Click here to Skip to main content
15,892,746 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
See more:
why does not the code go... am i stupid?

What I have tried:

PHP
<?php
    $con=mysqli_connect("localhost","root","toor","conferinta");
    if (mysqli_connect_errno())
    {
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
    }
    else
    {
    $query="SELECT articol_id,nume_articol,abstract,nume_fisier FROM articole WHERE an=".$data;
    $result = mysqli_query($con, $query);

    //if (!is_resource($result))
    //{
    //echo "Nu sunt introduse lucrări in baza de date";
    //}
    //else
    {
    while ($row = mysqli_fetch_assoc($result));
    {
    $lista_articole[] = $row['articol_id'];
    $lista_nume_art[] = $row['nume_articol'];
    $lista_abstract[] = $row['abstract'];
    $lista_fisiere[] = $row['nume_fisier'];
    }
    echo '<table width="700" >';
    echo '<tr><td><h5>Contents:</h5></td></tr>';
    foreach ($lista_articole as $key => $value)
    {
    echo '<tr><td align="center"><h6>';
    echo $lista_nume_art[$key];
    echo '</h6></td></tr>';
    $query="SELECT nume,prenume,titulatura FROM autori,autor_articol_titulatura,titulaturi WHERE ((titulaturi.titulatura_ID=autor_articol_titulatura.titulatura_id)AND(autori.autor_id=autor_articol_titulatura.autor_id)&(autor_articol_titulatura.articol_id=".$value."))";
    $result = mysqli_query($con, $query);
    while ($row = mysqli_query($con, $query));
    {
    echo '<tr><td align="center"><h1>';
    echo $row['nume']." ".$row['prenume'];
    echo '<h1> </td></tr>';
    echo '<tr><td align="center"><font color="#000099" size="3">';
    echo $row['titulatura'];
    echo '</font> </td></tr>';
    }
    echo '<tr align="left"><td>Abstract</td></tr>';
    echo '<tr><td align="justify">';
    echo $lista_abstract[$key];
    echo '</td></tr>';
    $link='';
    $link='conferences/'.$data.'/'.$lista_fisiere[$key];
    echo '<tr><td>';
    echo'<a target="blank" href="'.$link.'">';
    echo '<img src="images\pdf.jpg" width="30">Pdf Version</a>';
    echo'</td></tr>';
    }
    echo '</table>';
    }
    }
    ?>
Posted
Updated 12-Sep-18 21:46pm
Comments
Patrice T 13-Sep-18 3:28am    
Define "why does not the code go"
look for error message on php server.
Richard Deeming 13-Sep-18 14:51pm    
Aside from the fact that you haven't declared the variable $data, as mentioned in solution 1; if the value of that variable is in any way controlled by the user, then your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

PHP: SQL Injection - Manual[^]
PHP: Prepared statements and stored procedures - Manual[^]

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

  Print Answers RSS
Top Experts
Last 24hrsThis month


CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900