Click here to Skip to main content
15,900,724 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
See more:
why does not the code go... am i stupid?

What I have tried:

PHP
<?php
    $con=mysqli_connect("localhost","root","toor","conferinta");
    if (mysqli_connect_errno())
    {
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
    }
    else
    {
    $query="SELECT articol_id,nume_articol,abstract,nume_fisier FROM articole WHERE an=".$data;
    $result = mysqli_query($con, $query);

    //if (!is_resource($result))
    //{
    //echo "Nu sunt introduse lucrări in baza de date";
    //}
    //else
    {
    while ($row = mysqli_fetch_assoc($result));
    {
    $lista_articole[] = $row['articol_id'];
    $lista_nume_art[] = $row['nume_articol'];
    $lista_abstract[] = $row['abstract'];
    $lista_fisiere[] = $row['nume_fisier'];
    }
    echo '<table width="700" >';
    echo '<tr><td><h5>Contents:</h5></td></tr>';
    foreach ($lista_articole as $key => $value)
    {
    echo '<tr><td align="center"><h6>';
    echo $lista_nume_art[$key];
    echo '</h6></td></tr>';
    $query="SELECT nume,prenume,titulatura FROM autori,autor_articol_titulatura,titulaturi WHERE ((titulaturi.titulatura_ID=autor_articol_titulatura.titulatura_id)AND(autori.autor_id=autor_articol_titulatura.autor_id)&(autor_articol_titulatura.articol_id=".$value."))";
    $result = mysqli_query($con, $query);
    while ($row = mysqli_query($con, $query));
    {
    echo '<tr><td align="center"><h1>';
    echo $row['nume']." ".$row['prenume'];
    echo '<h1> </td></tr>';
    echo '<tr><td align="center"><font color="#000099" size="3">';
    echo $row['titulatura'];
    echo '</font> </td></tr>';
    }
    echo '<tr align="left"><td>Abstract</td></tr>';
    echo '<tr><td align="justify">';
    echo $lista_abstract[$key];
    echo '</td></tr>';
    $link='';
    $link='conferences/'.$data.'/'.$lista_fisiere[$key];
    echo '<tr><td>';
    echo'<a target="blank" href="'.$link.'">';
    echo '<img src="images\pdf.jpg" width="30">Pdf Version</a>';
    echo'</td></tr>';
    }
    echo '</table>';
    }
    }
    ?>
Posted
Updated 12-Sep-18 21:46pm
Comments
Patrice T 13-Sep-18 3:28am    
Define "why does not the code go"
look for error message on php server.
Richard Deeming 13-Sep-18 14:51pm    
Aside from the fact that you haven't declared the variable $data, as mentioned in solution 1; if the value of that variable is in any way controlled by the user, then your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

PHP: SQL Injection - Manual[^]
PHP: Prepared statements and stored procedures - Manual[^]

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900