below.

---------------------------------------------------------------<
<?php

$access_code = $_GET['access_code'];

if ($access_code) {

echo db_connect();

$result = mysql_query('SE LECT random_link FROM invites');

while ($row = mysql_fetch_arr ay($result, MYSQL_NUM)) {

$random_link_db = $row[0];

if ($random_link_d b == $access_code) {
echo profile_creator _page();
}

// Would like to insert an error warning here

}
}

else {
echo "Error!"
}
function profile_creator _page() {
echo "All's well!";
}

?>
---------------------------------------------------------------<

Any ideas?

Regards,
Luc

[Andy Hassall]

On 5 Mar 2005 15:10:38 -0800, st**********@ho tmail.com (Stat) wrote:

Greetings all. I am writing a profile creator script where a user gets
a URL invite in their mail in the form of;

http://domain.com/profile-create.php...d98jadf098asdf

Things are working well except for a small annoyance in which someone
might have a solution to.

In the event that someone accesses profile-create.php without an
access_code the script generates a warning. If there is an access_code
that matches the access code entered in the MySQL database then they
are directed to the profile creation page.
OK, so the access_code was generated when the email was sent and stored in the
MySQL database?
My problem is;

If someone accesses profile-create.php with an access_code but it
doesn't match any entries in the database I would like to generate a
warning.

When I try to do this with an else statement it produces an error for
every access code listed in the database which isn't the correct one,
so I could end up with a successful profile creation page with a bunch
of errors.

I've played with break and pattern matching but no results. Here is
the script below.

---------------------------------------------------------------<
<?php

$access_code = $_GET['access_code'];

That'll raise a warning when access_code isn't passed at all; consider either:

$access_code = isset($_GET['access_code']) ? $_GET['access_code'] : '';

or

$access_code = @$_GET['access_code'];
if ($access_code) {

echo db_connect();

$result = mysql_query('SE LECT random_link FROM invites');
I thought you were looking for a specific access_code? It's somewhat defeating
the point of using a database if you fetch the entire table and match in PHP -
use a WHERE clause in the SQL.
while ($row = mysql_fetch_arr ay($result, MYSQL_NUM)) {
Also, if the invites table is empty, you'll never even get here.
$random_link_db = $row[0];

if ($random_link_d b == $access_code) {
echo profile_creator _page();
}

// Would like to insert an error warning here

}
}

You could replace it with something like:

$result = mysql_query(spr intf(
"SELECT count(*) from FROM invites WHERE random_link = '%s'",
mysql_escape_st ring($access_co de)
) or die(mysql_error ());

// This is a single group aggregate query so you're guaranteed
// one row unless the database is broken.
$row = mysql_fetch_arr ay($result, MYSQL_NUM);

if ($row[0] == 1)
{
echo profile_creator _page();
}
else
{
// Warning - got an access code, but it's not in the DB
}

--
Andy Hassall / <an**@andyh.co. uk> / <http://www.andyh.co.uk >
<http://www.andyhsoftwa re.co.uk/space> Space: disk usage analysis tool

[Jerry Stuckle]

Andy Hassall wrote:

You could replace it with something like:

$result = mysql_query(spr intf(
"SELECT count(*) from FROM invites WHERE random_link = '%s'",
mysql_escape_st ring($access_co de)
) or die(mysql_error ());

Why go to all the overhead of sprintf just to concatenate a string?
This has much less overhead:

$result = mysql_query(
'SELECT count(*) from FROM invites WHERE random_link = \'' .
mysql_escape_st ring($access_co de) . '/'')
or die(mysql_error ());

[stat_holyday]

Slick! I'd never looked at it that way before. This opens up a whole
new can of proverbial worms. Thank you gentlemen.

NOTE: for those who might have a similar problem in the future, there's
an extraneous 'from' in;

'SELECT count(*) from FROM invites WHERE random_link = ...

it should be

'SELECT count(*) FROM invites WHERE random_link = ...

[NSpam]

st**********@ho tmail.com wrote:

Slick! I'd never looked at it that way before. This opens up a whole
new can of proverbial worms. Thank you gentlemen.

NOTE: for those who might have a similar problem in the future, there's
an extraneous 'from' in;

'SELECT count(*) from FROM invites WHERE random_link = ...

it should be

'SELECT count(*) FROM invites WHERE random_link = ...

bear in mind that one is operating in a stateless asynychronous
environment. Don't make any assumptions as to the content of any
variable passed to the script

[Andy Hassall]

On Sat, 05 Mar 2005 20:10:09 -0500, Jerry Stuckle <js*******@attg lobal.net>
wrote:

Andy Hassall wrote:

You could replace it with something like:

$result = mysql_query(spr intf(
"SELECT count(*) from FROM invites WHERE random_link = '%s'",
mysql_escape_st ring($access_co de)
) or die(mysql_error ());

Why go to all the overhead of sprintf just to concatenate a string?
This has much less overhead:

$result = mysql_query(
'SELECT count(*) from FROM invites WHERE random_link = \'' .
mysql_escape_st ring($access_co de) . '/'')
or die(mysql_error ());

Readability mostly, particularly when you end up with more than one variable.
It's sort of a poor-man's placeholder system.

You've also demonstrated another reason in your response; you've got your
quoting wrong.

The overhead of a call to sprintf is negligable particularly compared with
external calls to a database.

--
Andy Hassall / <an**@andyh.co. uk> / <http://www.andyh.co.uk >
<http://www.andyhsoftwa re.co.uk/space> Space: disk usage analysis tool

[Andy Hassall]

On 5 Mar 2005 19:28:39 -0800, st**********@ho tmail.com wrote:

Slick! I'd never looked at it that way before. This opens up a whole
new can of proverbial worms. Thank you gentlemen.

NOTE: for those who might have a similar problem in the future, there's
an extraneous 'from' in;

'SELECT count(*) from FROM invites WHERE random_link = ...

Whoops :-)

--
Andy Hassall / <an**@andyh.co. uk> / <http://www.andyh.co.uk >
<http://www.andyhsoftwa re.co.uk/space> Space: disk usage analysis tool

[Michael Fesser]

.oO(Jerry Stuckle)

Why go to all the overhead of sprintf just to concatenate a string?
The code looks better and is easier to maintain, especially if you have
to embed multiple values into the string.
This has much less overhead:

But is ugly and buggy. And BTW: Who cares about the overhead when
creating a DB query string? That's peanuts.

Micha

[Jerry Stuckle]

Michael Fesser wrote:

.oO(Jerry Stuckle)

Why go to all the overhead of sprintf just to concatenate a string?

The code looks better and is easier to maintain, especially if you have
to embed multiple values into the string.

In your opinion. I find just the opposite.

This has much less overhead:

But is ugly and buggy. And BTW: Who cares about the overhead when
creating a DB query string? That's peanuts.

Depends on the query and the database. Some database calls can be very
quick, for instance, if handled from the cache, and may have very little
overhead. But sprintf has significantly more overhead than simple
concatenation.

Micha

[Jerry Stuckle]

Andy Hassall wrote:

On Sat, 05 Mar 2005 20:10:09 -0500, Jerry Stuckle <js*******@attg lobal.net>
wrote:

Andy Hassall wrote:

You could replace it with something like:

$result = mysql_query(spr intf(
"SELECT count(*) from FROM invites WHERE random_link = '%s'",
mysql_escape_st ring($access_co de)
) or die(mysql_error ());

Why go to all the overhead of sprintf just to concatenate a string?
This has much less overhead:

$result = mysql_query(
'SELECT count(*) from FROM invites WHERE random_link = \'' .
mysql_escape_st ring($access_co de) . '/'')
or die(mysql_error ());

Readability mostly, particularly when you end up with more than one variable.
It's sort of a poor-man's placeholder system.

You've also demonstrated another reason in your response; you've got your
quoting wrong.

The overhead of a call to sprintf is negligable particularly compared with
external calls to a database.

Depends on the actual query to the database. And sprintf has much more
overhead than simple concatenation.

Yes, there's a minor bug - I used a forward slash where I should have
used a backslash. The parser would catch that bug. A similar bug can
happen in sprintf - but the parser might not catch it. And, BTW, you
had an extra "from" in your statement (which I didn't catch, either).

As for readability - to each his own. I find simple concatenation to be
much easier to read than sprintf. Others may find otherwise.

Jerry